Privacy
Last updated 24 September 2026
Spelling Garden is run by UNSEEN FORMS LIMITED, which is the data controller for everything described here. This page says exactly what we store, why, who else sees it, and how to make us delete it.
The short version
- You can play without giving us your name, your email, or anything else.
- We set no cookies at all unless you sign in.
- We use no advertising trackers and no third-party analytics. Nothing about you is sold or shared for marketing. The one exception is narrow and described below: if you arrived through one of our adverts on Facebook or Instagram, we tell Meta when that click led to somebody playing, so we can stop paying for clicks that do not.
- We do keep a detailed record of your spelling practice, because that record is the product: it is what schedules your reviews.
- The only time we ever need your email is if you subscribe, and it is collected by Stripe rather than typed into our site.
Playing without an account
When you first play, your browser is given a random token which it keeps in
localStorage. That token is how we recognise your garden when you
come back. We store only a SHA-256 hash of it, so the value in our database
cannot be used to access your garden.
This is not a cookie and it is not a tracking identifier. It is never sent to anyone else, it does not follow you to other websites, and it exists only so that the garden you planted is still there tomorrow.
It also means an unclaimed garden lives in one browser. If you clear your browser data, that garden is gone and we cannot recover it, because the only copy of the token was the one you cleared.
A second device. On an iPhone, a web app added to the Home Screen keeps its storage apart from Safari's, so to bring your garden across, Safari shows a one-time garden code. The app gets a token of its own for the same garden when it uses that code, and we store only a SHA-256 hash of it, as with the first. The code works once, for thirty minutes, and only its hash is stored.
What is stored against that token
| What | Why |
|---|---|
| Every answer you type, including wrong ones, with how long it took and whether it was right | It is what decides when a word comes back, and it is how we measure which words are genuinely hard |
| Every answer you pick in a vocabulary question: which of the three meanings you chose, whether it was right, and how long you took | Same reasons, plus it is how we find a wrong answer that is misleading and rewrite it |
| Which words are in your garden, where you planted them, and when each is next due | It is your garden |
| Any memory hooks you write for a word | You wrote them; they are shown back to you and to nobody else |
| Your estimated spelling ability and vocabulary level | It decides which words you are served next |
| Achievements, daily completions, the days you watered without a mistake, and your streak | Progress |
| Whether you spell in British or American English, and your region | Which spellings we show you and which voice reads to you |
| The date you last used the app | So abandoned gardens can eventually be cleared out |
| A handful of moments: reaching the subscribe screen, starting a checkout, subscribing, cancelling, signing in | So we can tell whether the paid part is working. Five events, all first-party, no third party involved |
The website that linked you here, if any, and any tag on the link
you arrived through (a partner's ref code, or the
utm campaign labels an advert carries) |
To know where people find us, and to pay a partner their share when someone they sent subscribes. We keep the site name and the tag only, never the full address, and never anything for someone who typed us in directly. The tag is read from the address once and then removed from it |
If you arrived through one of our adverts on Facebook or Instagram:
the click identifier Meta put on that link (fbclid) |
So that we can report back to Meta which advert clicks led to someone actually playing. See Advertising below. Nobody who arrived any other way has one |
Also in localStorage, and never sent to us at all: whether you
muted the music, whether you forced day or night, which garden you were last
looking at, which plants sparkled today, which voice (British or American) the
game reads to you, whether you last listened to the British or the American
voice on the dictionary pages, and whether you switched these pages to light or
dark.
What we publish from it
The dictionary pages at spelling.garden/spell/ show, for each word, how many people got it wrong the first time they were asked to spell it, the misspellings they typed most often, and which other words the people who got it wrong also got wrong. These are totals across everyone who has played. A misspelling or a pairing of words only appears once at least three different people account for it, nothing on those pages says who typed what, and answers from our own staff accounts are left out.
If you subscribe
Payments are taken by Stripe. Your card details are entered on Stripe's own page and we never see or store them. From a purchase we keep your email address, Stripe's customer and subscription references, whether the subscription is active, when it renews or ends, and which screen you were on when you decided to subscribe.
Your email address is the only piece of directly identifying information we hold, and we use it for exactly three things: sending your one-time sign-in links, sending your purchase confirmation, and replying if you contact us. We do not send marketing email and there is no mailing list to be added to.
Daily reminders
If you turn on a daily reminder, your browser gives us a push address: the address your browser's own notification service (Google, Apple, Mozilla or Microsoft, depending on the browser) uses to deliver a notification to it. We keep that address and the time the next reminder is due, and nothing else with it: it is not linked to your garden, your answers or anything else we hold. The reminder itself carries no content from us beyond the fact that it was sent; the words you see are built into this site. Turning the reminder off deletes the address straight away, and so does the notification service telling us it no longer works.
Advertising
We advertise on Facebook and Instagram. There is no Meta pixel on
this site, no Meta script and no Meta cookie. Instead, for a player who
arrived through one of those adverts (which we know from the fbclid
above), our own server tells Meta when six things happen, each at most once:
you answer your first word, you finish the placement test, you finish your
first day, you come back on a later day, you fill your free garden, and you
subscribe. With each report we send the click identifier,
your IP address and browser type at that moment, and, only for a subscription,
a SHA-256 hash of the email address Stripe collected, plus the amount paid.
Nothing else: not your answers, not your words, not your garden.
Meta uses these reports to work out which of its users are likely to become players rather than accidental clicks, and to show our advert to fewer of the latter. That is the whole purpose. If you did not arrive through a Meta advert, none of this happens and Meta is never told anything about you. The report is held on our server for at most a few minutes before it is sent, and the IP address and browser type are deleted from our copy as soon as it has gone.
Cookies
An anonymous player is set no cookies. Not for analytics, not for functionality, not for anything. That is why there is no cookie banner here: a banner is required for tracking, and we do none.
If you sign in, we set a single session cookie (sg_sid) which
keeps you signed in and does nothing else. It is sent only over a secure
connection and cannot be read by scripts on the page. Stripe sets its own cookies on
Stripe's checkout page, which is Stripe's domain and their policy.
IP addresses
Your IP address is stored in only six places, all briefly:
- The first time you play, once, to work out which country you are in. That decides whether you are taught British or American spellings and which voice reads the words to you, so that an American arrival is not marked wrong for writing "color" all through their first session. We keep the country, not a record of you: you can change it at any time from the menu, and the app also adjusts on its own as it sees how you actually spell.
- When you start a checkout, so we can quote you a price in your own currency. The lookup is done by ip-api.com, which means your IP is sent to them at that moment. We cache the result for up to 30 days so we do not have to ask again.
- When a sign-in link is requested, to stop the form being used to send mail to people who did not ask for it. These records are deleted after about two days.
- When a garden code is typed in, so that codes cannot be guessed at speed. These records are deleted after about two days.
- When a new garden is created, so that one address cannot create them by the thousand. We keep a scrambled form of the address (a keyed hash, not the address itself) with the time, and delete it after a day.
- If you came through a Meta advert, in the queued report described under Advertising, for the minutes between the milestone and the report being sent. Deleted from our copy once sent.
We do not log IP addresses against your gameplay. Like any website, our web server keeps standard access logs (IP address, browser type, the address of each page or request, and when) for about three months, for security and to fix problems. They are not joined to your account, and sign-in links, garden codes and checkout references are removed from them before they are written.
Who else your data reaches
| Who | What they get | Where |
|---|---|---|
| Stripe | Your email and payment details, at checkout and for renewals | USA and Ireland |
| Amazon Web Services (SES) | Your email address, to deliver sign-in links and receipts | Ireland |
| Amazon Web Services (S3) | Your IP address, because your browser fetches the spoken audio directly from our storage bucket | London |
| ip-api.com | Your IP address, on your first visit and at checkout | See their site |
| Your browser's notification service (Google, Apple, Mozilla or Microsoft) | Only if you turn on a daily reminder: an empty message at the time you chose, sent to the push address your browser gave us | Depends on the browser |
| Meta (Facebook and Instagram) | Only if you arrived through one of our adverts: the advert click identifier, your IP address and browser type at up to six milestones, and a hash of your email if you subscribe. See Advertising | USA and Ireland |
That is the complete list. There is no analytics provider, no session recorder, and no data broker; the only advertising network that hears from us is Meta, in the narrow case above. Where data reaches the USA it is under the transfer terms in that provider's own data processing agreement.
Why we are allowed to hold it
- To give you the thing you asked for. Your practice record, your garden and your schedule are the service itself. Without them there is no product.
- To take payment and meet our tax and accounting duties.
- Our legitimate interests in keeping the service working and not abusable: the sign-in rate limiting, and using anonymised results across all players to judge how difficult each word really is and to publish the totals described above; and in not paying for advertising that reaches nobody, which is the advert reporting described above. You may object to that reporting by writing to us, and we will stop it for your garden.
How long we keep it
- Anonymous gardens that have not been used for a long stretch may be deleted, along with everything attached to them.
- Subscription and payment records are kept for six years after the end of the relationship, because tax law requires it.
- Sign-in links expire after a day and are single use.
- Everything else is kept while your garden exists, and goes when it goes.
Your rights
Under UK and EU data protection law you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing based on legitimate interests. We will not charge you and we will answer within one month.
You can wipe your own progress at any time from the menu, which deletes your practice history, your garden, your ratings and your achievements. To delete the account itself, including your email address, write to hello@spelling.garden.
If you think we have got this wrong you can complain to the Information Commissioner's Office at ico.org.uk, or to your own national supervisory authority in the EU. We would rather you told us first.
Children
Spelling Garden is built for adults and is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created a garden here, write to us and we will delete it.
Changes
If we change what we collect or who we share it with, we will change this page and move the date at the top. Material changes affecting subscribers will be sent by email.