Privacy

This policy covers the BeeSpell website and web app at beespell.com.au.

Last updated 17 August 2026.

The short version

• At home, one adult email address signs in and children have no account of their own. At school, a student may sign in with an address their school gave them. BeeSpell never gives a child one, and there are no passwords for anyone.
• No advertising, no third party analytics, no tracking, nothing sold or shared for marketing.
• Nothing a child types is ever sent to a third party.
• You can take everything out as a file, and close the account, from inside the app.

What is stored

Your account. The email address you sign in with, a username, and when the account was made and last changed. There is no password, so there is none to leak.

Your characters. For each child you set up: a display name you choose, an emoji, a colour, and a scene. Nothing else. No surname is asked for, no birthday, no photograph, no contact details.

Practice. Which words were asked, what was typed in answer, whether it was right, and the schedule that decides when a word comes back. This is the app working; it is also a record of a child's spelling, so it is treated as theirs.

Signing in. A sign in request holds the address it was sent to and two one time codes, kept as hashes rather than as the codes themselves, for fifteen minutes. A session is a hashed token, the time it was made, the time it was last used, and when it expires. Sessions are shown to you in the app so you can close any of them.

Schools and classes. If a school uses BeeSpell: which classes exist, who teaches them, which families are in them, the word lists the school made, homework set, and how a class is going.

A record of significant actions. Signing in, inviting somebody, approving a word list, closing an account, and the like. Each entry holds what happened, when, and which account did it. It holds no message contents and no child data.

What is not stored

Passwords, payment details, contact details for children, location, device identifiers for advertising, and any third party analytics or tracking script. The pages load nothing from anywhere but this site, which the content policy the browser is given enforces.

Who else is involved

Google Cloud Text-to-Speech makes the spoken words. This happens once, ahead of time, when a word list is prepared: the word, its meaning, and its example sentence are sent to Google, which returns audio files that BeeSpell stores and serves itself. It does not happen while a child plays. Nothing a child types is ever sent to Google, and no child's name goes with the text.

Resend delivers the sign in and invitation emails, so it handles the address an email is sent to and the message itself.

Cloudflare carries traffic to the site, which means requests pass through it, including the address your device connects from.

Those three are the whole list. BeeSpell does not sell personal information, and does not disclose it for marketing.

Cookies

Two, both necessary. One holds your session so the app knows you are signed in. One is set briefly while a sign in is being approved and lasts fifteen minutes. Both are HttpOnly and same site, and neither is used to follow you anywhere. There are no advertising or analytics cookies.

Children

BeeSpell is meant for children of primary school age. At home it is used through an adult's account: a parent or a guardian, with each child a character the adult set up. At school, a student may sign in with the email address their school issued, because the school runs those addresses; BeeSpell itself never creates one for a child, never asks a child for contact details, and never uses a password. What exists either way is a chosen name and the spelling practice that followed. A school using BeeSpell is responsible for telling its families and, where it needs to, obtaining consent.

How long it is kept

Account, character, and practice records are kept while the account exists. Sign in requests expire after fifteen minutes and sessions after thirty days. When an account is closed, its characters and all of their practice are deleted immediately and permanently. The record of significant actions is kept without the closed account's identity attached to it.

Taking it out, and deleting it

Sign in, open Me, then My Details. Download My Data gives you one file holding everything the account has: its details, every character, every word they have practised, and every attempt. Close My Account deletes the account and all of it. There is no undo and no waiting period.

If a school holds a class your child is in, ask the school as well: the class, its word lists, and its reports belong to the school's account rather than yours.

Where it lives

BeeSpell stores its data in a single database and audio files on servers it controls. Speech generation sends text to Google, which processes it on its own infrastructure and may do so outside Australia.

Changes

If this policy changes, the new version and its date appear on this page. If a change is significant, the email address on the account is told.

Asking

Privacy questions, requests for a copy of data, and complaints go to hello@beespell.com.au. If you are not satisfied with the answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.