Privacy Policy

Service: Spelly (the “Service”): the website at https://spelly.net and the Spelly apps for Android and iPhone

Operated by: Importify Limited (“we”, “us”, “our”)

Registered address: Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong

Privacy contact: support@spelly.net

1. Overview

This Privacy Policy explains what information Spelly collects, how we use it, who we share it with, and the choices and rights you have. It applies to the Spelly website, the web and mobile applications, and the Spelly browser extension (see section 9). By using Spelly, you agree to this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

a) Information from Google Sign-In, Sign in with Apple, or email sign-up

An account is created by a parent, guardian or teacher, using Google Sign-In (Google OAuth), Sign in with Apple (iOS app only), or an email address with a password or a sign-in code we email. When you choose to sign in with Google, we receive from your Google account:

• Your name
• Your email address
• Your Google profile picture (if available)
• A unique Google account identifier

We do not receive or store your Google password.

With Sign in with Apple we receive your name (if you choose to share it), your email address or Apple's private relay address, and an Apple account identifier. With email sign-up we hold your email address and a hashed password.

b) Profile and learning information you provide

• A first name or nickname for the child, if one is entered (it is optional), and, in the classic version of Spelly, an age
• For teachers using Track my class: the student first names you type into a class roster, the first name a student picks or types when opening the shared list, and each student's results on that list
• Practice language, definition language, and difficulty level
• Word lists you create, scan, or generate, and lists you save
• Words you add to your filter list and your app settings

c) Usage and progress data

• Learning progress such as XP, levels, coins, streaks, achievements, and quest progress
• Practice results (e.g., number of words attempted and answered correctly)
• We keep the wrong spellings children type, combined across many children and never linked to any child, to make practice better (for example, to show the mistakes children make most often).
• We keep which words a child has missed and the kind of mistake (for example, a double letter) with their progress, so Spelly can notice when they get it right later and build their Words to practice list. We do not keep the wrong spelling itself with the child's account, with one exception: when someone taps Too easy, Too hard or Report under an answer, that answer is saved with the feedback so we can look into it.

d) Content you submit for AI features

• Topics or words you type to generate or define words
• Images you upload (e.g., a photo of a spelling worksheet) so we can extract the words from them. The photo is sent to our AI provider for reading and is not stored by Spelly once the words have been extracted — only the words are kept, in your list.
• On spelly.net, before you have an account, the Try Spelly box can read one worksheet photo a day. The photo is sent to our AI provider (OpenAI) to find the words, which are shown to you and are not stored unless you create an account and save them. If you use your phone to send a photo to a computer, the photo waits on our server only until that computer receives it, and is deleted within the hour.

e) Technical data

• Authentication/session cookies needed to keep you signed in
• Limited technical and log information (such as request metadata) used for security and reliability
• Locally stored data in your browser (e.g., cached voice audio, theme preference)
• For features a visitor can use without an account (such as one worksheet read a day), a one-way code made from your network address and the date, used only to keep those features to their limits. It cannot be turned back into the address, and it is deleted after 30 days.
• When you ask for a sign-in code by email, one-way codes made from the email address and your network address, used only to limit how many codes can be asked for. They cannot be turned back into either, and they are deleted after 30 days.
• Your approximate country, worked out once from your internet address at sign-up, so we know where Spelly is used. We don't keep the address and never use precise location.
• How you found Spelly, saved once at sign-up: the site you came from, the first page you opened, any campaign tags in the link, and the kind of device (phone, tablet or computer).
• When someone opens a shared list link without an account: a random visitor id kept in that browser and what was done on the list (opened, played, finished). It carries no name and no address.
• Messages you send through the contact form or by email, with the name and email address you give.
• Page views on the website and in the apps, counted by Cloudflare Web Analytics. It uses no cookies and does not identify or follow anyone (see section 8).
• In the Android and iOS apps, a device identifier for notifications (a push token from Firebase Cloud Messaging or Apple Push Notification service). It is used only to deliver practice reminders a grown-up has turned on, which can be turned off at any time in Settings, and is never used for advertising.

3. How We Use Your Information

• To create, secure, and manage your account and keep you signed in
• To provide the Service and personalize your learning experience
• To power AI features (word generation, definitions, text-to-speech, and image/worksheet scanning)
• To save your word lists, settings, and track your progress across devices
• To build Spelly's shared word library, a bigger collection of words for all our users, with voices, meanings and ready-made lists by age and grade. The words people add to their lists are combined across users. We use single words that appear in lists from several different families, never a whole list, a list name, or anything that could identify you or your child. Combined practice statistics that identify no one (for example, how often children spell a word correctly) help us sort those words by difficulty.
• To process purchases and manage premium access
• To maintain security, prevent abuse, and comply with legal obligations
• To respond to your support requests

We do not use your information for third-party advertising, and we do not sell your personal information.

4. Google User Data & Limited Use

Spelly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• We only request the basic profile and email information needed to sign you in and create your account.
• We use Google user data solely to provide and improve the Spelly features described in this Policy.
• We do not sell Google user data, and we do not use it for advertising.
• We do not transfer Google user data to others except as needed to provide the Service (see “Service Providers” below), for security or legal reasons, or in connection with a merger or acquisition with appropriate notice.
• We do not use Google user data to develop, improve, or train generalized AI/ML models.

5. AI Processing

To deliver AI features, we send the relevant content you provide — for example a topic, a word, or an uploaded image of a word list — to our AI provider (OpenAI) for processing, and we return the result to you. We do not send your Google sign-in credentials to the AI provider.

To improve performance, some generated results (such as definitions and pronunciation audio) may be cached in our systems or in your browser.

6. How We Store and Protect Information

• Account, profile, progress, and word-list data are stored in our cloud database and authentication provider (Supabase), in India.
• The application is hosted on Railway, in Singapore.
• Data is transmitted over encrypted connections (HTTPS/TLS).
• Access to personal data is restricted to what is needed to operate the Service.

No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

7. Service Providers We Share Data With

We share data only with providers that help us operate the Service, and only as needed:

• Google and Apple — sign-in / authentication, when you choose them
• Supabase — authentication and database hosting
• OpenAI — AI text generation, text-to-speech, and image/word extraction
• ElevenLabs — text-to-speech (receives only the words to be spoken)
• Google Firebase Cloud Messaging and Apple Push Notification service — delivery of app notifications, using the device push token described above
• Railway — application hosting and infrastructure
• PayPro Global — our authorized reseller and payment processor (Merchant of Record) for purchases made on the website; it handles your payment and billing details. We do not store full payment card numbers.
• Google Play and the Apple App Store — payment processing for purchases made inside the Android and iOS apps. We receive a purchase token to verify the purchase, never your payment details.
• ipwho.is, country.is and geojs.io: country lookup at sign-up. One of them receives the internet address, once, and returns the country; we store only the country.
• Postmark (ActiveCampaign) — delivery of account and service emails (welcome, purchase confirmation, practice reminders you can opt out of)
• Cloudflare — Web Analytics, which counts page views without cookies
• Namecheap (Private Email) — the support mailbox; it holds the emails you send us
• YouTube (Google) — one video on the home page of the website, loaded from youtube-nocookie.com
• MyMemory and the Free Dictionary API — in the classic version of Spelly only, a translation or meaning lookup that receives the word

These providers process data on our behalf under their own terms and security commitments. We do not sell your personal information to anyone.

8. Cookies and Local Storage

We use only the cookies needed to sign you in and keep your session active. We also keep some preferences and cached content (such as voice audio and your language) in your browser's local storage. We do not use advertising or tracking cookies, so there is no cookie banner. Cloudflare Web Analytics counts page views, on the website and in the apps, without cookies and without building a profile of anyone. The video on the home page is loaded from YouTube's privacy-enhanced address (youtube-nocookie.com), which sets no cookies unless you play it.

9. Spelly Browser Extension

We offer an optional Spelly extension for Chrome. It builds a spelling list three ways — from the web page you are already looking at, from a ready-made topic, or from a photo of a worksheet — and lets you save it to your Spelly word lists. You do not need the extension to use Spelly, and installing it is entirely your choice.

a) What the extension reads, and where

By default the extension reads a page only when you ask it to, by pressing “Grab words from this page”. It has no standing access to your browsing. If you want it to check pages as you go, so the toolbar icon can tell you a list is there before you click, you can switch that on in the extension’s settings — Chrome will ask your permission, and switching it back off hands that permission back.

Either way, the analysis happens entirely on your own computer. The extension examines the page for list-shaped content, checks the words against a dictionary bundled inside the extension itself, and then discards what it looked at. The contents of the pages you browse are not transmitted to us, not to any third party, and not to any AI service. Neither is the address of the page you are on: the extension uses it only to suggest a name for your list, and it never leaves your browser.

The ready-made topic lists are bundled inside the extension. Choosing one involves no network request at all.

b) What is sent to Spelly, and when

Nothing leaves your browser automatically. Two things are sent, and each one only because you pressed a button:

• The list you save. We receive the words you chose to keep and the name you gave the list, so it can be saved to your account. You can remove any word before saving.
• A photo you choose to upload. If you use the photo option, the image is sent to spelly.net, along with the language your child practises in so the words can be read in the right language, and passed to an AI text-recognition provider (OpenAI) to read the words off it. We do not keep the image afterwards, and it is not used to train anyone’s model. Only the words it found come back to the extension, where you review them before saving. Worth knowing: a school worksheet often has your child’s name written at the top, so whatever is visible in the photo you choose is part of what you send. Crop or cover anything you would rather not share.

The extension makes no other network request of any kind, and it can only communicate with spelly.net.

c) Your account inside the extension

A free Spelly account is needed to save lists, to see lists you have already saved, and to read photos. Building a list from a page or a topic works without one. Signing in opens spelly.net in an ordinary browser tab — the extension never sees or stores your password. It uses the same sign-in cookie your browser already holds for spelly.net.

When you are signed in, the extension shows your email address in its settings so you can tell which account is in use, and the names and word counts of your saved lists so you can practise one directly. It does not send either of those anywhere. Your interface language is saved to your Spelly account so the website and the extension agree on it, and so it follows you to another computer — it is a display preference and nothing more. Signing out from the extension clears your spelly.net sign-in in every tab, exactly as signing out on the website would.

d) What the extension stores

• Words found on the current tab, held in temporary session storage and erased when you close your browser
• Your preference for whether the extension checks pages automatically, which you can switch off at any time
• The interface language and your child’s practice language, as chosen in the extension’s settings
• A count of how many times you have opened it, used only to stop showing a first-run tip

The extension does not store your browsing history, does not build a profile of the sites you visit, and contains no analytics or tracking code.

e) Permissions and why they are needed

• Access to the page you are on — granted for one tab at a time, at the moment you press “Grab words from this page”. Used only for the local analysis described above.
• Access to all sites (optional) — not requested when you install, and never required. Only if you switch on automatic checking, and revoked when you switch it off.
• Access to spelly.net — required to save a list, to show the lists you already have, to read an uploaded photo, and to sign out. Uses the sign-in you already have; the extension never asks for your password.
• Storage — for the temporary per-tab results and the preferences described above.
• Context menu — to add the “Add to Spelly” option when you right-click selected text.

f) Limited use

We use data from the extension solely to provide the features you asked for: saving a word list to your account, showing you the lists already in it, and reading a photo you uploaded. We do not use it for advertising, we do not sell it, and we do not share it with third parties beyond the text-recognition provider named above. Removing the extension from your browser deletes everything it stored locally; word lists you already saved remain in your Spelly account until you delete them.

10. Children's Privacy

Spelly is designed for children aged 6 to 12 to use with a parent, guardian or teacher. Children's privacy is built into how the Service works:

• Signing in. The account is created by a parent, guardian or teacher, and belongs to them. Google Sign-In, Sign in with Apple and email sign-up are the only ways in; a Google account for a child under 13 is one a parent manages, under Google's own rules. A child should not create an account on their own.
• What we hold about the child is limited to the sign-in details above, what is entered in Spelly (an optional first name or nickname, a practice language, and an age in the classic version) and the child's activity in Spelly (words practised, results, XP, streaks and creatures). Spelly itself does not ask for a phone number, photo or location.
• No advertising. Spelly shows no ads and contains no advertising SDKs. The only analytics is a cookieless count of page views (section 8). We do not sell personal information and we do not use children's data for marketing.
• Purchases require a grown-up. In the mobile apps, the one-time unlock sits behind a grown-up check and is completed through Google Play or the App Store, which apply their own purchase authentication. The optional practice reminders we email go to the address on the account, and every one of them has a one-tap unsubscribe.
• Students on a shared class list practise from a link without creating an account. The teacher who shared the list can see each student's first name and results on that list. Apart from the random visitor id described in section 2, we hold nothing else about them.
• Deleting a child's data. The account holder can delete the account and everything in it at any time from Settings or at spelly.net/delete-account. Deletion is permanent.

A parent or guardian who creates an account for their child, or lets their child use Spelly, consents to the collection described in this policy. Teachers who create accounts for classroom use do so under their school's authority. If you are a parent or guardian and believe your child created an account without your consent, or that we hold information about a child without appropriate consent, contact support@spelly.net and we will delete it.

11. Your Rights and Choices

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. A parent or guardian can ask to see or delete what we hold about their child, and can ask us to stop collecting it. You can also complain to the data protection authority where you live.

We use personal data to provide the Service you signed up for, to keep it secure and improve it (our legitimate interests), to meet legal obligations, and, for the reminders you turn on, with your consent, which you can withdraw at any time.

• You can view and edit much of your profile information inside the app.
• You can revoke Spelly's access to your Google account at any time from your Google Account settings.
• To delete your account and all associated data yourself, go to spelly.net/delete-account, or open the menu in the app and choose Delete account. You can also email support@spelly.net to request deletion, and we will complete it within 7 days.

12. Data Retention

We keep your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we permanently erase your personal data, including your profile, saved word lists, and all progress and gamification data. The one exception is payment and transaction records, which we may keep where the law requires it for legal, tax, and accounting purposes, and only for the period the law requires. We do not use retained records for anything else. Words in the shared word library and combined statistics that no longer identify anyone (section 3) can stay after an account is deleted.

13. International Transfers

We are based in Hong Kong. Your data is stored in India and Singapore and is handled by the service providers in section 7, most of which are in the United States. These countries may not have the same data protection laws as the country where you live.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate. Continued use of the Service after changes take effect means you accept the updated Policy.

15. Contact Us

Questions about this Policy or your data? Contact us at support@spelly.net.