Privacy Policy

Last updated: 19 August 2026

This Privacy Policy explains what data Spell-IT collects, how it is used, and your rights as a user. Please read it carefully before using the app.

1. Who We Are

Spell-IT is a spelling assistant for macOS and Windows, developed by Toby Pernot. If you have any questions about this policy, contact us at: contact@spell-it.net

2. What Data We Collect

Data you provide directly

• Name — your first and last name, required at sign-up.
• Email address — required at sign-up to identify your account.
• Platform — whether you signed up on Mac or Windows, recorded once with your account.

Data sent to our servers while you use the app

• Spelling corrections you accept — the misspelled word, the correction you accepted, and the name of the application you were writing in (for example "Microsoft Word"). We use this to build your personal word list and to understand where corrections are most useful.
• Practice session data — your score, the difficulty level, how long the session took, and how many retries you needed.
• Words you have mastered — when a word is marked as mastered through practice, the correctly spelled word is included so your progress can be tracked.
• App usage events — when you launch the app, start or finish a practice session, or accept a correction. Each event is linked to your email address.

Data that stays on your device

• The text you are writing. Spell-IT reads text from the field you are typing in only to find misspellings, in memory, as you work. Beyond the individual corrected words described above, it is not stored or transmitted.
• Raw keystrokes. Processed locally to detect word boundaries, then discarded.
• Your full spelling and practice history. A local copy is kept on your device so the app works and shows your progress without needing to fetch it.
• A local diagnostic log. The app keeps a technical log on your device to help diagnose problems. It can contain misspelled words and the names of on-screen elements. It stays on your machine unless you choose to send it to us when reporting a bug, and it is overwritten each time the app starts.

What we never collect

• Passwords. Spell-IT detects secure and password fields and does not read text typed into them.
• The content of your documents, messages, or emails, beyond the individual corrected words described above.
• Browsing history, files, photos, or contacts.
• A record of every application you open. The application name is recorded only at the moment you accept a correction, not as you move between apps.

3. How Spell-IT Reads Your Text

Because Spell-IT checks spelling as you write in other applications, it needs to observe text you type. We think you should know exactly how.

On Windows, it uses two mechanisms:

• UI Automation — the accessibility API built into Windows, the same one screen readers use. This is the primary method: it reads the text of the field you are currently typing in.
• A low-level keyboard hook — a fallback for applications that do not expose their text through UI Automation. This observes key presses to detect when you have finished typing a word.

The keyboard hook is the same class of API a keylogger would use, so to be completely clear about what it does and does not do: key presses are examined in memory to find word boundaries, checked against the dictionary, and then discarded. They are never written to a file or transmitted anywhere. Both mechanisms are disabled entirely for password fields.

On macOS, the equivalent function uses the system Accessibility permission, which macOS requires you to grant explicitly and which you can revoke at any time in System Settings.

4. How We Use Your Data

We use your data solely to:

• Provide and improve the Spell-IT service.
• Show you your personal spelling history and practice progress within the app.
• Understand how users interact with the app (usage analytics) to improve the product.
• Contact you about significant updates to the service (infrequently, and only using the email you provided).

5. Legal Basis for Processing (UK/EU users)

If you are in the UK or EU, we process your data on these bases under the UK GDPR / GDPR Article 6:

• Performance of a contract — your name and email, which are needed to create and maintain your account.
• Legitimate interests — usage analytics and practice data, used to understand how the app is used and improve it. We have balanced this against your rights and limited what we collect accordingly.

You can object to processing based on legitimate interests at any time (see Section 9).

6. We Will Never Sell Your Data

We do not sell, rent, trade, or otherwise transfer your personal data to any third party for commercial purposes. Ever.

7. Data Storage and Security

Your data is stored using Supabase (supabase.com), a cloud infrastructure provider, on servers located in the United Kingdom. Data is encrypted in transit (HTTPS/TLS) and at rest.

Supabase acts as a data processor on our behalf, under their standard Data Processing Agreement, which we have accepted.

Because your data is held in the UK, it is covered by the UK GDPR. For users in the EU, the European Commission's adequacy decision for the United Kingdom permits their data to be transferred to and stored in the UK.

A local copy of your spelling history, practice progress, settings, and personal dictionary is also stored on your device at:

• macOS: ~/Library/Application Support/SpellIT/
• Windows: %APPDATA%\SpellIT\

This local data never leaves your device except as described in Section 2.

8. Data Retention

• Account data (name, email): retained for as long as your account is active. Deleted within 30 days of a deletion request.
• Practice and progress data: retained to provide you with your history. You may request deletion at any time.
• Usage events: retained for up to 24 months for product analytics, then deleted.
• Local data on your device: removed when you uninstall the app or delete the folders listed in Section 7.

9. Your Rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your data ("right to be forgotten").
• Portability — request your data in a machine-readable format.
• Objection — object to processing of your data.

To exercise any of these rights, email us at contact@spell-it.net. We will respond within 30 days.

If you are based in the UK or EU, you also have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK at ico.org.uk).

10. Children's Privacy

Spell-IT is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this document and, where appropriate, by notifying you via email.

12. Contact

For any questions, requests, or concerns about this privacy policy or your data:

Email: contact@spell-it.net

This policy is written in plain English intentionally. If you have questions about anything in it, just ask.