Privacy

Last updated 2 September 2026

Wordwhirl is used by children, so this page says exactly what we hold, who else sees it, and how to take it back. If anything here is unclear, email hello@wordwhirl.app and ask.

The short version

• A child never makes an account. A grown-up does, and adds children inside it.
• We ask for a first name, an avatar, a grade and, optionally, a 4-digit PIN — no surname, no birthday, no photo, no address.
• We record how the spelling practice goes, because that is the product.
• There are no advertising or analytics trackers anywhere on the site, and none at all on the pages children use.
• You can download everything or delete everything from your account settings, at any time, without asking us.

What we collect about your child

• First name — shown on their screen and used inside their stories.
• Avatar and colour — a picked emoji character, not a photograph.
• Grade level — sets how hard the stories read.
• An optional 4-digit PIN — stored as a one-way hash, so we cannot read it back. It keeps siblings out; it is not a security measure against adults.
• Spelling performance — which words they have practised, which they got right or wrong and how often, which stage of the practice schedule each word sits in, quiz scores, which games they played and when, their daily streak, and the badges they have earned.
• The stories and word lists made for them, including the full story text.

We do not collect a surname, date of birth, address, phone number, photograph, voice recording, precise location, or anything from their device's contacts, camera or microphone. Children are never asked to type anything into the site except spelling words.

What we collect about you, the grown-up

Your name, your email address and a hashed password. If you subscribe, Stripe handles the payment and holds the card details — we never see or store a card number.

Who else sees it

We do not sell data, and we do not share it for advertising. It reaches exactly three places:

• Cloudflare hosts the site and the database, so everything above is stored on their infrastructure. Two features also send content to Cloudflare's AI service:
  • Reading a word aloud sends the single spelling word — nothing else, no name, no account — and gets back an audio clip. Because the same words come up across every family, clips are cached and reused.
  • Making a story sends the word list and your child's first name, so the story can be about them. Island quests send the word list only — no name.
• Stripe handles subscriptions. Stripe receives the grown-up's email address and payment details. No information about any child is sent to Stripe.
• Nobody else. There are no third-party analytics, advertising, session recording or tracking scripts on this site — not on the marketing pages, not in the grown-up area, and not on any page a child uses.

Consent

The grown-up account is how consent works. Only an account holder can add a child, and adding one requires confirming that you are that child's parent or guardian and have read this page. Children cannot sign themselves up, cannot invite anyone, and cannot change account or billing settings — the grown-up area can be locked behind a separate PIN.

You can withdraw consent at any time by deleting the child, or the whole account.

Classrooms

A teacher can make a class, put their spelling lists in it, and give out a six-character join code. This is the only way anyone outside your household sees anything about your child, and it only ever happens because you typed that code and ticked a box.

• The teacher sees the class's words only. How your child is getting on with the words on the class's lists: which they have mastered, which they keep missing, and when they last practised one. Your family's own word lists, your child's stories, their badges, their island and your account are not visible to the teacher, and are not reachable from any screen they have.
• You can leave at any time. “Leave class” on your dashboard ends it immediately. Your child keeps everything; the teacher's class view stops including them.
• A child added by a teacher carries a first name or an initial, and nothing else. If a teacher sets a child up at school before a grown-up has an account, that profile lives under the teacher's account until a parent claims it with the codes on the printed card. Claiming moves the profile into your account, and from then on it is yours.
• Archiving a class removes its lists from every child's screen. A teacher cannot see anything about a child once the child has left or the class has been archived.

Getting your data out, or deleting it

• Download it. Account → “Download your family's data” gives you one JSON file containing every profile, word list, statistic, game, quiz and story we hold.
• Delete one child. Their progress, stories, quiz history, streak and badges are erased. Your family's word lists stay, because their brothers and sisters share them.
• Delete the whole account. Account → “Delete your account” removes your login and every child's data with it. There is no undo, so download first if you want a copy.

Deletions take effect immediately. Backups and cached audio clips of individual dictionary words may persist for a short period afterwards; the audio contains no personal information.

How long we keep it

For as long as the account exists, because the whole point is to track progress over a school year. Delete the account and it goes.

Changes

If we change what we collect or who receives it, we will update this page and say so on the grown-up dashboard before the change takes effect.

Contact

Questions, corrections, or a request to see what we hold: hello@wordwhirl.app.