This app is designed for children aged 5–11. Parents and guardians create profiles and control all data. We do not knowingly collect personal data directly from children, and we do not sell any personal data.
1. Who we are
Data controller: SpellBands (a trading name, pending incorporation).
Website: www.spellbands.co.uk
Privacy contact: privacy@spellbands.co.uk
We are registered with the UK Information Commissioner's Office (ICO) as required under UK data protection law. Our registration details are available at ico.org.uk.
EU residents: SpellBands primarily serves UK users. If you are located in the European Economic Area (EEA), the EU GDPR applies to our processing of your data in addition to UK GDPR. Our processing of EU residents' data is occasional, not large-scale, and does not involve special categories of data or systematic monitoring; we therefore fall within the Article 27(2)(a) exemption and have not appointed a formal EU representative. For any EU data protection queries, contact privacy@spellbands.co.uk.
2. Data stored on your device (no account required)
By default, all child profiles and progress are stored in your device's local storage and are never sent to our servers. No account is required to use the app.
| Data | Purpose | Lawful basis |
|---|---|---|
| Child profile name and age band | Personalise gameplay | Legitimate interests (Art. 6(1)(f)) |
| Spelling progress, levels, streaks | Save learning journey | Legitimate interests (Art. 6(1)(f)) |
| Badges and achievements | Motivation | Legitimate interests (Art. 6(1)(f)) |
| Theme, avatar, sound preferences | User preferences | Legitimate interests (Art. 6(1)(f)) |
| Signed entitlement token | Unlock paid content after purchase | Contract (Art. 6(1)(b)) |
| Word etymology cache (words only, no names) | Performance: avoids repeated API calls | Legitimate interests (Art. 6(1)(f)) |
| Text-to-speech usage counters | API budget management (no identity data) | Legitimate interests (Art. 6(1)(f)) |
Legitimate interests: we have assessed that storing this data locally is necessary to provide the service, is proportionate, and does not override the interests of parents or children given that no data leaves the device by default.
3. Optional parent account
Parent and guardian accounts are for adults aged 18 and over only. Children do not create accounts.
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address | Account sign-in and recovery | Contract (Art. 6(1)(b)) |
| Optional display name | Account personalisation | Contract (Art. 6(1)(b)) |
| Purchase entitlement flag | Verify paid access | Contract (Art. 6(1)(b)) |
Cloud sync of child profiles is not currently active; profile data remains on your device only.
4. Purchases
- Web (Stripe): Payment is processed by Stripe, Inc. We receive confirmation of payment and entitlement status. We do not receive or store card numbers.
- iOS (Apple) and Android (Google): Payment is processed by Apple or Google. We receive entitlement status via RevenueCat. We do not receive card details.
Lawful basis: Contract (Art. 6(1)(b)).
Web purchases come with a 7-day money-back guarantee. See our Terms of Service for details. To request a refund, contact support@spellbands.co.uk.
5. Feedback
If you submit feedback, we may store your message, optional contact email, optional user ID, and a hashed IP address (for rate limiting, capped at five submissions per hour). We do not store raw IP addresses.
Lawful basis: Legitimate interests (Art. 6(1)(f)): responding to user feedback and preventing abuse.
6. Optional online features
Text-to-speech (Microsoft Azure)
If you enable spoken pronunciation, individual words are sent to Microsoft Azure Speech Services (UK South region). No child names, profile data, or progress are transmitted. The default speech engine processes audio entirely on your device.
Lawful basis: Legitimate interests (Art. 6(1)(f)).
Word Detective (dictionaryapi.dev)
Individual words are sent to dictionaryapi.dev to retrieve definitions. No personal data is transmitted.
7. Marketing analytics: website only, consent required
We use the Meta Pixel (ID 2028526094425499) on our marketing website to measure whether our Facebook and Instagram advertisements lead to website visits and purchases. The Pixel is not loaded until you click Accept on our cookie banner. If you ignore the banner, close the page, or click Reject, no advertising cookies or tracking scripts are loaded. See our Cookie Policy for full details including cookie durations and how to withdraw consent.
We track pricing page views and checkout events only. We never send child names, spelling progress, or profile data to Meta.
Lawful basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time by clearing your browser's site data for spellbands.co.uk.
8. Children's privacy
SpellBands is designed for children aged 5–11, used under parental supervision.
- We do not knowingly collect contact information directly from children.
- Child profiles are created and managed by parents or guardians on their own device.
- We do not profile children for commercial advertising purposes.
- We do not sell children's personal data.
- The Meta Pixel only fires on the parent-facing marketing website; it is not active inside the game or children's profile screens.
- We comply with the UK Children's Code (Age Appropriate Design Code) and apply its principles throughout the app's design.
If you believe a child has provided personal data without appropriate parental consent, please contact privacy@spellbands.co.uk and we will delete it promptly.
9. Who we share data with
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, edge functions | Parent email, entitlement status, feedback | EU (Frankfurt) with UK IDTA safeguards |
| Vercel | Website hosting | Standard server access logs | Global CDN |
| Stripe, Inc. | Web payment processing | Payment metadata (not card numbers) | USA (SCCs in place) |
| Apple / Google / RevenueCat | App purchase processing | Store transaction identifiers, entitlement status | USA (SCCs in place) |
| Microsoft Azure | Optional text-to-speech | Words only (no personal data) | UK South |
| dictionaryapi.dev | Word definitions | Words only (no personal data) | Unknown (words only) |
| Meta Platforms, Inc. | Marketing analytics (consent required) | Events and device identifiers | USA (SCCs in place) |
| Resend | Feedback email notifications | Feedback content and optional contact email | USA (SCCs in place) |
We do not sell personal data to any third party. Recraft AI is used in development to generate artwork and is not active at runtime in the published app.
10. International transfers
Some processors are based outside the UK and EEA. Where personal data is transferred internationally, we rely on one of the following safeguards: UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or an ICO adequacy decision. Details are available on request at privacy@spellbands.co.uk.
11. How long we keep data
| Data | Retention period |
|---|---|
| Device-local profiles and progress | Until you delete profiles, clear storage, or uninstall the app |
| Parent account data | While your account is active; deleted within 30 days of a verified deletion request |
| Etymology cache | 30 days per word entry, stored locally on device |
| Feedback submissions | Up to 24 months, then deleted |
| Cookie consent choice | 365 days (stored locally in your browser) |
| Marketing analytics (Meta Pixel events) | Governed by Meta's data retention policy (see Meta's Privacy Policy) |
12. Your rights
Under UK GDPR (and EU GDPR for EEA residents), you have the right to:
- Access: request a copy of personal data we hold about you
- Rectification: correct inaccurate personal data
- Erasure: request deletion of your personal data
- Restriction: ask us to pause processing while a dispute is resolved
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests or for direct marketing
- Withdraw consent: for any processing based on consent (such as the Meta Pixel), at any time
To exercise any right, email privacy@spellbands.co.uk. We will respond within 30 days. Device-local data can be deleted immediately via the profile delete function or your device's storage settings.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113. EEA residents may also complain to their local supervisory authority.
13. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
14. Security
We protect personal data using HTTPS encryption in transit, Supabase Row Level Security for database access, hashed IP addresses for feedback rate limiting, and HMAC-signed local entitlement tokens. Payment card data is handled entirely by Stripe, Apple, and Google; we never see or store it.
15. Changes to this policy
We will update the "Last updated" date above when this policy changes. For material changes that affect how we use your data, we will notify account holders by email where possible and reshow the cookie banner if consent is affected.
16. Contact
SpellBands
Privacy enquiries: privacy@spellbands.co.uk
General enquiries: hello@spellbands.co.uk