Privacy Policy

Who is responsible

Spelloom is provided by Osipchuk Viktor, an individual based in Ukraine, who is responsible for processing your personal data. General enquiries: [email protected]. Privacy requests: [email protected].

This Privacy Policy explains how Spelloom (“Spelloom”, “we”, or “us”) collects, uses, shares, stores, and protects information when you use the Spelloom mobile application, website, and related services.

Information we collect

• Account and identity data: email address, profile name, internal user ID, and identifiers provided by Apple or another sign-in provider.
• Learning data: selected languages and courses, words, answers, study history, progress, streaks, statistics, room participation, leaderboard results, and settings.
• Content you provide: custom words, examples, images, audio recordings or files, profile information, room content, and messages or attachments sent to support.
• Voice data: microphone audio used for pronunciation exercises. Speech recognition may be processed by Apple. Recordings attached to custom words are uploaded only when you choose to record or add them.
• Purchase data: subscription product, entitlement, transaction status, renewal, and restore information. Payments are processed by Apple; Spelloom does not receive your complete payment-card details.
• Device and usage data: device or push-notification token, app and operating-system information, internal identifiers, screens viewed, feature interactions, and diagnostic or security events needed to run and improve the service.
• Network, location and search data: IP address and the approximate country derived from it, time zone, interface language, and the search queries you enter in the Word Bank, which stay in our server logs for up to 30 days.
• Website and launch-notification data: email address, page language, form source, consent date and time, and, only with your consent, website analytics such as page views and button interactions.

How we use information

We use information to create and secure your account, provide and synchronize learning features, personalize exercises and review timing, operate rooms and leaderboards, deliver notifications you request, manage subscriptions, provide support, prevent abuse, troubleshoot problems, and understand and improve Spelloom.

Service providers and sharing

We share only the information needed for a provider to perform a service for Spelloom:

• Apple: Sign in with Apple, in-app purchases, push notifications, and speech-recognition services.
• Google Firebase: app analytics, app integrity checks, push-notification delivery, and crash reports.
• RevenueCat: subscription entitlement, purchase, renewal, and restore management.
• YouTube/Google: playback of learning videos. YouTube may process device and viewing information under its own privacy terms.
• OpenAI and Google Cloud AI: when a custom word is enriched or generated audio is requested, the word, language, and limited context needed to create a transcription, example, level, part of speech, or audio may be processed by the configured provider. We do not send your account email for this purpose.
• Public-content moderation: Profile and room photos are reviewed by moderators before they are shown to other users. Public names, room descriptions and icons are checked by a local text filter; flagged content and links require moderator review. We do not send these profile or room drafts to AI for review. You can report content and block users in the app.
• Hosting, storage, email, and security providers: infrastructure required to deliver and protect the service.

We may also disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. We do not sell personal information, use it for third-party advertising, or track you across other companies’ apps and websites.

Analytics, consent, and your choices

Optional iOS usage analytics is off by default. You can enable or withdraw it under Profile → Settings → Usage analytics. With permission, Firebase receives screen and feature interactions, an internal account ID and an app-instance identifier; RevenueCat can use that identifier to associate subscription events. Website Google Analytics 4 runs only after cookie consent and may include your demo account ID. These identifiers are pseudonymous, not anonymous. We do not send your email address or form responses to Google Analytics. Change website consent through Cookie settings in the footer. Disabling optional analytics does not disable learning, purchases, operational records or security and crash diagnostics.

You control microphone, speech-recognition, and notification permissions in iOS Settings. You may withdraw consent previously given for launch emails or other optional processing by contacting us. Withdrawal does not affect processing that already occurred.

Retention

Account, learning, and user-provided content is retained while your account is active. Push tokens are retained while needed to deliver enabled notifications. Launch-notification data is retained until the launch message is sent or you withdraw consent. Analytics, security logs, support communications, and subscription records are retained only for the period reasonably necessary for the purposes above, dispute resolution, security, accounting, or legal obligations. Deleted data may remain temporarily in restricted backups until the backup rotation completes.

Account deletion

You can delete your account directly in the app (Profile → Settings → Delete account) or request deletion by contacting us. Account data is removed from active systems, except information we must retain for legal, fraud-prevention, security, accounting, or dispute-resolution purposes. Deletion is permanent. Deleting your Spelloom account does not automatically cancel an Apple subscription; subscriptions must be managed separately in your Apple Account settings.

Security and international processing

We use technical and organizational safeguards, including encrypted HTTPS connections and access controls. No system is completely secure. Service providers may process information in countries other than yours, subject to their contractual and legal safeguards.

Children

Spelloom is not directed to children under 13 or the minimum digital-consent age in their country. If you believe a child provided personal information without appropriate permission, contact us so we can investigate and delete it.

Your privacy rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or an objection to certain processing. You may also withdraw consent where processing relies on consent. Contact us to make a request; we may need to verify your identity.

Messages and optional features

Promotional emails and promotional pushes have separate opt-in controls in Profile → Settings → Notifications. You can withdraw each separately; iOS notification permission alone is not consent to promotional messages. Essential account, billing, support and security messages are separate. AI enrichment and generated audio require the permission shown before submission; you can instead enter words manually. Microphone and speech permissions can be revoked in iOS Settings.

What other users can see

Your approved display name and avatar may be visible to other users. Leaderboard visibility is controlled in settings. Joining a room shares membership and learning progress with its members and owner. The owner can see exam results; other members can see them only when room settings permit. Words, examples and media you add to a shared room are available to its members. Anyone with an invitation link may see the room invitation preview, so share links only with intended recipients. Do not add personal or confidential information to shared learning content.

Legal grounds and privacy requests

Where GDPR applies, we process account, learning, purchase and requested support data to perform our agreement with you; optional analytics, promotional messages and optional AI submissions on consent; and necessary security, fraud prevention and diagnostics on our legitimate interest in operating a reliable service. Legal obligations may require particular records. You may object to processing based on legitimate interests and complain to the supervisory authority where you live, work or believe an infringement occurred. Contact [email protected] to exercise your rights. Where GDPR applies we normally respond within one month; if a permitted extension is needed, we explain it.

Deletion and provider records

In-app deletion removes your account and linked learning history from our active database and queues removal of account media. Independently saved copies of shared content may remain with their recipients; contact us about personal information in such copies. Deleting a Spelloom account does not instantly erase all provider records or Apple purchase records. For access or deletion of provider-held data, contact [email protected] so we can identify the relevant records and handle the request with the provider, subject to applicable retention duties. Analytics retention depends on provider settings; backups and security, transaction or dispute records may expire on separate schedules. We do not promise immediate deletion from every backup or provider.

Protection by service providers

We require service providers receiving personal data on our behalf to protect it to the same or an equivalent standard described in this policy and required by applicable law and Apple’s rules. Access must be limited to the service purpose. Providers may operate outside your country; where GDPR requires safeguards for a transfer, an applicable adequacy decision or appropriate contractual safeguards such as standard contractual clauses must be used. Contact us for information about the safeguards applicable to your data.

Changes to this policy

We may update this policy when our services or legal obligations change. We will publish the updated version here and change the date above. We will provide additional notice when a material change requires it.

Contact

For privacy questions, email [email protected].