Privacy Policy
1. Who this covers
This policy is for SpellingJoy Reading at reading.spellingjoy.com, operated by Veloris, LLC, a Delaware limited liability company doing business as SpellingJoy. It covers this app only. The spelling practice, the word lists and the teacher tools at spellingjoy.com are a different product and have their own policy, because they collect different things.
2. Parents make the account, not children
Only an adult of 18 or over may create an account, and that adult is responsible for it. We do not knowingly collect anything directly from a child. Everything we hold about a child was typed in by the parent or produced by the child playing inside an account the parent opened. The grown-up screens (account, billing, the weekly summary) sit behind a parental gate that asks for a birth year every single visit, so a young child cannot wander into them.
If you think a child made an account without a parent, email reading@spellingjoy.com and we will delete it.
3. What we collect
| What | From where | Why |
|---|---|---|
| Parent email address | You, at sign up | Signing in by one-time code, receipts, the trial reminder, the weekly summary, notices about the service |
| Subscription details | Stripe, when you start the trial | Billing. Stripe holds the card. We store a Stripe customer id, the status, and the last four digits so you can recognise the card |
| Child’s first name or nickname, and birth year | You, at onboarding | So the buddy can greet the child by name and start at the right place |
| Play data: spots started and finished, answers, sounds and words mastered, stars, room items, time on task | The child playing | To choose the next lesson, to fill your weekly summary, to award stars |
| Usage data: pages and screens viewed, buttons pressed, browser and device type, screen size, approximate country, the page that referred you | Analytics, described below | To see what works and what confuses people, and fix it |
| Error data: stack traces, the steps leading to an error, and a session replay in which every piece of text and every input is masked out | Sentry | To find and fix bugs, often before you report them |
| Emails you send us | You | To reply |
We do not collect a child’s surname, photograph, voice, contacts or precise location. The microphone is never used. The app plays audio, it does not record it.
4. Tracking, analytics and cookies
We do track how the app is used, on purpose, because it is how we learn which lessons land. Here is the whole list.
Google Analytics 4 (Google LLC) sets cookies beginning _ga and reports page views and in-app events, for example that a lesson finished or a trial started, to Google. Google truncates the IP address before storing it. Vercel Web Analytics (Vercel Inc.) counts page views and events without cookies, using an identifier that is hashed and reset every day. Sentry (Functional Software, Inc.) records errors, and a replay of the screen for sessions that hit one, with all text, inputs and images masked into blocks so the replay shows shapes and clicks, not content.
Where the law asks for consent before non-essential cookies, which today means the European Economic Area, the United Kingdom and Switzerland, analytics and replay stay switched off until you accept them, and you can change that at any time from the Cookies link in the footer. Everywhere else they are on by default and the same link turns them off. Essential cookies cannot be switched off, because the app cannot work without them.
| Cookie | Set by | What for | Lasts |
|---|---|---|---|
sb-* | Us, through Supabase Auth | Keeps you signed in. Essential. | Until you sign out |
rg | Us | The parental gate pass, good for one visit. Essential. | 5 minutes |
sj_reading | Us | Lets spellingjoy.com show “Go to the app” instead of “Start trial”. Essential. | 1 year |
sj_consent | Us | Remembers your cookie choice. Essential. | 1 year |
rewardful.referral | Rewardful | Remembers which teacher or partner recommended us, so they are paid their share of what you pay. It records the referral, not you. Essential to that agreement. | 60 days |
_ga, _ga_* | Google Analytics | Tells visitors and sessions apart. Analytics. | Up to 2 years |
| Sentry replay id | Sentry | Ties a masked replay to an error report. Analytics. | The session |
5. Who handles data for us
These companies run parts of the service. Each gets only what its job needs, under its own data processing terms.
| Company | Job | What it sees |
|---|---|---|
| Supabase | Database and sign in | Account, child profile and play data |
| Vercel | Hosting and page-view analytics | Request logs, usage counts |
| Stripe | Trial, subscription, invoices | Email, card details, billing name |
| Resend | Sending our email | Email address and the content of the email |
| Google Analytics | Usage analytics | Events, device data, truncated IP |
| Sentry | Errors and masked replay | Error data, device data, masked screen replay |
| Rewardful | Crediting the partner who recommended us | That a referral led to a subscription, and the amount, never your name or your child’s |
| OpenAI | Making lesson pictures ahead of time | No personal data. Everything is generated before any child sees it |
| ElevenLabs | Making the buddy voices ahead of time | No personal data. The audio is recorded in advance and stored as files |
Several of these are in the United States, so if you are elsewhere your data is transferred there. We rely on those companies’ standard contractual clauses or equivalent safeguards for the transfer.
6. What we never do
We do not sell personal information and have not in the past twelve months. We do not share it for cross-context behavioural advertising. There is no advertising in the app at all. We do not profile a child for anything except teaching that child to read. We do not use your child’s data to train AI models.
7. How long we keep things
While the account is open we keep everything, so the child can carry on where they stopped. If you cancel, the child profile and play data stay for twelve months so you can come back without starting over, and are then deleted. If you delete the account from the Account page, the parent record, the children and the play data are deleted within thirty days. Stripe keeps invoices for as long as tax law requires. Google Analytics data is kept fourteen months, Sentry errors and replays ninety days, and hosting logs for a short period for security.
8. Your rights
Wherever you live you may see, correct, export or delete what we hold about you and your child. The Account page handles notification settings, billing and account deletion. For anything else, including rights under the GDPR, the UK GDPR or the California Consumer Privacy Act, email reading@spellingjoy.com from the account address. We answer within thirty days, never charge, and never treat anyone worse for asking. Under the GDPR our legal bases are the contract with you for running the app, our legitimate interest in keeping it secure and improving it, and your consent for analytics cookies and any marketing email. If you are in the EEA or the UK and our answer does not satisfy you, you may complain to your data protection authority.
As a parent you may also, at any time, review what we hold about your child, have it deleted, and refuse any further collection. Deleting a child’s data ends that child’s use of the app.
9. Email we send
Sign-in codes, receipts, the reminder two days before the trial converts, the weekly summary, and notices about the service. The summary and the reminders can be switched off on the Account page. Sign-in codes and receipts cannot be, while you hold an account. Marketing email only goes to people who asked for it and always carries an unsubscribe link.
10. Security
Data is encrypted in transit and at rest at our providers. Sign in is by one-time code, so there is no password to steal or reuse. Access to live data is limited to the people who run the service. No system is perfect; if a breach affects your data we will tell you without undue delay, and as the law requires.
11. Changes
If we change this policy in a way that matters, we email the account address at least fourteen days before it takes effect, and the date at the top always shows the current version. If we ever want to collect a new kind of information about children, we will ask parents to consent again first.
12. Contact
Veloris, LLC doing business as SpellingJoy, reading@spellingjoy.com. A real person reads it.