1. Who we are
Spelling Universe ("the app", "we", "us") is operated by Brightquill Education Ltd, a company registered in England & Wales.
- Company number: 17239775
- Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- ICO registration number: ZC164266
- Contact: dpo@brightquill.co.uk
Brightquill Education Ltd is the data controller for personal data collected through the app, except where a school or organisation uses the app to manage its own pupils; in that case the school is the controller and we act as its data processor (see Section 10).
2. Our approach to children's data
This app is designed to be used by children. We follow the UK GDPR and the ICO's Age Appropriate Design Code ("Children's Code"). In plain terms:
- We collect the least data possible to make the app work: a child is identified only by a first name and last initial (or a username they choose) and a short PIN. We never ask a child for an email address, full name, date of birth, or age.
- We never sell personal data, and we do not use it for advertising.
- We use no analytics, no crash-reporting, and no advertising or tracking SDKs of any kind. We do not collect location data or device advertising identifiers.
- Privacy-protective settings are on by default.
3. What we collect
Account data: depends on account type
- Learner accounts (someone signing up for themselves): a username and a password. No email address, real name, age, or date of birth. For technical reasons our login system requires an email format, so the app generates an internal placeholder address from the username; it is not a real, contactable mailbox.
- Tutor accounts: the tutor's name, a real email address, and a password. Tutors are adults. We send a one-time verification link to that address to confirm it before the tutor can add pupils.
- Managed pupil accounts (created by a tutor for their pupils): the pupil's first name and last initial (displayed as "Firstname X."), an automatically generated username, and a 4-digit PIN. As above, an internal placeholder address is generated. No pupil email, age, or date of birth is collected.
Learning data: spelling practice results (which words were attempted and spelled correctly), scores, practice history, streaks, medals and achievements, homework or assignments, and the level the Daily Spelling Quest is working at, used to show progress and choose the right words to practise next.
Custom word lists: a parent, guardian, or tutor can type in extra words to practise (for example, a school spelling list). These lists are stored with the account. Please only enter spelling words — do not type personal information into a word list.
Class data (tutor/school use): a class name, an automatically generated join code, and which pupils belong to a class.
Subscription data: your free-trial and subscription status (e.g. trial end date, whether a subscription is active). Paid subscriptions are sold and billed by Google Play on Android or the Apple App Store on iPhone and iPad; we never see or store your card details (see Section 5).
Security data: a bot-protection check at sign-up and sign-in via Cloudflare Turnstile (see Section 9).
Camera: the app can scan a pupil's QR login card using the device camera. The camera is used only to read the code at that moment; no photos or video are captured, stored, or transmitted.
Audio: the app plays recorded word and sentence clips to support spelling practice. All audio is playback only — the clips are built into the app, and the app never records sound and does not request microphone access.
On-device storage: your login session, a small offline queue (so progress isn't lost without a connection), and minor app preferences are stored locally on your device.
4. Why we use it and our legal basis (UK GDPR)
| What | Why | Legal basis |
|---|---|---|
| Account data | To create and run your account (including verifying a tutor's email) | Performance of a contract |
| Learning, word-list & class data | To track progress, pick the right words to practise, and let tutors manage classes | Performance of a contract |
| Subscription data | To manage your free trial and access to paid features | Performance of a contract |
| Security data (Turnstile) | To prevent automated abuse and protect accounts | Legitimate interests |
Where a child is too young to enter into these terms themselves, an account is created and managed on their behalf by a parent, guardian, tutor, or school.
5. Who we share it with (our service providers)
We share data only with providers who help us run the app, under contract, and only for the purposes above. We do not sell personal data or share it with advertisers.
- Supabase: secure database, authentication, and hosting, located in the EU (Ireland).
- Cloudflare: bot protection via Turnstile. As a condition of using Turnstile, we direct you to Cloudflare's Turnstile Privacy Addendum.
- Resend: sends the one-time email that verifies a tutor's email address. It processes only the tutor's (adult) email address, never any pupil data. Resend is a US-based provider (see Section 7).
- RevenueCat: subscription and free-trial management. We send RevenueCat an internal account identifier (a random ID, not a name or email) so it can track whether a subscription or trial is active; it does not receive your name, email, or card details. RevenueCat is a US-based provider (see Section 7).
- Google Play (Android) and the Apple App Store (iPhone and iPad): payment processing and subscription billing; we do not receive your card details.
6. How long we keep it
We keep account and learning data for as long as the account is active. If an account is inactive for 18 months, or if you ask us to, we delete it within 30 days. (We allow a generous window because children often pause and return to learning after long breaks.)
7. Where your data is stored / international transfers
Your account and learning data are stored in the EU (Ireland) via Supabase. Three providers are US-based: Cloudflare (the Turnstile bot-protection check), Resend (tutor verification emails), and RevenueCat (subscription status), so a limited amount of data is processed outside the UK/EU; this is covered by an appropriate safeguard (UK International Data Transfer Agreement / Standard Contractual Clauses).
8. Your rights
You (or a parent/guardian/tutor/school on a child's behalf) can ask us to access, correct, delete, or export data; restrict or object to processing; or withdraw consent. Email dpo@brightquill.co.uk. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. Cookies, SDKs and tracking
The app uses no advertising cookies and no tracking or analytics SDKs. The only third-party technologies are the operational services in Section 5 (Supabase, Cloudflare Turnstile, Resend for tutor verification emails, RevenueCat for subscription status, and Google Play or Apple App Store billing). The marketing website, if it ever uses cookies, will have its own notice.
10. Schools and organisations
Where a school or tutoring organisation sets up and manages pupil accounts, that organisation is the data controller and Brightquill Education Ltd is its data processor. In that case, processing is governed by a separate Data Processing Agreement (DPA) between us and the organisation.
11. Changes to this policy
We'll update this page if our practices change and revise the "Last updated" date. Significant changes will be notified in the app.
12. Contact
dpo@brightquill.co.uk. Brightquill Education Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.