1. Who we are
Spelling Universe ("the app", "we", "us") is operated by Brightquill Education Ltd, a company registered in England & Wales.
- Company number: 17239775
- Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- ICO registration number: ZC164266
- Contact: dpo@brightquill.co.uk
Brightquill Education Ltd is the data controller for personal data collected through the app, except where a school or organisation uses the app to manage its own pupils; in that case the school is the controller and we act as its data processor (see Section 10).
2. Our approach to children's data
This app is designed to be used by children. We follow the UK GDPR (and the EU GDPR for users in the EU) and the ICO's Age Appropriate Design Code ("Children's Code"). In plain terms:
- We collect the least data possible to make the app work: a child is identified only by a first name and last initial (or a username they choose) and a short PIN. We never ask a child for their own email address, full name, date of birth, or age. A learner account can optionally hold a parent's or guardian's email address, used only to reset a forgotten password (see Section 3).
- We never sell personal data, and we do not use it for advertising.
- We use no analytics and no advertising or tracking SDKs of any kind, and no third-party crash-reporting service. We do not collect location data or device advertising identifiers.
- Privacy-protective settings are on by default.
3. What we collect
Account data: depends on account type
- Learner accounts (someone signing up for themselves): a username and a password, and optionally a parent's or guardian's email address (below). No real name, age, or date of birth, and never the child's own email address. For technical reasons our login system requires an email format, so the app generates an internal placeholder address from the username; it is not a real, contactable mailbox.
- Tutor accounts: the tutor's name, a real email address, and a password. Tutors are adults. We send a one-time verification link to that address to confirm it before the tutor can add pupils.
- Managed pupil accounts (created by a tutor for their pupils): the pupil's first name and last initial (displayed as "Firstname X."), an automatically generated username, and a 4-digit PIN. As above, an internal placeholder address is generated. No pupil email, age, or date of birth is collected.
Parent's email (optional, learner accounts only): when a learner account is set up, a parent or guardian can add their email address so that a password-reset code can be sent to it if the password is forgotten. That is its only use: we never send marketing to it or share it. It can be changed or removed at any time in the app's grown-ups settings, under Password recovery. Tutors reset their passwords the same way, using their own email address.
Learning data: spelling practice results (which words were attempted and spelled correctly), scores, practice history, streaks, medals and achievements, homework or assignments, and the level the Daily Spelling Quest is working at, used to show progress and choose the right words to practise next.
Custom word lists: a parent, guardian, or tutor can type in extra words to practise (for example, a school spelling list). These lists are stored with the account. Please only enter spelling words — do not type personal information into a word list.
Class data (tutor/school use): a class name, an automatically generated join code, and which pupils belong to a class.
Subscription data: your free-trial and subscription status (e.g. trial end date, whether a subscription is active). Paid subscriptions are sold and billed by Google Play on Android or the Apple App Store on iPhone and iPad; we never see or store your card details (see Section 5).
Security data: a bot-protection check at sign-up and sign-in via Cloudflare Turnstile (see Section 9).
Error reports: if the app hits an error while someone is signed in — a screen failing to load, or progress failing to save — it records a short technical note so we can fix it: what went wrong, which part of the app, the app version, and the type of device (iPhone/iPad, Android or web). It is linked to the account so we can match it to a reported problem. It never contains answers, names, or anything typed into the app. Nothing is recorded for someone trying the app without an account.
Camera: the app can scan a pupil's QR login card using the device camera. The camera is used only to read the code at that moment; no photos or video are captured, stored, or transmitted.
Audio: the app plays recorded word and sentence clips to support spelling practice. All audio is playback only — the clips are built into the app, and the app never records sound and does not request microphone access.
On-device storage: your login session, a small offline queue (so progress isn't lost without a connection), and minor app preferences are stored locally on your device.
4. Why we use it and our legal basis (UK GDPR and EU GDPR)
| What | Why | Legal basis |
|---|---|---|
| Account data | To create and run your account (including verifying a tutor's email) | Performance of a contract |
| Parent's email (optional) | To send a password-reset code if a learner forgets their password | Legitimate interests |
| Learning, word-list & class data | To track progress, pick the right words to practise, and let tutors manage classes | Performance of a contract |
| Subscription data | To manage your free trial and access to paid features | Performance of a contract |
| Security data (Turnstile) | To prevent automated abuse and protect accounts | Legitimate interests |
| Error reports | To find and fix faults | Legitimate interests |
Where a child is too young to enter into these terms themselves, an account is created and managed on their behalf by a parent, guardian, tutor, or school.
5. Who we share it with (our service providers)
We share data only with providers who help us run the app, under contract, and only for the purposes above. We do not sell personal data or share it with advertisers.
- Supabase: secure database, authentication, and hosting, located in the EU (Ireland).
- Cloudflare: bot protection via Turnstile. As a condition of using Turnstile, we direct you to Cloudflare's Turnstile Privacy Addendum.
- Resend: sends the app's one-time emails: the link that verifies a tutor's email address, and password-reset codes. It receives only the address it is sending to and the message itself, never any learning data. Resend is a US-based provider (see Section 7).
- RevenueCat: subscription and free-trial management. We send RevenueCat an internal account identifier (a random ID, not a name or email) so it can track whether a subscription or trial is active; it does not receive your name, email, or card details. RevenueCat is a US-based provider (see Section 7).
- Google Play (Android) and the Apple App Store (iPhone and iPad): payment processing and subscription billing; we do not receive your card details.
6. How long we keep it
We keep account and learning data for as long as the account is active. If an account is inactive for 18 months, or if you ask us to, we delete it within 30 days. (We allow a generous window because children often pause and return to learning after long breaks.) A parent's email is removed with the account, or as soon as it is cleared in the app. A password-reset code expires after 15 minutes and can be used only once. Error reports are deleted automatically after 90 days.
7. Where your data is stored / international transfers
Your account and learning data are stored in the EU (Ireland) via Supabase. Three providers are US-based: Cloudflare (the Turnstile bot-protection check), Resend (verification and password-reset emails), and RevenueCat (subscription status), so a limited amount of data is processed outside the UK/EU; this is covered by an appropriate safeguard (UK International Data Transfer Agreement / Standard Contractual Clauses).
8. Your rights
You (or a parent/guardian/tutor/school on a child's behalf) can ask us to access, correct, delete, or export data; restrict or object to processing; or withdraw consent. Email dpo@brightquill.co.uk. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you live in the EU, you can complain to your local data protection authority instead; in Ireland, that is the Data Protection Commission at dataprotection.ie.
9. Cookies, SDKs and tracking
The app uses no advertising cookies and no tracking or analytics SDKs. The only third-party technologies are the operational services in Section 5 (Supabase, Cloudflare Turnstile, Resend for verification and password-reset emails, RevenueCat for subscription status, and Google Play or Apple App Store billing). The marketing website, if it ever uses cookies, will have its own notice.
10. Schools and organisations
Where a school or tutoring organisation sets up and manages pupil accounts, that organisation is the data controller and Brightquill Education Ltd is its data processor. In that case, processing is governed by a separate Data Processing Agreement (DPA) between us and the organisation.
11. Changes to this policy
We'll update this page if our practices change and revise the "Last updated" date. Significant changes will be notified in the app.
12. Contact
dpo@brightquill.co.uk. Brightquill Education Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.