Privacy Notice

Who is responsible

Michael Nelson, a sole trader trading as darklingspy games, supplies The Spelling Cube and is the data controller for personal data processed to provide the app. This notice is written for parents and guardians. For privacy requests, email darklingspy@gmail.com.

Children's progress stays on the device

There are no pupil accounts and no advertising. Child nicknames, selected child, spelling dates and streaks, stars, records and custom word lists are saved in your browser on that device, not in our online progress records. Anyone with access to the device may see them. You can remove local progress using the app's reset controls or clear browser storage. Local data does not move automatically to another device.

The service does send handwriting and scanned-sheet images for AI reading when you ask it to check or scan. It is therefore not a service that collects no data.

What we process and why

• Parent account: email, authentication credentials and account identifiers, to create and secure your account, send confirmation/recovery messages and provide access. Legal basis: performance of our contract and legitimate interests in security.
• Trial and subscription records: account identifier, trial dates, subscription status, plan and billing-period identifiers, to manage access and renewals. Legal basis: contract performance and legal obligations for relevant financial records. Paddle handles payment card information; it is not stored by the app.
• Handwriting and sheet images, target words and recognition results: to read spellings and extract word lists when requested. These may contain personal data if you include it. Legal basis: contract performance for the requested function; legitimate interests in providing educational practice where incidental child personal data is involved. Please crop sheets and omit names and other personal details.
• Technical data: IP addresses, browser/device information, request and error/security logs may be processed by hosting and service providers to deliver the app, diagnose faults and prevent abuse. Legal basis: legitimate interests in a safe, reliable service.
• Support correspondence: any email or details you provide when asking for help, to respond and resolve problems. Legal basis: contract performance or legitimate interests in handling enquiries.

We do not use pupil work for advertising or maintain online pupil profiles. We do not send marketing messages as part of the current service.

Who receives data

Lovable Cloud provides hosting and parent account services. Handwriting and sheet images are sent through Lovable's AI Gateway to an OpenAI vision model for recognition. Providers may also process operational logs under their own service arrangements; this notice does not promise that images are instantly deleted or never retained by providers.

Paddle receives the data needed for product sales, subscription management, payments, tax compliance and invoicing, acting as Merchant of Record under its privacy notice. Hosting, email-delivery, AI and support providers process information needed to deliver their services. Professional legal/accounting advisers and authorities may receive data when required for lawful advice or a legal obligation.

The app loads fonts from Google Fonts; Google receives technical connection information such as your IP address when your device requests them.

Retention and security

Local progress remains until removed on the device. Parent account and access records are kept while needed to run your account and resolve billing or security issues. Relevant financial records may need to be kept for statutory retention periods. Data no longer needed will be deleted or anonymised, subject to lawful retention and backup cycles.

The app does not save submitted images in a pupil image library. AI and hosting providers may retain requests or logs according to their service policies; provider retention periods need confirmation before live launch.

We use appropriate technical and organisational safeguards, including encrypted connections, account authentication and access controls. No online service can guarantee absolute security.

International transfers

Hosting, AI, payment and other providers may process data outside the UK or EEA. Where required, transfers must be covered by an adequacy decision or appropriate contractual safeguards, such as standard contractual clauses with a UK Addendum or the UK International Data Transfer Agreement. The applicable provider arrangements and safeguards need confirmation before live launch.

Your rights

Under UK GDPR, where applicable, you may request access, correction, erasure, restriction, portability or object to processing, including on behalf of your child where appropriate. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. We normally respond within one month, with any lawful extension explained.

Online account deletion does not clear progress stored on your devices. For privacy requests, email darklingspy@gmail.com. You may complain to the UK Information Commissioner's Office at ico.org.uk.

Cookies and browser storage

The app uses essential browser storage for parent sign-in and device-only preferences and progress. Hosting and checkout providers may use essential cookies or storage for security, sessions and payments. The app does not intentionally add advertising or optional analytics cookies. You can manage cookies in your browser and clear local storage; blocking essential storage may prevent sign-in, checkout or saving progress. Any future optional analytics or marketing cookies would require appropriate notice and consent before use.