Last updated 23 September 2026
Privacy
SpellChirp is used by children, so the short version matters most: there are no ads, no trackers, no analytics on children, and nothing your child writes or spells is sold, shared or used to train anything. Most of the app doesn’t need a server at all.
Who we are
SpellChirp (“we”, “us”) runs the website and app at spellchirp.com. For privacy questions, write to privacy@spellchirp.com. We are the data controller for the information described below.
The default: everything stays on your device
Without an account, SpellChirp stores your child’s words, attempts, streaks and handwriting in your browser’s own storage. That practice stays on the device. Two things go out, and only the bare word: each word you add is looked up in a dictionary, and if the Studio voice reads the words aloud, the text being read goes to the voice server (see where your words travel). Clearing your browser data deletes the rest, and we have no copy to give you or to lose.
What we collect, and only when you ask for it
| What | When | Why |
|---|---|---|
| A parent’s email address | Only if you create an account to sync across devices | To send the six-digit sign-in code and identify your account |
| Your family’s practice data — the word list, attempt history, handwriting images, child first names or nicknames, grade and avatars | Only while signed in | So the same nest appears on the tablet and the phone |
| Recordings of a child saying a word | Only if you use “Say it aloud” while signed in | So a grown-up can listen back and mark it. Stored with the practice data |
| A student’s own email address | Only for students aged 13 or over who sign in themselves | To sign them in and put them in the nest a parent invited them to |
| Billing details | Only if you buy Flock or seeds | Payment is taken by Stripe; we see the plan and whether it is paid, never your card |
| An email address for Word of the Day and the age band you picked | Only if you subscribe | To send one word each morning, pitched to the right age |
| A class you run — its name, the weekly word lists and any note you add to a list | Only if you start a class code | So families who follow the class get each week’s list on their dashboard |
| Which classes your family follows | Only if you follow a class code while signed in | To put the class’s newest list on your dashboard, and to count your practice of that list, anonymously, in the class totals (see below) |
That is the complete list. We do not ask for a surname, an address, a date of birth, a school, a photo of a child, or a payment card for the free tier.
Signing in with Google
Signing in is optional, and Google is one of two ways to do it — the other is a six-digit code emailed to you. If you pick Google, Google passes us three things: your name, your email address and your profile picture. We use them to create your account, to recognise you when you come back, and to write to you about the account itself. Nothing else.
SpellChirp asks Google for the openid, userinfo.email and userinfo.profile scopes only, so we cannot see your Gmail, Drive, contacts or calendar even if we wanted to. SpellChirp’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: that data is never sold, never used for advertising, and never used to train a model. You can cut the connection at any time under your Google account permissions; email us if you want the SpellChirp account deleted too.
Children
Children under 13 do not create accounts. An account belongs to a parent or guardian, who decides what goes into it. A student aged 13 or over may sign in with their own email, and joins a family only with a code a parent made; the sign-in screen asks a student’s birth year and turns away anyone younger. A child’s presence in the app is a first name or nickname you type and an avatar you pick — you can use “Bee” or “Kiddo” and the app works exactly the same.
We do not knowingly collect personal information directly from a child under 13. If you believe a child has sent us information without a parent’s involvement, email privacy@spellchirp.com and we will delete it.
There is no chat, no profile, no friend list, no leaderboard against strangers, no user-generated content from anyone outside your household, and no way for one family to see another.
Three things share on purpose, and only when a grown-up makes them. A join code lets the person who types it into your nest, where they see what you see. A cheer link shows whoever opens it a child’s first name, the words they mastered this week, how many they have mastered in all, and how many days and answers they practised this week — nothing else — and can be switched off in Settings.
A share code or class code carries a word list, its title and the teacher’s note, and nothing about any child. Anyone with a class code can see the class name and its newest list. A family that follows a class stays anonymous: the teacher sees how many families follow and how often each list was added, never who. Practice comes back to the teacher only as class totals for the newest list — answers, how many were right, and the words the class found hardest — and only once at least five families have practised it that week, so no figure on the teacher’s screen can be one child’s. Unfollow the class and your practice stops counting.
Where your words travel
These services see something, and only what is listed:
- Word look-ups. When you add a word, the word itself (nothing else) is sent to the free dictionary API at
dictionaryapi.devto fetch a definition, pronunciation and example sentences. - Syncing, if you signed in. Your family’s practice data, handwriting and recordings are stored with Supabase, our database and authentication provider, and served through Vercel, our host.
- Written stories and definitions. When a Storyweave quest is written, or a word the dictionary lacks is defined, we send Anthropic the child’s first name or nickname, their grade, the story theme, and the words with their meanings. Nothing else — no email, no surname, no answers. Under its commercial terms Anthropic does not train its models on it.
- Email. Sign-in codes, the Word of the Day and the Sunday report are delivered by Resend. The Sunday report contains your children’s first names and the words they practised and missed.
- Payments. Stripe takes payment and receives your email address to send receipts.
- Downloads that carry nothing of yours. The “Chirpy Natural” voice model comes from the Hugging Face CDN, and the photo reader’s engine from
cdn.jsdelivr.net. Both see your IP address, as any website you load does; after that they run on your device and the words and pictures never leave it.
Photographs of word lists are read entirely in your browser. The picture is never uploaded to us or to anyone else. A picture you add to a word card stays on the device too. The “device voice” option is likewise your operating system’s own. The optional “Studio” voice only exists if whoever runs the site has set one up: when it reads aloud, the text being read (a word or a sentence, nothing about who is listening) is sent to the voice server they configured, which may be their own or a third-party speech provider such as OpenAI.
What we never do
- No advertising, and no ad networks.
- No selling or renting of personal information, ever, to anyone.
- No third-party analytics or behavioural tracking of children.
- No training of machine-learning models on your family’s data.
- No profiling and no automated decisions with legal or similar effects.
How long we keep things
- On-device data: until you clear it. We can’t reach it.
- Account data — practice history, handwriting and recordings: while the account exists. Deleting the account in Settings → Your data removes it at once, files included; a deletion asked for by email is done within 30 days.
- Classes: a class’s name, lists and notes stay while the teacher’s account exists, archived or not, and go when it is deleted. Following a class lasts until the family unfollows or deletes their account. Class totals are worked out each time the teacher looks, never stored.
- Payment records: kept as long as tax law requires. They hold no information about a child.
- Word of the Day subscription: until you unsubscribe, which every email links to.
Your rights
Depending on where you live — the UK and EU (UK GDPR / GDPR), California (CCPA/CPRA) and elsewhere — you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent. A copy and deletion are both one tap in Settings → Your data; for anything else, email privacy@spellchirp.com and we’ll act within 30 days. You never have to pay, and asking will never degrade the app.
Our lawful bases, where GDPR applies: contract for running the account you asked for, and consent for the Word of the Day email, which you can withdraw at any time.
Security
Traffic is encrypted in transit. Account data sits behind row-level security so one account cannot read another’s. Sign-in uses a one-time six-digit code, or Google, rather than a password you might reuse elsewhere. No system is perfect; if something goes wrong that affects you, we will tell you promptly and plainly.
Changes
If this policy changes in a way that affects you, we’ll update the date at the top and, for anything significant, tell account holders by email before it takes effect.
Questions about any of this: hello@spellchirp.com, or see the contact page.
This page describes how SpellChirp works today, in plain English. It isn’t legal advice, and if your family’s situation depends on the fine print you should take your own.