Privacy Policy

Introduction

Spell Steps ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use our spelling practice service.

By using Spell Steps, you agree to the practices described in this policy.

Information We Collect

Parent Account Information

• Email address
• Account password (encrypted)
• Account creation date

Child Profile Information

• Child's name or nickname (first name only, no last names)
• Grade level
• Avatar emoji (optional)

Progress and Learning Data

• Words practiced and their status (known, needs practice, not started)
• Grade levels and categories accessed
• Practice history and progress metrics
• Custom word lists created by parents

Technical Information

• Device type and browser information
• IP address and approximate location (for security)

How We Use Information

We use the information we collect to:

• Provide and maintain the spelling practice service
• Track and display your child's progress
• Personalize the learning experience
• Communicate with parents about account matters
• Improve our service and develop new features
• Protect against fraud and unauthorized access
• Comply with legal obligations

How We Share Information

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

• Service Providers: We work with trusted third-party services for hosting, analytics, and email delivery. These providers are contractually obligated to protect your data.
• Legal Requirements: We may disclose information if required by law or to protect our rights and safety.
• Business Transfers: In the event of a merger or acquisition, user data may be transferred as part of the transaction.

Children's Privacy

Spell Steps is designed for use by elementary-aged children with parental supervision. We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA).

Parental Consent

Only parents or legal guardians may create accounts. By creating an account, you confirm that you are a parent or guardian and consent to the collection of information for your child's profile.

What We Collect from Children

We collect only essential information for the educational service:

• First name or nickname (no last names)
• Grade level for appropriate content
• Spelling progress and practice data

What We Do NOT Collect or Allow

• Children's email addresses or phone numbers
• Last names or detailed personal information
• Public profiles visible to other users
• Messaging or communication between users
• Location tracking beyond general region
• Third-party advertising directed at children

Parental Rights

Parents have the right to:

• Review their child's profile and progress data
• Delete child profiles and all associated data
• Request deletion of their own account
• Contact us with privacy concerns

Data Retention and Deletion

We retain your data as long as your account is active. You may delete your account and all associated data at any time by emailing hello@spellsteps.com with the subject line "Data Deletion Request." We will process your request within 30 days.

We may retain certain information for legal or security purposes even after account deletion.

Data Security

We implement reasonable security measures to protect your information, including encryption, secure servers, and access controls. However, no method of transmission over the internet is 100% secure.

Our service is built on infrastructure provided by Base44, which maintains SOC 2 Type II and ISO 27001 certifications. These independent audits confirm that the servers, data centers, and access controls protecting your data meet enterprise-grade security standards. For more information, see the Base44 Security Trust Center.

Security and Tracking Transparency

We are committed to a "privacy-by-default" design. Specifically, we confirm the following:

• No third-party tracking: We do not use Google Analytics or similar analytics trackers to follow you across pages.
• No advertising pixels: We do not install Meta (Facebook), TikTok, or any other advertising or marketing pixels.
• No session replay: We do not use Clarity, Hotjar, FullStory, or any tool that records your screen, clicks, or interactions.
• No third-party error monitoring: Application errors are logged within our own secured infrastructure and are not transmitted to third-party monitoring services.
• No child data shared with advertisers: Because no advertising or tracking tools are present, there is no technical path for your child's name, word lists, progress screens, or practice activity to be recorded by or shared with any third-party tracker.

The only scripts that run on every page are our own application code and the Base44 platform software that powers your account, database, and login. This keeps the data footprint limited to what is necessary to deliver the spelling service.

Your Rights and Choices

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your data
• Opt out of non-essential communications

To exercise these rights, please contact us at /contact.

Cookies and Analytics

We use only essential cookies and similar technologies to:

• Maintain your login session
• Remember your preferences (such as the selected child profile)

We do not use cookies for advertising, cross-site tracking, or third-party analytics. You can control cookies through your browser settings, but disabling essential cookies may limit your ability to use the Service.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or through the Service. The updated policy will include a new "Last updated" date.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at /contact.

To request data deletion: Email us at hello@spellsteps.com with the subject line "Data Deletion Request." Include your account email address, and we will delete your account and all associated child profiles and progress data within 30 days.