Privacy Policy

Information we collect

From parents, guardians, and educators (account holders):

• Name and email address, used to create and manage your account.
• A password, stored only as a cryptographic hash — we never store or see your plain-text password.
• Organization name, for school or club accounts.
• Billing details for paid plans, handled by our payment processor Stripe. Card numbers are sent directly to Stripe and never touch our servers.

About children (player profiles):

• A screen name (we encourage made-up names, and offer a random name generator).
• Age, used only to select age-appropriate word difficulty.
• A login PIN, stored only as a keyed cryptographic hash.
• Game activity: words practiced, spelling attempts, stars, levels, streaks, and accuracy — used to show progress to the child and their parent or educator.

Collected automatically:

• A session cookie strictly required to keep you signed in (httpOnly, not used for tracking).
• IP addresses, used transiently for security rate limiting and abuse prevention.

We do not use analytics trackers, advertising cookies, or fingerprinting. We do not collect precise location, photos, voice, or contacts.

Children's privacy (COPPA)

bSpell is designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA) for children under 13:

• Parental consent first.A child profile can only be created by a verified adult account holder who completes a consent step agreeing to these terms on the child's behalf. Children cannot create accounts themselves.
• Data minimization. We collect from children only what the service needs: a screen name, an age, and gameplay activity.
• No ads, no selling. We show children no advertising of any kind, and we never sell or rent personal information.
• Leaderboards show screen names only.Optional global leaderboards display only the child's screen name and score — never real names, ages, or any contact information.
• Parental control.Parents and guardians can review their child's information and progress, correct it, or delete the child's profile at any time from the dashboard. Deleting a profile deactivates the child's access and their data is removed from active use.
• Consent withdrawal.You may withdraw consent at any time by deleting the child's profile or contacting us at bspellsupport@gmail.com.

How we use information

• To provide the service: sign-in, spelling games, progress tracking, badges, and leaderboards.
• To let parents and educators monitor the progress of players in their account.
• To process subscription payments and manage plans.
• To keep the service safe: rate limiting, abuse prevention, and account security.

We do not use personal information for marketing, profiling, or automated decision-making.

Who we share information with

• Stripe— payment processing for paid plans (account-holder billing information only; never children's data).
• Cloud infrastructure providers — we host our application and database with reputable cloud providers who process data on our behalf under contract.

We never sell personal information. We may disclose information if required by law, or to protect the safety of children using the service.

Data retention and deletion

Account data is kept while your account is active. When you delete a player profile, it is deactivated immediately and no longer accessible in the product. You can request full deletion of your account and all associated data by contacting bspellsupport@gmail.com. We honor verified deletion requests within 30 days.

Security

• Passwords hashed with bcrypt; player PINs stored as keyed hashes.
• Session cookies are httpOnly and secure in production.
• Login and sensitive endpoints are rate limited, with lockouts on repeated PIN failures.
• Access to children's data is restricted by account membership and role.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Parents and guardians may exercise these rights for their children. Contact us at bspellsupport@gmail.com and we will respond within 30 days.

Changes to this policy

If we make material changes to this policy — especially changes affecting children's data — we will notify account holders by email and require renewed consent where the law requires it.

Contact us

Questions about privacy or COPPA: bspellsupport@gmail.com
bSpell