Privacy Policy

2. Definitions

For the purposes of this Privacy Policy:

• "Child" or "Children" refers to individuals under the age of 13 (or under 16 in the European Union)
• "Parent" includes legal guardians
• "Personal Information" means any information that can identify an individual
• "Service" refers to the Kids Can Spell application
• "Device" means any device that can access the Service
• "Usage Data" refers to data collected automatically from Service use
• "Voice Data" refers to audio input captured for speech recognition when a parent has enabled the optional voice input feature

3. Information We Collect

We collect minimal information necessary to provide and improve our educational service:

3.1 Information You Provide Directly

• Nickname: A child-chosen username (no real names required)
• Avatar Selection: Choice of cartoon character representation
• Game Settings: Difficulty level, sound preferences, display preferences

3.2 Information Collected Automatically

• Game Progress: Levels completed, scores achieved, words practiced
• Learning Analytics: Time spent, accuracy rates, improvement metrics
• Session Information: Login times, session duration, last activity
• Device Information: Device type, operating system, app version
• App Usage Data: Anonymous app-lifecycle events (when the app is opened and backgrounded). We do not record taps. Screen recording is off by default and is not collected during normal use; we may enable it temporarily to diagnose a specific problem, with all text and images masked (see Section 7.3 for full details)

3.3 Optional Voice Input (Off by Default)

Kids Can Spell includes an optional voice input mode that lets a child spell words aloud instead of typing. It is turned off by default for every profile. We do not collect any audio unless a parent explicitly enables voice input for a profile, behind our parental verification gate. Microphone permission is requested only at the moment a parent enables the feature — never during setup or normal play.

When voice input is enabled:

• Audio from the device microphone is streamed to our secure infrastructure (Modal.com and Cloudflare Workers, acting as our processing infrastructure) and converted to text in real time
• Audio is not recorded, stored, or retained — it exists only for the moments needed to transcribe it
• The transcribed text of a spelling attempt (for example, "C-A-T") is stored with the attempt to grade the answer and improve recognition accuracy
• We do not create voice prints or use audio to identify anyone
• A parent can turn voice input off at any time in Settings, and we can disable the feature remotely for any account

4. Information We Do NOT Collect

We are committed to child privacy. We specifically do NOT collect:

• Real Names: We don't ask for or store actual names
• Email Addresses: No email collection from children
• Phone Numbers: No phone number collection
• Physical Addresses: No address information
• Precise Location: No GPS or precise geolocation data
• Photos/Videos: No camera access or image storage
• Social Media: No social media integration or sharing
• Contact Lists: No access to device contacts
• Biometric Data: No fingerprints, face scans, or voice prints
• Marketing Site "Try It" Demo Input: The interactive spelling demo on our marketing site runs entirely in your browser. Letters you type are compared locally and never sent to our servers.

5. How We Use Information

We use the limited information we collect to:

• Provide the spelling education service
• Track learning progress within the app
• Customize difficulty based on performance
• Display achievements and rewards
• Maintain game state between sessions
• Provide technical support when needed
• Improve app functionality and user experience
• Ensure app security and prevent misuse

We do NOT use information for advertising, marketing, or sale to third parties.

6. Information Sharing and Disclosure

We do not sell, trade, or rent children's personal information. We may share information only in these limited circumstances:

• With Parental Consent: When a parent explicitly requests or approves
• For Legal Reasons: To comply with laws, regulations, or valid legal requests
• To Protect Rights: To protect the rights, property, or safety of our users
• Service Providers: With trusted service providers who assist in operating our app (under strict confidentiality agreements)
• Business Transfers: In connection with a merger or sale of assets (with continued protection)

7. Third-Party Services

We use minimal third-party services to operate our app:

7.1 Infrastructure Services

• Cloudflare: Content delivery and DDoS protection
  Purpose: Faster loading and security
  Data Shared: None (they only see anonymous traffic)

7.2 Error Monitoring and Stability

• Sentry: Error monitoring and crash reporting (website, backend, and mobile app)
  Purpose: Application stability and bug detection for our website, server infrastructure, and mobile app
  Data Shared: Anonymous error logs, device type, OS version, app version

7.3 Mobile App Analytics

• PostHog: Product analytics (mobile app and web app)
  Purpose: Understanding how the app is used — how often it is opened and returned to — to improve usability and fix issues
  Data Shared: Anonymous app-lifecycle events (app opened and backgrounded), a randomly generated app-scoped identifier that is never linked to your account, device model and manufacturer, locale, timezone, screen dimensions, and the device and app information already described in Section 3.2. We do not capture taps, screen views, or the content of what is on screen, and we do not send PostHog your IP-derived location.
  Session replay: off by default. Screen recording is turned off for all users and is not collected during normal use. We may enable it temporarily to diagnose a specific problem; when enabled, all text and images are masked before anything leaves the device, so recordings show layout and interactions only — never your child's name, their answers, or any other content.
  Privacy Settings: All text inputs are masked in session replays, IP addresses are discarded after processing (not stored), EU data residency (data stored and processed in the European Union)
  Note: PostHog is used in the Kids Can Spell app (mobile and web app), not on this marketing website

7.4 Analytics Services (Consent Required)

The following analytics services are only enabled when users explicitly consent through our cookie consent banner:

• Google Analytics 4: Website usage analytics
  Purpose: Understanding how visitors use our website to improve user experience
  Data Shared: Page views, anonymized IP addresses, browser type, device information
  Privacy Settings: IP anonymization enabled, no cross-device tracking, no personalized ads
• Microsoft Clarity: Session recording and heatmap analysis
  Purpose: Understanding user interactions to improve website design and usability
  Data Shared: Session recordings, heatmaps, click patterns, scroll depth

Note: You can manage or withdraw consent for analytics at any time by clicking the "Manage Cookies" button in our cookie consent banner.

7.5 Payment Processing

• Stripe: Payment processing for web subscriptions
  Purpose: Securely process credit card payments and subscriptions
  Data Shared: Payment information, billing details, transaction data
• RevenueCat: Subscription management platform
  Purpose: Process in-app purchases and manage mobile subscriptions
  Data Shared: Device identifiers, purchase information, subscription status
• Apple App Store / Google Play: Platform payment processing
  Purpose: Process payments for mobile app purchases
  Data Shared: Payment information processed by platform providers

7.6 No Advertising or Social Media

We do not use advertising networks or social media plugins. Mobile app analytics (PostHog) operate as described in Section 7.3.

8. Data Retention

We retain information only as long as necessary:

• Game Progress: Retained while account is active
• Inactive Accounts: Deleted after 12 months of inactivity
• Upon Request: Deleted immediately when parent requests

Parents can request immediate deletion of all data at any time.

9. Data Security

We implement industry-standard security measures to protect information:

• Encryption: All data transmitted using HTTPS/TLS encryption
• Access Controls: Limited access to authorized personnel only
• Secure Storage: Protected databases with encryption at rest
• Regular Updates: Security patches and vulnerability assessments
• Incident Response: Procedures for handling security breaches
• Minimal Data: Limited collection reduces security risks

While we strive to protect information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but commit to promptly notifying you of any breaches affecting your child's information.

10. Parental Rights

Parents and legal guardians have the following rights regarding their child's information:

• Access: Review information we have about your child
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your child's information
• Portability: Receive a copy of your child's data
• Restriction: Limit how we use your child's information
• Objection: Object to certain uses of information
• Consent Withdrawal: Withdraw consent at any time

To exercise these rights, contact us at [email protected] with proof of parental relationship.

11. GDPR Rights (European Users)

For users in the European Union, we comply with the General Data Protection Regulation (GDPR):

11.1 Legal Basis for Processing

• Consent: Parental consent for children under 16
• Contract: Necessary to provide the service
• Legitimate Interests: Improving service and security

11.2 Your Rights Under GDPR

• Right to be informed (this privacy policy)
• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

12. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: What information we collect and how we use it
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

We do not sell personal information of any users, including California residents.

To exercise your rights, California residents may contact us at [email protected].

13. International Data Transfers

Our Service is operated in the United States. If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States.

For European Union users, we ensure appropriate safeguards for data transfers:

• Standard Contractual Clauses approved by the European Commission
• Adequate security measures for data protection
• Compliance with GDPR requirements for international transfers

14. Cookies and Tracking Technologies

We use minimal cookies and similar technologies:

14.1 Essential Cookies (Always Active)

• Session Cookies: Maintain game state during play
• Preference Cookies: Remember sound and display settings
• Security Cookies: Protect against unauthorized access
• Cookie Consent: Remember your cookie preferences

14.2 Analytics Cookies (Consent Required)

These cookies are only set if you consent to analytics tracking:

• Google Analytics Cookies: Track page views, user interactions, and website usage patterns
• Microsoft Clarity Cookies: Record session information for heatmaps and user behavior analysis

14.3 Mobile App Tracking

The app uses non-cookie-based, anonymous usage measurement via PostHog. Screen recording is off by default and may be enabled temporarily for diagnostics, with all text and images masked. See Section 7.3 (Mobile App Analytics) for full details on what data is collected and our privacy settings.

14.4 What We Don't Use

• No advertising cookies
• No cross-site tracking cookies
• No social media cookies

14.5 Cookie Management

You can manage your cookie preferences at any time:

• Click the "Manage Cookies" button in our cookie consent banner
• Control cookies through your browser settings (may affect app functionality)
• Opt out of analytics cookies while keeping essential cookies

15. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• We will update the "Last Updated" date at the top
• For material changes, we will provide prominent notice
• We may notify parents via email if we have contact information
• Continued use after changes constitutes acceptance

We encourage you to review this policy periodically. All changes are effective immediately upon posting.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We aim to respond to all privacy inquiries within 30 days.