Privacy policy

Spelling Bees ("we", "us", "our") is a UK-based spelling-practice application for children in Years 3–6, part of the Tweenage family of apps. If you have any questions about this policy or your data, contact us at hello@answerthequestion.co.uk.

Rebecca Everton, a sole trader trading as Tweenage, is the data controller. ICO registration ZC120037. You can write to the controller at hello@answerthequestion.co.uk.

We collect the minimum data needed to provide the service:

• Parent account: email address and a hashed password (via Supabase Auth)
• Child profile: an avatar character chosen from a fixed list of six (Cat, Owl, Robot, Unicorn, Dragon, Fox) and a colour. The character's label, for example "Owl", is used as the display name in the App. We do not collect your child's name, surname, date of birth, address or school
• Practice data: spelling attempts, word-mastery stars, streaks, scores, and timestamps, so the App can schedule reviews and show how it is going
• Optional setup data: an 11+ exam date (if you choose to enter one) and any school spelling words you type in for your child to practise
• Book Bees words: if your child uses Book Bees, the words they look up and save, so their list is there next time (see section 3). Your child can also type an optional book title (up to 80 characters) to say where the word came from. The book title is stored with the saved word and is never sent to Anthropic
• Payment data: processed securely by LemonSqueezy. We never see or store your card details
• Free word list: if you ask for the free printable word list on our landing page, the email address you give us, so we can send it
• Technical records: like any website, our hosts see your IP address and browser type when they serve a page or sign you in. These sit in short-lived security logs; the table in section 5 says for how long

One feature uses AI: Book Bees, where a child types a word they have found in a book and gets back a card explaining what it means. To write that card we send the word to Anthropic (the Claude API). Nothing else in the App uses AI.

• What is sent: the single word your child typed, and nothing else. Not their name, not their age, not their practice history, not your account details. The word is checked first and must be one plain word (letters, hyphens or apostrophes, up to 30 characters).
• Please note: the box only accepts single words found in an English dictionary. Anything else, including names, places and brands, is refused on our server: it is never sent on to Anthropic, never stored, and never saved to your child’s words. A word that is also a name, such as Rose or Grace, is treated as the ordinary word and the card explains that word, not a person. Swear words and adult words are not in the dictionary either: the App says it does not have that word, and nothing is sent or stored.
• What comes back is checked before your child sees it, and cards are stored for up to 180 days so the same word does not need looking up twice.
• Not used for training: Anthropic's API terms state that data sent through the API is not used to train their models.
• You can avoid it entirely: Book Bees is the only place this happens. If nobody in your family uses it, no word ever leaves our systems.

Everywhere else, the App is plain software. There is no profiling, no automated decision-making that affects your child, and no behavioural advertising. The spaced-repetition schedule that decides which words come round again is a simple, transparent algorithm running on the curated word list, not AI.

The App can read words aloud (text-to-speech) and, if you switch on the optional "spell aloud" mode in Settings, listen to your child spelling a word using the device microphone. Both features use your browser's built-in Web Speech API.

• The microphone is used only when you have explicitly enabled "spell aloud", and only during a practice or test word.
• We do not record, store, or transmit any audio ourselves.
• Depending on your browser, speech may be processed on-device or sent by the browser/operating-system vendor (for example Google in Chrome, or Apple in Safari) to their own speech services to convert it to text. That processing is governed by your browser/OS provider's privacy policy, not ours.
• If you would rather no audio leaves the device, leave "spell aloud" off. The App works fully with the keyboard.

Under the UK GDPR, as amended by the Data (Use and Access) Act 2025, every use of personal data needs a lawful basis. We rely on four:

• Contract: to provide the App you have signed up for or bought, including keeping practice in step across the devices you use. This is our main basis.
• Legal obligation: to keep tax and accounting records of payments for as long as HMRC requires, and to handle rights requests and complaints as data protection law requires.
• Legitimate interests: to keep the App secure and working, to stop abuse (there are limits on how often sign-in, checkout and word lookups can be called), to give support, to send the service emails described below, and to count visits to our public pages in aggregate (section 9). We weigh these against your interests and your child's; none of them involves profiling.
• Consent: for the optional extras you ask for yourself, such as the free word list on our landing page. You can withdraw consent at any time, and nothing else changes when you do.

We do not send advertising or promotional email. If you request the free word list we email it once, and that is all we use the address for.

Practice reminders. If you have bought Spelling Bees, we may send you a small number of reminder emails about your own child’s practice: for example, a Monday note if this week’s school spellings have not been added yet, or a reminder after a few quiet days. These relate to the service you have paid for, so we send them on the basis of legitimate interest under the soft opt-in in regulation 22(3) of PECR. To decide whether one is relevant we look only at whether a list has been added and whether a session has happened, never at what your child typed or got wrong. Every one of these emails carries a one-click link to stop them with no login, and you can switch each type off at any time in Settings → Email updates. We never send more than one in a day, and comeback reminders stop on their own if they are ignored twice.

What we hold, why, and for how long

"Straight away" means the moment you delete it in the App. Supabase keeps a daily backup for 7 days, so a deleted record can sit in a backup for up to 7 days before it is gone for good.

Swipe the table sideways to see every column.

The App is used by children aged 7–11, so the UK ICO's Age Appropriate Design Code (the "Children's Code") applies. We have designed the App to comply with it:

• Parent-managed accounts: the account holder is always a parent or guardian. Children do not create accounts, give an email address, or submit personal data directly.
• Data minimisation: a child profile is an avatar character picked from a fixed list. Its label (for example "Owl") is the display name. We do not collect a name, surname, date of birth, school, address or photograph.
• High privacy by default: all child data is private to the parent account. Database row-level security ensures one family can never see another's data.
• No profiling or manipulation: no behavioural advertising and no automated decisions affecting the child. The one place AI is used, Book Bees, only writes an explanation of a word; it makes no judgement about your child and is described in full in section 3.
• No dark patterns: streaks and stars exist to encourage a healthy practice habit, not fabricated scarcity or autoplay designed to extend screen time.
• No geolocation and no child-to-child contact. There are no leaderboards, messaging, forums, or shared content between users.
• Parental controls: a parent can view all practice data, change settings, and remove a child's profile and everything saved with it (practice history, settings, school lists and saved words) from Settings → Your data. That deletion is immediate and cannot be undone.

If you have any concerns about how your child's data is handled, please contact us at hello@answerthequestion.co.uk.

Data is stored in Supabase, in a PostgreSQL database hosted in the EU (Amazon Web Services, Ireland). It is encrypted in transit (TLS) and at rest, and row-level security means each parent can only reach their own family's data. Supabase takes a daily backup and keeps each one for 7 days. The App also keeps a working copy of your child's practice data in the browser on each device you use, so practice works offline.

We do not sell, rent, or trade your data. We share data only with the processors that run the service:

• Supabase: database hosting and authentication
• Vercel: application hosting and privacy-friendly, cookieless usage analytics (aggregate only)
• LemonSqueezy: our merchant of record. They sell the product to you and take the card payment on their own checkout page, under their own privacy policy. We receive the order details, never the card
• Resend: sending our emails: account confirmation, receipt, password reset, welcome, and the practice reminders described in section 5. To address a reminder to the right child, these emails use the label of the avatar your child chose (for example "Owl") alongside your email address. No child name is collected, so none is sent.
• Anthropic: writing the meaning card in Book Bees, and only the single word your child typed, as described in section 3. If your family does not use Book Bees, nothing is ever sent to Anthropic.

All sub-processors are engaged on terms which ensure their data processing obligations are observed. Supabase, a US company, holds our database in Ireland. Vercel, Resend and Anthropic process data in the United States. Each of these transfers rests on a safeguard UK law recognises: Standard Contractual Clauses with the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework. We keep a register of these providers, what each receives, where it processes it and the agreement it works under, and we review it whenever one of them changes.

We do not use Google Analytics, advertising networks, retargeting, or cross-site tracking.

The App keeps a few things in your browser, all of them needed to make it work. Separately, on our public pages we count visits in aggregate from visitors who are not signed in, unless you say no. Nothing is counted inside the App or while you are signed in.

• Sign-in token: set by Supabase Auth so you stay signed in. Strictly necessary; it goes when you sign out.
• The App's working copy of settings and practice data, so practice works offline and syncs when you are back online. Strictly necessary.
• Your cookie choice, so we do not ask again.
• Visit counting (public pages only, not signed in): Vercel Web Analytics counts page views on the landing, sign-up, sign-in and policy pages in aggregate, for visitors who are not signed in. Only the page's address is sent, never anything after it in the link. It sets no cookie and uses no identifier beyond a hash that Vercel discards within 24 hours, so it cannot follow you across sites or over time. It never counts a signed-in parent, a signed-in page or a child's practice.

Since 5 February 2026, UK law has allowed a site to count visits for its own statistics without asking first, as long as it explains clearly and offers an easy way to say no. This section is the explanation, the cookie notice offers the no, and this switch works at any time:

We use no advertising, retargeting, or cross-site tracking cookies. Affiliate links on the Books we love page (Amazon, Bookshop.org) may set their own cookies on those sites if you click through; that is governed by their policies, not ours.

We keep your data for as long as your account is active; the table in section 5 gives the period for each kind. Two ways to end that:

• Remove one child: Settings → Your data. That child's profile and everything saved with it is deleted straight away.
• Delete the whole account: also in Settings → Your data. Type the confirmation phrase and your account, every child profile and all practice data are permanently removed straight away. If you cannot sign in, email us from the address on the account and we will do it within 30 days and confirm when it's done.

Two details about Book Bees (section 3). Your child's own saved list of words lives with their profile and is deleted with it. The meaning cards themselves sit in a shared cache keyed by the word, so that the same word is never looked up twice for anyone, and are kept for up to 180 days. That cache is a dictionary of words, not a record of your child; it notes which account first requested a word so the lookup can't be run twice at once.

Payment records outlive the account because UK tax law requires it. Deleting your account detaches them from you but does not delete them; the table in section 5 gives the period.

Under UK GDPR you have the right to:

• Access: request a copy of your personal data
• Rectification: correct any inaccurate data
• Erasure: request deletion ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Object: object to processing based on legitimate interest
• Withdraw consent: for anything you opted into, at any time. Visit counting has its own switch in section 9; for the free word list, email us

To exercise any of these rights, email hello@answerthequestion.co.uk. We will respond within 30 days.

If you are not satisfied with how we handle your data, contact us first at hello@answerthequestion.co.uk and we will work to resolve it. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.

This policy may change, so we recommend that you revisit it from time to time. The "last updated" date at the top of this page always shows the current version. If we make a significant change, such as a new processor or a new use of data, we will also email account holders before it takes effect.