Privacy Policy

Introduction

SpellCrush ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational spelling practice service.

We are especially committed to protecting the privacy of children and comply with the Children's Online Privacy Protection Act (COPPA).

1. Information We Collect

1.1 Parent/Guardian Information

When you create a parent account, we collect:

• Email address (for account access and communication)
• Password (encrypted and stored securely)
• Payment information (processed securely through Stripe)
• Subscription status and billing history

1.2 Child Information (COPPA Compliant)

For child profiles created by parents, we collect only the minimum necessary information:

• First name only (no last names, email addresses, or other identifying information)
• Age (for appropriate word difficulty)
• Grade level (optional, for educational purposes)
• 4-digit PIN (encrypted, used only for child login authentication)

We do NOT collect email addresses, phone numbers, physical addresses, photos, or any other personal identifiable information from children.

1.3 Usage Information

We automatically collect certain information about how you use the Service:

• Spelling practice activity (words attempted, correct/incorrect answers)
• Progress and mastery tracking
• Time spent on practice sessions
• Virtual rewards earned
• Assessment results and recommended difficulty levels
• Device information (browser type, operating system) for technical support
• IP address (for security and fraud prevention)

2. How We Use Your Information

We use the collected information to:

• Provide and maintain the spelling practice service
• Process payments and manage subscriptions
• Track educational progress and provide personalized learning experiences
• Send important account notifications and updates
• Send optional weekly progress reports (if you opt in via email preferences)
• Improve and optimize the Service
• Prevent fraud and ensure security
• Comply with legal obligations

We do NOT:

• Sell or rent your personal information to third parties
• Use child information for targeted advertising
• Share child information with third parties except as required by law
• Contact children directly via email or any other communication method

3. Data Sharing and Disclosure

We share your information only in the following limited circumstances:

3.1 Service Providers

• Stripe: Payment processing (credit card information is never stored on our servers)
• Vercel: Web hosting and infrastructure
• Neon: Database hosting (all data encrypted at rest)
• Resend: Email delivery service for account notifications
• Anthropic: AI-powered hint generation (Premium feature only, no personal information shared)

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

3.2 Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect our rights, property, or safety.

3.3 Business Transfers

If SpellCrush is acquired or merged with another company, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted over HTTPS (SSL/TLS encryption in transit)
• Passwords and PINs encrypted using bcrypt hashing
• Database encryption at rest
• Regular security audits and updates
• Access controls limiting who can view your data
• Secure payment processing through Stripe (PCI DSS compliant)

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account or a child profile, we delete all associated data within 30 days, except where required by law to retain it longer. Billing records may be retained for tax and accounting purposes as required by law.

7. Your Rights and Choices

You have the right to:

• Access: View all information we have about you and your children
• Update: Modify your account information or child profiles at any time
• Delete: Delete your account and all associated data
• Export: Request a copy of your data in a portable format
• Email Preferences: Control which emails you receive through your account settings
• Cancel: Cancel your subscription at any time

To exercise these rights, log into your account or contact us at privacy@spellcrush.fun.

8. Cookies and Tracking Technologies

We use minimal cookies and tracking technologies:

• Essential Cookies: Required for authentication and basic functionality
• Session Cookies: Maintain your login state (expire after 24 hours)

We do NOT use third-party advertising cookies or tracking pixels.

9. Third-Party Links

The Service does not contain links to third-party websites. If we add external links in the future, we will clearly indicate them and are not responsible for the privacy practices of those sites.

10. International Users

SpellCrush is operated in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer and processing.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Service. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us: