Back to home

Built to the UK Children’s Code

Privacy

No accounts, no tracking, no adverts. This page explains what Spellito stores locally, what it sends for parent word lists, and how to ask us to delete anything held server-side.

Last updated: 13 June 2026

👋 What Spellito does with your stuff

Here’s the short version, in plain English:

  • No sign-up, no grown-up account. You can ask Spellito to remember a first name and a preset badge, but those stay in your browser so the app can say hello. We don’t see them.
  • Your practice stays on your device. The words you’ve practised and how you did — those are saved in your browser, like a bookmark. We don’t see them.
  • If a grown-up types in your spelling list, we send those words to a clever computer at Google so it can write the practice sentences and the teacher’s voice. Google has promised us, in writing, that it won’t use your words to teach its computer new things.
  • We don’t show you adverts. Ever.
  • We don’t share anything about you with other companies for marketing.

If you ever want to make Spellito forget everything, ask a grown-up to clear your browser’s site data — that wipes it all in one go.

For parents and carers — the detail

Spellito is built to the UK Children’s Code. This section covers what UK GDPR Article 13 requires us to tell you. It is longer than the kid summary above on purpose — but the substance is the same.

Who runs Spellito

Spellito is operated by Wacky Works Digital, a UK-based digital studio. For any privacy question or request, email privacy@spellito.com.

What personal data we process

Very little, by design. We don’t ask for or store on our servers:

  • Your child’s last name, age, or date of birth.
  • Your name, email address, phone, or address.
  • Any account credentials — there are no accounts.
  • Any location, device fingerprint, or advertising ID.

What we DO process:

On your device (browser localStorage)
An optional first name for local greetings, a preset profile badge, the year band you picked (Reception–Year 6), your practice preferences (typing, drag-the-letters, or showing the word to copy), the last 100 spelling attempts (which word, year, answer typed, right or wrong, how long it took), and any weekly word lists you’ve typed in. None of this profile or progress data is transmitted to us — it lives on your device until you clear it.
On our servers (Supabase, EU/UK)
When you submit a weekly word list, the word + sentence pairs are stored in our database alongside an unguessable ID, so we can generate the teacher voice clips for them. There is no link between this row and any identifier we hold about you. The audio clip itself is stored in a public bucket, keyed by a content-derived hash — two parents who submit the same word reuse the same clip.
Standard server logs (Vercel)
Like any website, our hosting provider records request metadata (IP address, browser user-agent, page visited, status code). This is held briefly per Vercel’s standard retention and used only for operational troubleshooting.

What we send to third parties

  • Google (Vertex AI) — when you submit a weekly word list, we send the words to Google Vertex AI so it can write the practice sentences and produce the teacher voice MP3s. Vertex AI operates under Google’s enterprise data-processing agreement, which contractually prohibits Google from using your submissions to train its models — this is the substantive difference between Vertex AI and the consumer Gemini API, and it is the reason we chose Vertex. Processing currently takes place in Google’s us-central1 region (Iowa, USA) because that is the only region where the voice-generation model is available today; we will move it to an EU region as soon as Google makes the model available there. Even so, we recommend not using your child’s name as a practice word — defence in depth.
  • Supabase — our managed database and audio storage provider, operating under a UK GDPR Article 28 data processing agreement.
  • Vercel — our hosting provider, operating under a UK GDPR Article 28 data processing agreement.

We never sell or share data for advertising or marketing. There is no analytics SDK on this site (no Google Analytics, no PostHog, no Plausible, nothing).

Lawful basis

For the minimal data we do process, our lawful basis under UK GDPR Article 6 is legitimate interests — the interest in providing a free, ad-free spelling-practice tool for primary-school children, balanced against (and not outweighing) the rights and freedoms of the children practising. We have completed a documented Legitimate Interests Assessment.

How long we keep it

  • On your device (localStorage):as long as you don’t clear your browser’s site data. We have no remote handle on this — it’s entirely under your control.
  • Parent-submitted word lists in our database (Supabase Postgres): automatically deleted 90 days after they are submitted, by a daily cron job.
  • Audio clips for parent-submitted lists (Supabase Storage): same daily cron also removes the audio MP3s belonging to expired lists, provided no other still-active list shares the same clip.
  • Curriculum audio (committed in the app bundle): not deleted — these are the pre-recorded teacher-voice MP3s for the standard SATs curriculum words, contain no user data, and ship as static content with the app.
  • Standard server logs (Vercel):retained per Vercel’s default plan policy.

Your rights

Under UK GDPR you have the right to be informed, to access your personal data, to correct it, to have it erased, to object to processing, and to lodge a complaint with the UK Information Commissioner’s Office (ICO).

Because we don’t hold a server-side identifier for you, most of these rights are satisfied directly by your browser’s site-data controls. If you want us to remove a specific word list from our servers, email privacy@spellito.com with the words (e.g. “please delete my list with the words prejudice, programme, relevant”) and we’ll match and purge.

You can complain to the ICO at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

International transfers

Our database (Supabase) and audio storage are hosted in the EU/UK (eu-west-2, London).

Sentence generation and voice synthesis (Google Vertex AI) are currently performed in Google’s us-central1 region (Iowa, USA). This transfer relies on Google LLC’s certification under the EU-US Data Privacy Framework and the UK Extension to that Framework — a transfer mechanism published by the UK government as providing an adequate level of protection for personal data transferred from the UK to certified US recipients. We will switch the inference region to an EU location as soon as Google makes the voice model available there.

Cookies and similar

We don’t set tracking cookies. The browser-side preferences described above are stored using the standard localStorage API, not cookies, and are not used to identify or track you.

Children specifically

Spellito is designed for UK primary-school children (Reception–Year 6, ages 4–11). We maintain a Data Protection Impact Assessment (DPIA) against the ICO’s Children’s Code 15 standards. Specifically: we do not profile children, we do not use nudge techniques, the default settings are the most private settings, and there are no features that depend on server-stored children’s personal data.

Changes to this notice

If we change what we collect or how we use it, we’ll update the “last updated” date at the top of this page. For material changes (new third parties, new categories of data), we’ll surface a notice on the home page until you’ve seen it.

Back to Spellito