Privacy, in plain English

If your child plays without a school code

• What is kept: the name or nickname you type for each player, their progress, and any word lists you make.
• Where: in your browser’s own storage, on this device only. It isn’t a cookie, and it isn’t sent to us. We never receive anything about the children who use the free app.
• Shared lists: a list shared by link or QR code holds the list’s name and any note, its words, and any example sentences and spelling tips, never players’ names or progress.
• Backups: a backup is a file you download and keep. It holds your players’ names and progress, so keep it somewhere safe.
• Removing it: remove a player in the Grown-ups area, or clear this site’s data in your browser’s settings. Either removes it for good: we have no copy.
• The voice: every word is played from recordings that come with the app, so nothing is sent anywhere to be spoken.

If your child’s school uses Spell Beasts

Your child joins their class with a code from their teacher. From then on, their practice is also saved for their teacher. This includes practice at home with the code from school.

• Who is responsible: the school is the data controller. We process the data on its behalf, and only on its instructions. The school decides the lawful basis: usually public task (UK GDPR Article 6(1)(e)) for maintained schools and academies, and legitimate interests for independent schools.
• What is kept: the name the teacher types (we advise a first name and an initial), your child’s class and any group, the secret beast picture they sign in with, and their practice: the words they tried, in which activity, whether each was right, what they typed when it wasn’t (up to 40 characters), how long they took, each word’s stage and when it is next due, the minutes they practised, their class test answers, wrong secret-beast guesses, and the times they signed in, opened the app and practised. If the class uses pupil codes, your child’s code is kept in a protected form so the teacher can print it again.
• Never kept: surname (unless the teacher types one), date of birth, email address, photos, voice recordings, location, device identifiers, special educational needs, or anything about you. If your child types something that looks like an unsuitable word, it isn’t stored at all.
• Who can see it: your child’s teachers and the school’s School Admins. Other children never see it. We don’t look at it: our own tools show only counts.
• On your device: a sign-in pass for your child, with their name, their class’s name and their teacher’s name as children see it, kept in the browser. Leave class in the Grown-ups area signs the device out.
• Class lists: if your child’s class signs in by tapping names, anyone with the class code can see the first names in that class, the class’s name and the teacher’s name, because that is how children find themselves. Choosing a name still needs the child’s secret beast, and teachers can switch to typed names to hide the list.
• Where it is stored: in the EU, encrypted.
• How long it is kept: until the teacher removes your child or the class is deleted. Archived classes are deleted after 30 days, and classes nobody has used for 13 months are deleted automatically. If the school stops using Spell Beasts, everything is deleted within 60 days. Deleted data is gone from our backups within 35 days.
• Your rights: to see, correct or delete your child’s data, ask the school; teachers can do it straight away. If you ask us, we pass your request to the school.

Teachers and school staff

• What is kept: your email address, name, school, role and classes; when you sign in; and a record of significant actions, such as adding pupils, approving words or exporting, which your School Admins can see.
• No passwords: we email you a link and a 6-digit code each time.
• One cookie, only to keep you signed in.
• Emails we send you: sign-in codes, invitations, a warning before an unused class is deleted, and, if you ask for them, a family pack to your own address and the Monday email of things to look at in your classes. None of them includes pupils’ names.
• When you leave: your school can deactivate your account. It is deleted after 12 months unused, or sooner if asked.
• Requesting a trial: the form asks for your school’s name, your name, school email address and role, and an optional message. We use them to set up your trial and to contact you about it, and we delete them 90 days after we have dealt with the request. For this, Spell Beasts is the data controller, and the lawful basis is our legitimate interest in answering your request (UK GDPR Article 6(1)(f)). We don’t add you to any mailing list.

AI and the voice

When a teacher adds a spelling word that Spell Beasts doesn’t have yet, our AI helper (Claude, by Anthropic) drafts a meaning, a sentence and a tip from that word alone, and ElevenLabs records the word and the sentence. A teacher reads and approves every AI-written word before any child sees it. Neither company ever receives anything about a school, a teacher or a child, and children’s devices never contact either of them.

Cookies and tracking

• These pages and the children’s app set no cookies, and there are no analytics, adverts or trackers. Everything, fonts included, comes from our own address, apart from the check below.
• Our host, Cloudflare, handles your device’s internet address to send you the pages, as any website host must. When the app talks to our server (in a class, or in the teacher app), we use the address briefly to stop repeated guessing, keep it only in a scrambled form, and delete it after two days.
• The teacher sign-in page and the trial request form may use Cloudflare’s “are you a person?” check.

Who else is involved

• Cloudflare: hosts the website, and keeps our database and files in the EU.
• Resend: sends emails to teachers, from Ireland, and keeps a log of them for 30 days in the United States.
• Anthropic and ElevenLabs: receive spelling words and sentences only.

We never sell data or use it for advertising, and we tell schools before adding or changing a provider.

If something goes wrong

We tell the school within 24 hours of becoming aware of a breach affecting its data, and help it decide what to do next, including whether to tell families and the Information Commissioner’s Office.

Who we are

Spell Beasts is run by [Company name], [registered address]. Company number [company number]. We are registered with the Information Commissioner’s Office: [ICO registration number].

We process children’s data for schools, on their instructions. We are the data controller only for our own business records, such as trial requests and who to invoice.

Questions and complaints

• If your child uses Spell Beasts through school, ask the school first: it is in charge of the data.
• Otherwise, write to us at the address above.
• You can complain to the Information Commissioner’s Office at ico.org.uk.

For schools and data protection officers

Our full data protection statement and data processing agreement are available on request: ask for them when you request a trial. More about how Spell Beasts for Schools works is on the For schools page.

Changes to this notice

We update this page before we change what we collect, where it is stored or who receives it, and we tell schools first.