UK Children’s Code
Safeguarding
Spellito is built for primary-school children, so the default is simple: collect as little as possible, keep guest practice on the device, limit signed-in progress to the parent and confirmed class, and avoid adverts, tracking, commercial profiling, or child-facing pressure.
Last reviewed: 11 August 2026
What this means for kids
No strangers
There is no chat, no friend requests, and no public profile.
No tracking
Spellito does not follow you round the web or sell anything about you.
No recordings
You hear Spellito. Spellito never records your voice or asks for your photo.
For parents and carers
This page is the public summary of Spellito’s safeguarding posture. The internal DPIA, or Data Protection Impact Assessment, is maintained separately and re-audited whenever the app adds a new data flow or third-party processor.
Anonymous by design
Guest practice does not require sign-up, email, birthday, address, photo, or voice recording. If a child asks Spellito to remember a first name, it stays on the device for local greetings only.
Device-first practice
A guest's year and practice attempts stay in the current tab and clear when it closes. If a child asks Spellito to remember a first name, their local profile persists in that browser and clears after 12 months without use or from Settings. Signed-in practice also syncs to the parent-owned child profile so it can be exported or deleted with that profile.
Private family progress
Only the signed-in parent who owns a child profile can open that child's practice-time, lifetime-accuracy, tricky-word and curriculum-mastery views. This is limited educational profiling: it summarises learning progress without advertising, recommendations or significant automated decisions.
Confirmed-class boundary
A private invitation reveals only official school/class details and teacher names inside a parent account; it never links a child automatically. A teacher sees no practice while the parent's request is waiting. After confirmation, that exact class can see aggregate progress and a curriculum-word matrix populated only from then on, but never raw attempts or typed answers. Empty cells contain only shared curriculum words. Active answer time is not background screen time.
Draft work stays with the class
A teacher spelling set belongs to one exact class and is readable only by its current registered teachers. Saving a draft never assigns it to a child; publishing is a separate deliberate step.
AI with controls
Microsoft Azure writes missing practice sentences from adult-supplied words without receiving an account profile or spelling answer. Google Vertex AI permanently supplies the approved voices: it receives a finished Teacher script for missing school-word audio or, only after parent consent, a first name inside fixed Spellito or buddy copy without a linking account, school, answer or progress record. Both runtime paths use enterprise terms that prohibit training on Spellito prompts. Public curriculum audio generation uses public-domain vocabulary only.
Children’s Code checks
Spellito’s internal self-assessment maps the Information Commissioner’s Office (ICO) Children’s Code standards against the current app. The current build records strong positions for data minimisation, transparency, no commercial profiling, no geolocation, no detrimental use of data, and private defaults. Signed-in child home and practice screens now show an obvious sign that saved progress is visible to their grown-up and, only while the exact class link is confirmed, their class teacher.
- No adverts or behavioural marketing.
- No public child profiles or child-to-child messaging.
- No geolocation, device fingerprinting, or third-party analytics.
- No voice recordings, photos, or child email addresses.
- Teacher progress starts only after parent-authorised class confirmation.
- A class invitation never enrols a child by itself.
- A draft teacher set never assigns work by itself.
- Plain-English privacy and terms pages.
- A 90-day purge process for runtime-generated server content.