Privacy
Last updated 9 October 2026
Spelling Garden is run by UNSEEN FORMS LIMITED, which is the data controller for everything described here. This page says exactly what we store, why, who else sees it, and how to make us delete it.
The short version
- You can play without giving us your name, your email, or anything else.
- We set no cookies at all unless you sign in.
- We use no advertising trackers and no third-party analytics. Nothing about you is sold or shared for marketing. The one exception is narrow and described below: if you arrived through one of our adverts on Facebook, Instagram or ChatGPT, we tell Meta or OpenAI when that click led to somebody playing, so we can stop paying for clicks that do not. (And if you subscribe from a connection one of those adverts was recently clicked from, we tell Meta about that subscription.)
- We do keep a detailed record of your spelling practice, because that record is the product: it is what schedules your reviews.
- The only time we ever need your email is if you subscribe, and it is collected by Stripe rather than typed into our site.
Playing without an account
When you first play, your browser is given a random token which it keeps in
localStorage. That token is how we recognise your garden when you
come back. We store only a SHA-256 hash of it, so the value in our database
cannot be used to access your garden.
This is not a cookie and it is not a tracking identifier. It is never sent to anyone else, it does not follow you to other websites, and it exists only so that the garden you planted is still there tomorrow.
It also means an unclaimed garden lives in one browser. If you clear your browser data, that garden is gone and we cannot recover it, because the only copy of the token was the one you cleared.
A second device, or a second browser. On an iPhone, a web app added to the Home Screen keeps its storage apart from Safari's, so to bring your garden across, Safari shows a one-time garden code. And if you are playing inside Facebook's or Instagram's own browser, the page makes a one-time garden code so that you can open the same garden in Safari or Chrome instead; it rides in the page's address while you are there. Either way, the new browser gets a token of its own for the same garden when it uses that code, and we store only a SHA-256 hash of it, as with the first. The code works once, for thirty minutes, and only its hash is stored.
What is stored against that token
| What | Why |
|---|---|
| Every answer you type, including wrong ones, with how long it took and whether it was right | It is what decides when a word comes back, and it is how we measure which words are genuinely hard |
| Every answer you pick in a vocabulary question: which of the three meanings you chose, whether it was right, and how long you took | Same reasons, plus it is how we find a wrong answer that is misleading and rewrite it |
| Which words are in your garden, where you planted them, and when each is next due | It is your garden |
| Any memory hooks you write for a word | You wrote them; they are shown back to you and to nobody else |
| Your estimated spelling ability and vocabulary level | It decides which words you are served next |
| Achievements, daily completions, the days you watered without a mistake, and your streak | Progress |
| Whether you spell in British or American English, and your region | Which spellings we show you and which voice reads to you |
| The date you last used the app | So abandoned gardens can eventually be cleared out |
| A handful of moments: whether you passed the sound check before the test, reaching the subscribe screen, starting a checkout, subscribing, cancelling, signing in, turning a daily reminder on or off, and moving your garden out of Facebook's or Instagram's browser | So we can tell whether the test and the paid part are working. All first-party, no third party involved |
The website that linked you here, if any, and any tag on the link
you arrived through (a partner's ref code, or the
utm campaign labels an advert carries) |
To know where people find us, and to pay a partner their share when someone they sent subscribes. We keep the site name and the tag only, never the full address, and never anything for someone who typed us in directly. It is recorded once, when your garden is started, and never changed afterwards; if you subscribe, it stays with your account on every device you sign in on. Nothing is stored in your browser for this: the tag is read from the address of the page you arrived on, sent to us with your garden's first request, and removed from the address. If you move between our pages before opening the game, it travels in the links rather than in storage |
If you arrived through one of our adverts on Facebook or Instagram:
the click identifier Meta put on that link (fbclid) |
So that we can report back to Meta which advert clicks led to someone actually playing. See Advertising below. Nobody who arrived any other way has one |
If you arrived through one of our adverts in ChatGPT: the click
reference OpenAI put on that link (oppref) |
The same, for OpenAI. See Advertising below. A link in one of ChatGPT's own answers carries no such reference, and nobody who arrived any other way has one |
| If your garden was started, with no tag of its own, on an internet connection that one of our adverts had been clicked from in the seven days before: a note that it probably came from that advert | People often tap an advert inside Facebook or Instagram, leave, and come back later in their usual browser, which starts a second garden with nothing to say where it came from. The note lets us count those. It is a guess, made once, and it is kept apart from the tags above |
What else is kept in your browser
Apart from the token above, everything we keep in your browser's storage is either a setting you chose or something the game needs in order to work, and none of it records where you came from: whether you muted the music or turned off vibration, which garden you were last looking at, which plants sparkled today, which voice (British or American) the game reads to you, whether you last listened to the British or the American voice on the dictionary pages, whether you switched these pages to light or dark, and the time of your daily reminder if you set one. The game also notes the last garden code this browser used, so that an old code is not tried twice, and while a garden is being moved from one browser to another it holds that code until the tab is closed. A few more are only ever set by our own testing links and tools. None of this is sent to anyone else.
What we publish from it
The dictionary pages at spelling.garden/spell/ show, for each word, how many people got it wrong the first time they were asked to spell it, the misspellings they typed most often, and which other words the people who got it wrong also got wrong. These are totals across everyone who has played. A misspelling or a pairing of words only appears once at least three different people account for it, nothing on those pages says who typed what, and answers from our own staff accounts are left out.
If you subscribe
Payments are taken by Stripe. Your card details are entered on Stripe's own page and we never see or store them. From a purchase we keep your email address, Stripe's customer and subscription references, whether the subscription is active, when it renews or ends, and which screen you were on when you decided to subscribe.
Your email address is the only piece of directly identifying information we hold, and we use it for exactly three things: sending your one-time sign-in links, sending your purchase confirmation, and replying if you contact us. We do not send marketing email and there is no mailing list to be added to.
Daily reminders
If you turn on a daily reminder, your browser gives us a push address: the address your browser's own notification service (Google, Apple, Mozilla or Microsoft, depending on the browser) uses to deliver a notification to it. We keep that address and the time the next reminder is due, and nothing else with it: it is not linked to your garden, your answers or anything else we hold. The reminder itself carries no content from us beyond the fact that it was sent; the words you see are built into this site. Turning the reminder off deletes the address straight away, and so does the notification service telling us it no longer works.
Advertising
We advertise on Facebook and Instagram. There is no Meta pixel on
this site, no Meta script and no Meta cookie. Instead, for a player who
arrived through one of those adverts (which we know from the fbclid
above), our own server tells Meta when five things happen, each at most once:
you answer your first word, you finish the placement test, you finish your
first day, you come back on a later day, and you subscribe. With each report we send the click identifier,
your IP address and browser type at that moment, and, only for a subscription,
a SHA-256 hash of the email address Stripe collected, plus the amount paid.
Nothing else: not your answers, not your words, not your garden.
Meta uses these reports to work out which of its users are likely to become players rather than accidental clicks, and to show our advert to fewer of the latter. That is the whole purpose. The report is held on our server for at most a few minutes before it is sent, and the IP address and browser type are deleted from our copy as soon as it has gone.
There is one case where Meta hears about somebody who did not arrive through an advert themselves. If your garden was started on an internet connection that one of our adverts had been clicked from in the seven days before, and you then subscribe, we report that one subscription to Meta against that advert click, with the same details as above. Nothing else you do is reported. We recognise the connection from a scrambled form of its IP address, described under IP addresses below. If neither of these applies to you, Meta is never told anything about you.
We also advertise in ChatGPT, and it works the same way: no OpenAI pixel,
script or cookie on this site. For a player who arrived through one of those
adverts (which we know from the oppref above), our own server
tells OpenAI about the same five things, each at most once, with the same
details: the click reference, your IP address and browser type at that moment,
and, only for a subscription, a SHA-256 hash of the email address Stripe
collected, plus the amount paid. OpenAI uses them for the same purpose, and the
IP address and browser type are deleted from our copy once the report has gone.
Somebody who clicked a link in one of ChatGPT's own answers, rather than an
advert, is never reported, and OpenAI is never told anything about anybody
else.
Cookies
An anonymous player is set no cookies. Not for analytics, not for functionality, not for anything. That is why there is no cookie banner here: a banner is required for tracking, and we do none.
If you sign in, we set a single session cookie (sg_sid) which
keeps you signed in and does nothing else. It is sent only over a secure
connection and cannot be read by scripts on the page. Stripe sets its own cookies on
Stripe's checkout page, which is Stripe's domain and their policy.
IP addresses
Your IP address is stored in only seven places, all briefly:
- The first time you play, once, to work out which country you are in. That decides whether you are taught British or American spellings and which voice reads the words to you, so that an American arrival is not marked wrong for writing "color" all through their first session. We keep the country, not a record of you: you can change it at any time from the menu, and the app also adjusts on its own as it sees how you actually spell.
- When you start a checkout, so we can quote you a price in your own currency. The lookup is done by ip-api.com, which means your IP is sent to them at that moment. We cache the result for up to 30 days so we do not have to ask again.
- When a sign-in link is requested, to stop the form being used to send mail to people who did not ask for it. These records are deleted after about two days.
- When a garden code is typed in, so that codes cannot be guessed at speed. These records are deleted after about two days.
- When a new garden is created, so that one address cannot create them by the thousand. We keep a scrambled form of the address (a keyed hash, not the address itself) with the time, and delete it after a day.
- If you came through a Meta or ChatGPT advert, in the queued report described under Advertising, for the minutes between the milestone and the report being sent. Deleted from our copy once sent.
- Also if you came through a Meta advert, a scrambled form of the address you arrived from (a keyed hash, not the address itself), kept for seven days and then deleted. It is how a garden started later on the same connection is recognised as probably coming from that advert. Everybody else's is deleted after a day, as above.
We do not log IP addresses against your gameplay. Like any website, our web server keeps standard access logs (IP address, browser type, the address of each page or request, and when) for about three months, for security and to fix problems. They are not joined to your account, and sign-in links, garden codes and checkout references are removed from them before they are written.
Who else your data reaches
| Who | What they get | Where |
|---|---|---|
| Stripe | Your email and payment details, at checkout and for renewals | USA and Ireland |
| Amazon Web Services (SES) | Your email address, to deliver sign-in links and receipts | Ireland |
| Amazon Web Services (S3) | Your IP address, because your browser fetches the spoken audio directly from our storage bucket | London |
| ip-api.com | Your IP address, on your first visit and at checkout | See their site |
| Your browser's notification service (Google, Apple, Mozilla or Microsoft) | Only if you turn on a daily reminder: an empty message at the time you chose, sent to the push address your browser gave us | Depends on the browser |
| Meta (Facebook and Instagram) | Only if you arrived through one of our adverts: the advert click identifier, your IP address and browser type at up to five milestones, and a hash of your email if you subscribe. Or, if your garden was started on a connection one of our adverts was clicked from in the week before, the same for a subscription only. See Advertising | USA and Ireland |
| OpenAI (ChatGPT) | Only if you arrived through one of our adverts in ChatGPT: the advert click reference, your IP address and browser type at up to five milestones, and a hash of your email if you subscribe. See Advertising | USA |
That is the complete list. There is no analytics provider, no session recorder, and no data broker; the only advertising networks that hear from us are Meta and OpenAI, in the narrow cases above. Where data reaches the USA it is under the transfer terms in that provider's own data processing agreement.
Why we are allowed to hold it
- To give you the thing you asked for. Your practice record, your garden and your schedule are the service itself. Without them there is no product.
- To take payment and meet our tax and accounting duties.
- Our legitimate interests in keeping the service working and not abusable: the sign-in rate limiting, and using anonymised results across all players to judge how difficult each word really is and to publish the totals described above; in knowing where people find us and paying a partner their share when someone they sent subscribes, which is the record of the link you arrived through; and in not paying for advertising that reaches nobody, which is the advert reporting described above. You may object to that reporting by writing to us, and we will stop it for your garden.
How long we keep it
- Anonymous gardens that have not been used for a long stretch may be deleted, along with everything attached to them.
- Subscription and payment records are kept for six years after the end of the relationship, because tax law requires it.
- Sign-in links expire after a day and are single use.
- Everything else is kept while your garden exists, and goes when it goes.
Your rights
Under UK and EU data protection law you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing based on legitimate interests. We will not charge you and we will answer within one month.
You can wipe your own progress at any time from the menu, which deletes your practice history, your garden, your ratings and your achievements. To delete the account itself, including your email address, write to hello@spelling.garden.
If you think we have got this wrong you can complain to the Information Commissioner's Office at ico.org.uk, or to your own national supervisory authority in the EU. We would rather you told us first.
Children
Spelling Garden is built for adults and is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created a garden here, write to us and we will delete it.
Changes
If we change what we collect or who we share it with, we will change this page and move the date at the top. Material changes affecting subscribers will be sent by email.