Last updated 19 August 2026
Privacy
SpellChirp is used by children, so the short version matters most: there are no ads, no trackers, no analytics on children, and nothing your child writes or spells is sold, shared or used to train anything. Most of the app doesn’t need a server at all.
Who we are
SpellChirp (“we”, “us”) runs the website and app at spellchirp.com. For privacy questions, write to privacy@spellchirp.com. We are the data controller for the information described below.
The default: everything stays on your device
Without an account, SpellChirp stores your child’s words, attempts, streaks and handwriting in your browser’s own storage. It never leaves the device. Clearing your browser data deletes it, and we have no copy to give you or to lose.
What we collect, and only when you ask for it
| What | When | Why |
|---|---|---|
| A parent’s email address | Only if you create an account to sync across devices | To send the six-digit sign-in code and identify your account |
| Your family’s practice data — the word list, attempt history, handwriting images, child first names or nicknames and avatars | Only while signed in | So the same nest appears on the tablet and the phone |
| An email address for Word of the Day and the age band you picked | Only if you subscribe | To send one word each morning, pitched to the right age |
That is the complete list. We do not ask for a surname, an address, a date of birth, a school, a photo of a child, or a payment card for the free tier.
Children
Children do not create accounts. An account belongs to a parent or guardian, who decides what goes into it. A child’s presence in the app is a first name or nickname you type and an avatar you pick — you can use “Bee” or “Kiddo” and the app works exactly the same.
We do not knowingly collect personal information directly from a child under 13. If you believe a child has sent us information without a parent’s involvement, email privacy@spellchirp.com and we will delete it.
There is no chat, no profile, no friend list, no leaderboard against strangers, no user-generated content from anyone outside your household, and no way for one family to see another.
Where your words travel
Three things reach outside your device, and only these:
- Word look-ups. When you add a word, the word itself (nothing else) is sent to the free dictionary API at
dictionaryapi.devto fetch a definition, pronunciation and example sentences. - Syncing, if you signed in. Your family’s practice data is stored with Supabase, our database and authentication provider, and served through Vercel, our host.
- Voice downloads. If you turn on the “Chirpy Natural” voice, the speech model is downloaded once from the Hugging Face CDN. After that it runs on your device — the words being read aloud are never sent anywhere.
Photographs of word lists are read entirely in your browser. The picture is never uploaded to us or to anyone else. The “device voice” option is likewise your operating system’s own, and the optional “Studio” voice only exists if the person running the deployment points it at a server they control.
What we never do
- No advertising, and no ad networks.
- No selling or renting of personal information, ever, to anyone.
- No third-party analytics or behavioural tracking of children.
- No training of machine-learning models on your family’s data.
- No profiling and no automated decisions with legal or similar effects.
How long we keep things
- On-device data: until you clear it. We can’t reach it.
- Account data: until you delete your account, then removed within 30 days.
- Word of the Day subscription: until you unsubscribe, which every email links to.
Your rights
Depending on where you live — the UK and EU (UK GDPR / GDPR), California (CCPA/CPRA) and elsewhere — you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent. Email privacy@spellchirp.com and we’ll act within 30 days. You never have to pay, and asking will never degrade the app.
Our lawful bases, where GDPR applies: contract for running the account you asked for, and consent for the Word of the Day email, which you can withdraw at any time.
Security
Traffic is encrypted in transit. Account data sits behind row-level security so one account cannot read another’s. Sign-in uses a one-time six-digit code rather than a password you might reuse elsewhere. No system is perfect; if something goes wrong that affects you, we will tell you promptly and plainly.
Changes
If this policy changes in a way that affects you, we’ll update the date at the top and, for anything significant, tell account holders by email before it takes effect.
Questions about any of this: hello@spellchirp.com, or see the contact page.
This page describes how SpellChirp works today, in plain English. It isn’t legal advice, and if your family’s situation depends on the fine print you should take your own.