Your family’s data, looked after carefully

Word Wizards is a spelling-practice app for children, run from the United Kingdom. The data controller responsible for your personal data is the operator of Word Wizards, who you can reach at mark.bulling@gmail.com. For any question about your data, or to exercise the rights described below, please use that address.

Word Wizards is designed to be set up and supervised by a responsible adult (a parent, carer or guardian). Only an adult creates an account. Children do not sign up, enter an email address, or manage their own account. An adult adds each child as a profile within their own account and decides what spelling words the child practises.

By adding a child profile, the adult confirms they hold parental responsibility for that child, or have the permission of someone who does, and consents to us processing that child’s data as described here.

• Adult account. The email address used to sign in, handled through our authentication provider (Supabase Auth). We do not store passwords in readable form.
• Child profiles. For each child, a name (or nickname — a real name is not required), a chosen avatar and accent colour, and an optional PIN the adult sets to help the right child sign in. We recommend using a first name or nickname rather than a full name.
• Spelling words and learning content. The spelling words an adult adds for a child, plus AI-generated helpers cached against those words (definitions, tags, explanations, hints and images).
• Practice and progress data. Records of practice attempts, test results, badges, missions, and spaced-review scheduling — the information that lets the app adapt to how a child is getting on.
• Usage and activity data. Basic activity such as daily practice time and streaks, and standard technical logs (for example request logs generated by our hosting provider) needed to run and secure the service.

We do not ask children for contact details, and we do not use family data to build advertising profiles or sell it to anyone.

We process this data to provide the spelling-practice service the adult signed up for — saving words, running games and tests, tracking progress, and keeping accounts secure.

• Contract. Most processing is necessary to deliver the service to the account holder.
• Consent.An adult provides consent, on behalf of their child, for us to process the child’s profile and learning data. Consent can be withdrawn at any time by deleting the profile or the account, or by contacting us.
• Legitimate interests. Keeping the service secure and reliable, and understanding basic usage, where this does not override the interests of the child.

We use a small number of trusted providers to run the app. They process data only on our instructions and for the purposes below.

• SupabaseDatabase and authentication — stores the adult account, child profiles, and practice/progress data.
• VercelHosting and content delivery — serves the app and processes request logs.
• MiniMaxText-to-speech — turns spelling words into spoken audio. Word text is sent to generate audio.
• OpenRouterAI features — word definitions, tags, explanations, practice hints and images. Word text is sent to generate this content.
• PrunaGenerates the explainer videos shown on our public marketing pages.

Some of our processors operate outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards — such as UK adequacy decisions or the International Data Transfer Agreement / Standard Contractual Clauses — so your data keeps a comparable level of protection. (The specific safeguards for each processor should be confirmed as part of the legal review noted at the top of this page.)

We keep account and child-profile data for as long as the account is active. If you delete a child profile, its associated practice and progress data is removed. If you delete your account, or ask us to, we delete the account and its child profiles. Some technical logs held by our hosting provider are kept for a short period for security and then automatically discarded.

We use a small number of cookies and browser storage items that are essential to make the app work — for example, keeping you signed in and remembering which child profile is active. We do not use advertising or cross-site tracking cookies. For more detail, see our cookie policy.

Because Word Wizards is used by children, we aim to follow the UK’s protections for children’s data, including UK GDPR and the Information Commissioner’s Age Appropriate Design Code(the Children’s Code). In practice this means:

• the best interests of the child come first in how the app is designed;
• we collect the minimum data needed, and turn off anything unnecessary by default;
• we do not profile children for advertising or sell their data;
• an adult sets up and controls each child’s profile.

If Word Wizards is used by families in the United States, we also intend to respect the protections of the Children’s Online Privacy Protection Act (COPPA) — including obtaining a parent’s consent before collecting a child’s personal information, and giving parents the ability to review and delete it. The exact approach should be confirmed in the legal review.

You (as the account-holding adult, including on behalf of your child) have rights over this personal data. These include the right to:

• access the data we hold and get a copy of it;
• correct anything inaccurate;
• delete a child profile, or your whole account and its data;
• restrict or object to certain processing;
• withdraw consent at any time.

To exercise any of these, or to ask us to delete your data, email mark.bulling@gmail.com. If you are in the UK and are unhappy with how we handle your data, you can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

We may update this policy as the app develops. When we make significant changes, we will update the date at the top of this page and, where appropriate, let account holders know.

For any privacy question, or to see or delete your data, contact mark.bulling@gmail.com.