Spelling Stream Privacy Policy

Last Updated: July 2, 2026

1. Who We Are

Spelling Stream is published by Monthly Balance Capital LLC, an Arizona limited liability company. This Privacy Policy applies to both the Spelling Stream mobile application and the spellingstream.com website (collectively, the "Service").

Email: support@monthlybalance.com
Phone: (602) 456-7189
Mailing Address: 4539 N 22nd St, Ste N, Phoenix, AZ 85016, USA

2. Children's Privacy (COPPA Compliance)

Spelling Stream is designed for use by children under the age of 13, always under the supervision of a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA), including the amended rules effective April 22, 2026.

2a. What We Do Not Collect From Children

• We do not collect personal information from children.
• We do not use behavioral advertising or serve ads of any kind.
• We do not sell, rent, or share any user data with third parties for marketing purposes.
• We do not collect biometric data from children. Custom voice recordings (made by parents) are stored exclusively on-device and are never transmitted.

2b. Parental Consent

All optional data features require verifiable parental consent before activation. During the app's initial setup wizard, a parent or legal guardian must:

• Pass a math-based parental verification gate
• Review this Privacy Policy and our Terms of Use
• Explicitly tap to consent before proceeding

All parent-only settings are further protected by a PIN or math-based parental gate that children cannot bypass.

2c. Parental Rights

As a parent or legal guardian, you have the right to:

• Review all data stored by the app. All data is visible within the app itself (spelling lists, scores, profiles, recordings).
• Refuse further collection. You may revoke consent for optional features (Cloud Sync, microphone, camera) at any time through your device's Settings or the app's Parent Center. To stop analytics collection and clear its anonymous identifier, use Settings > Delete All Data.
• Request deletion. You may delete all app data at any time using Settings > Delete All Data. For Cloud Sync users, this also deletes all data from our servers. You may also contact us at support@monthlybalance.com to request deletion.

2d. Age Signals (Age Assurance)

To comply with U.S. state app-store accountability laws (such as Texas SB 2420), which apply to both the Apple App Store and Google Play, when the app starts in a covered region it asks the device operating system for an age category (for example, "under 13," "13–15," "16–17," or "adult") and whether a parent or legal guardian has verified the user's age. On iOS and iPadOS this uses Apple's Declared Age Range framework; on Android it uses the Google Play Age Signals API. These are built-in operating-system features, not separate advertising or tracking services.

We use this signal for a single purpose: to determine whether the user is a child without verified parental or legal-guardian consent. If so, the app does not collect analytics or enable Cloud Sync for that session, and no personal information is collected or transmitted.

Retention — none. The age information is evaluated on the device, in memory, and immediately discarded. It is not stored, not sent to our servers, not attached to any profile, and not used for advertising or profiling. It is re-checked each time the app starts. The age category is provided by Apple Inc. (Declared Age Range) on iOS and Google LLC (Google Play Age Signals) on Android.

3. Data That Stays on Your Device

The following data is stored on your device. Unless you enable Cloud Sync (Section 4), it is never transmitted to us or any third party:

• Spelling lists and words
• Custom voice recordings of words (recorded by parents; these are never synced or uploaded, even with Cloud Sync enabled)
• Test scores, stars, and progress
• Child profile nicknames
• Sticker and theme selections
• Photos taken for OCR word scanning (processed on-device by the platform's built-in text recognition — Apple Vision on iOS, Google ML Kit on Android, running locally on the device; photos are never uploaded or stored beyond the scanning session)
• Parent PIN and biometric preferences

4. Cloud Sync (Pro Feature, Optional)

If a parent explicitly enables Cloud Sync, the following data is synced via Google Firebase/Firestore (operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043):

• Spelling lists and words
• Child profile nicknames and progress
• Stars, stickers, themes, and reward data
• The parent's email address from their Apple ID or Google account (used solely for authentication)

Not synced: Voice recordings, photos, PIN settings, and biometric preferences are never synced and always remain on-device only.

Cloud Sync requires:

• An active Pro subscription
• The parent to sign in with their Apple ID (on iOS) or Google account (on Android) — not a child's account
• Explicit consent during setup

Synced data is stored in Google Cloud data centers located in the United States and is encrypted in transit (TLS) and at rest. Parents can delete all cloud data at any time from Settings > Delete All Data.

4a. Overseas Disclosure

Monthly Balance Capital LLC is a United States company, and our cloud infrastructure and service providers are located in the United States.

If you use Spelling Stream outside the United States and enable Cloud Sync, your personal information leaves your country and is stored in the United States. The information transferred is the parent's Apple ID or Google account email address (used solely for authentication) and the synced spelling lists, profile nicknames, and progress described above. If you enable analytics or a crash occurs, anonymous usage identifiers and technical crash data are also sent to the United States. More broadly, the third-party services listed in Section 9 are operated by United States companies, and any data they receive — as described in that section — is processed in the United States.

The United States is not currently the subject of an adequacy or comparability assessment under the Australian Privacy Act 1988 or the New Zealand Privacy Act 2020, and its privacy laws differ from those of Australia and New Zealand. We disclose your information overseas to our own and Google's United States infrastructure so that Cloud Sync, analytics, and crash reporting can function. We remain accountable for this information: it is encrypted in transit (TLS 1.2+) and at rest (AES-256), it is processed by Google LLC and our other providers under their data-processing terms, and we take reasonable steps to ensure it is handled consistently with this Privacy Policy, Australian Privacy Principle 8, and New Zealand Information Privacy Principle 12. By enabling Cloud Sync you authorise this transfer of your information to the United States; if you do not enable Cloud Sync, your personal information does not leave your device on this basis.

5. Analytics

5.0 Website Analytics

The spellingstream.com website uses Google Analytics (GA4) (operated by Google LLC) to understand visitor traffic and behavior on the marketing site. Google Analytics is used on the website only — it is not present in the mobile app. The website is directed at parents, not children. Standard Google Analytics cookies and identifiers may be set when you visit the site. This data is used solely for understanding how visitors find and use our website.

Do Not Track & Global Privacy Control. Some browsers can send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. Because there is no common industry standard for how to interpret these signals, our website does not currently respond to them differently. We do not sell or share your personal information for cross-context behavioral advertising regardless of whether such a signal is present.

5.1 App Analytics

Within the mobile app, we use Google Firebase Analytics (operated by Google LLC) solely to understand aggregate app usage (e.g., which features are popular, crash-free session rates).

5a. Consent Required

Analytics serves only internal operations — measuring app stability (crash-free sessions) and aggregate feature usage. It is disabled by default and enabled only after a parent acknowledges it during the initial setup wizard; if it is not enabled, no analytics data is collected. This anonymous, internal-operations use is covered under the COPPA rule's internal-operations exception (see Section 5c).

5b. What Analytics Collects

When enabled, Firebase Analytics may collect:

• Anonymous usage events (e.g., "game started", "test completed")
• Device type and OS version
• A Firebase instance ID (a random, anonymous persistent identifier assigned to the app installation)

Firebase Analytics does not collect:

• Names, email addresses, or any personally identifiable information
• Spelling words, test answers, or any user-generated content
• Location data

5c. Persistent Identifiers

The Firebase instance ID is a persistent identifier used solely for internal operations: aggregating anonymous usage statistics and measuring app stability. It is not used for advertising, user profiling, or any purpose beyond internal analytics. This use is covered by the parental consent obtained during setup, in accordance with the COPPA rule's internal operations exception.

We have configured Firebase Analytics with the following restrictions:

• ad_storage: denied
• ad_user_data: denied
• ad_personalization: denied

6. Crash Reporting

We use Google Firebase Crashlytics (operated by Google LLC) to detect, diagnose, and fix app crashes. Crash reports contain only technical diagnostic information (device model, OS version, and the crash stack trace) and do not contain any personal information, user content, spelling data, or voice recordings.

Unlike analytics (Section 5), Crashlytics runs for all users, including children, so that the app stays stable and works correctly. It is used solely for internal operations — maintaining and analyzing the functioning of the app and diagnosing stability problems — and the diagnostic data is never used for advertising, profiling, or to contact or identify any individual. This limited, internal-operations use of diagnostic data is permitted under the COPPA rule's support-for-internal-operations exception, and the technical crash data Crashlytics collects is not the kind of personal information that would otherwise require separate verifiable parental consent. Crash data is retained for 90 days (see Section 10c).

7. Subscriptions & Payments

Subscriptions are processed entirely by Apple Inc. through the App Store (on iOS) or Google LLC through Google Play (on Android). We do not collect or have access to payment information, credit card numbers, or billing addresses. Subscription management (cancellation, plan changes) is handled through your Apple ID or Google Play account settings.

Free trial (yearly Pro): The yearly Pro plan includes a 7-day free trial for first-time subscribers (one trial per Apple ID or Google account). If you do not cancel before the trial ends, your Apple ID or Google Play account is automatically charged for the yearly subscription and renews annually thereafter. You can cancel at any time during the trial through your Apple ID or Google Play account settings to avoid being charged. The monthly Pro plan does not include a trial.

8. Microphone, Camera & Speech

• Microphone: Used by a parent in two ways: to record custom pronunciations of spelling words, and to add words by speech-to-text dictation (see the next item). Custom voice recordings are stored on-device only and are never uploaded, synced, or transmitted. They constitute biometric data under the updated COPPA rule and are collected only with explicit parental consent. Audio captured for speech-to-text dictation is handled differently: when transcription runs online, that audio is sent to Apple or Google solely to perform the transcription, as described in the next item.
• Speech Recognition (speech-to-text): Used only if a parent chooses to add spelling words by speaking them aloud instead of typing. The spoken audio is transcribed into text using the platform's speech recognition service — Apple Speech on iOS, Google speech recognition on Android. Depending on the device and network connectivity, this transcription may run entirely on-device, or the audio may be sent to and processed by Apple or Google. When transcription happens on-device, no audio leaves the device. When it happens online, the audio is sent to Apple or Google solely to perform the transcription. In either case, we use the audio solely to convert the spoken word into the text of a spelling word; it is never sent to our servers, never stored by us, and is not used for any other purpose. This feature is operated by a parent, requires explicit parental consent, and is separate from the on-device custom voice recordings described above.
• Text-to-Speech (reading words aloud): The app speaks spelling words aloud using the device's built-in text-to-speech engine. On iOS, Apple's voices are downloaded voice packs and synthesis happens entirely on-device — spelling words are never transmitted. On Android, some higher-quality Google Text-to-Speech voices (the engine's "network" voices) synthesize audio in Google's cloud: while such a voice is selected, the text of each spelling word is sent to Google LLC solely to generate the spoken audio. The word text is never sent to our servers, is never stored by us, and is not used for any other purpose. A parent or legal guardian can select an "offline" voice in the Parent Center's voice settings, in which case nothing is transmitted.
• Camera: Used only if a parent chooses to photograph a printed spelling list for OCR scanning. Photos are processed on-device by the platform's text recognition framework (Apple Vision on iOS, Google ML Kit on Android) and are never uploaded or stored beyond the scanning session.

All of these features require explicit parental consent and the operating system's permission prompts (iOS or Android).

9. Third-Party Services

We use the following specifically named third-party services:

Other than the speech-to-text transcription described in Section 8 — where, when performed online, a parent's spoken audio is sent to Apple or Google solely to be converted into spelling-word text — and the Android "network" text-to-speech voices described in Section 8 — where the text of a spelling word is sent to Google solely to be spoken aloud — no third-party service receives children's personal information, spelling data, custom voice recordings, or photos.

10. Data Retention & Deletion

10a. On-Device Data

All on-device data (spelling lists, recordings, scores, profiles) persists until:

• The parent taps "Delete All Data" in Settings (immediate deletion), or
• The app is uninstalled from the device

On-device data (spelling lists, scores, profiles, and recordings) persists indefinitely. There is no automatic time-based expiration or deletion. Parents or guardians have complete control and may delete all data at any time using the in-app "Delete All Data" feature, or by uninstalling the app from the device.

10b. Cloud Sync Data

For users who enable Cloud Sync, synced data is retained on Google Cloud servers for as long as the user's account exists. Data is deleted:

• Immediately when a parent taps "Delete All Data" or "Delete Account" in Settings
• Within 30 days of subscription expiration if the account is not renewed (grace period for resubscription)

After deletion, data is purged from Google Cloud Firestore and cannot be recovered.

10c. Analytics & Crash Data

Firebase Analytics data is retained for 14 months from the date of collection, after which it is automatically deleted by Google. Crashlytics data is retained for 90 days.

10d. Requesting Deletion

Parents may delete all data at any time using the in-app "Delete All Data" feature, or by contacting us at support@monthlybalance.com. We will process deletion requests within 7 business days.

11. Data Security

We take reasonable measures to protect user data:

• On-device data is protected by the device's built-in encryption and passcode
• Cloud Sync data is encrypted in transit (TLS 1.2+) and at rest (AES-256) on Google Cloud
• Authentication uses Apple Sign-In (on iOS) or Google Sign-In (on Android) with industry-standard token-based security

No security system is perfect, and we cannot guarantee that unauthorized access or disclosure will never occur. If we determine that a security breach has affected your personal information, we will notify affected users and applicable authorities as required by law, typically by email to the address associated with your account and, where appropriate, by an in-app notice.

12. Your Rights (U.S. Residents)

As a U.S. resident, you have the right to:

• Know what information we collect and how it is used (this policy, and the app's Parent Center).
• Access and review all data stored by the app — it is visible within the app itself.
• Delete your data at any time using Settings > Delete All Data, or by contacting support@monthlybalance.com.
• Withdraw consent for optional features (Cloud Sync, microphone, camera) at any time through the app's Parent Center or your device settings. To stop analytics, use Settings > Delete All Data.
• Non-discrimination: We will not deny, charge different prices for, or provide a different level of service because you exercise any of these rights.

We do not sell or share personal information. We do not sell personal information in exchange for money or any other valuable consideration, and we do not share personal information for cross-context behavioral advertising (as those terms are defined under the California Consumer Privacy Act / California Privacy Rights Act). We do not serve ads of any kind in the app.

California residents: Although our current operations do not meet the business thresholds that trigger the California Consumer Privacy Act / California Privacy Rights Act, we voluntarily honor the rights listed above for California residents. We do not use "Shine the Light" data-sharing practices. To exercise any right, contact support@monthlybalance.com.

Other U.S. states: Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) may have similar rights. We voluntarily honor the rights listed above for residents of those states. Contact us at the email above to exercise them.

Australia & New Zealand residents: If you are in Australia or New Zealand, you also have the right to:

• Access the personal information we hold about you.
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Most data is editable directly in the app's Parent Center; for the parent email or other account-level information, contact us using the details below and we will correct it or, if we decline, attach a statement of correction to the record.
• Withdraw consent to the overseas transfer described in Section 4a by disabling Cloud Sync (and analytics) at any time.
• Complain about how we handle your personal information, as described below.

Privacy Officer. Monthly Balance Capital LLC's Privacy Officer can be contacted at support@monthlybalance.com. We will acknowledge your complaint and respond within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au) in Australia, or the Office of the Privacy Commissioner (privacy.org.nz) in New Zealand.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be noted with an updated "Last Updated" date at the top. If we make material changes to how we collect or use children's data, we will obtain new parental consent before implementing those changes. Continued use of the app after non-material changes constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this privacy policy, your data, or your parental rights under COPPA, contact us at:

Monthly Balance Capital LLC
Email: support@monthlybalance.com
Phone: (602) 456-7189
Mailing Address: 4539 N 22nd St, Ste N, Phoenix, AZ 85016, USA