Spelling Stream Privacy Policy

Last Updated: October 6, 2026

1. Who We Are

Spelling Stream is published by Monthly Balance Capital LLC, an Arizona limited liability company. This Privacy Policy applies to both the Spelling Stream mobile application and the spellingstream.com website (collectively, the "Service").

Email: support@monthlybalance.com
Phone: (602) 456-7189
Mailing Address: 4539 N 22nd St, Ste N, Phoenix, AZ 85016, USA

2. Children's Privacy (COPPA Compliance)

Spelling Stream is designed for use by children under the age of 13, always under the supervision of a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA), including the amended rules effective April 22, 2026.

2a. What We Do and Do Not Collect From Children

• We do not collect personal information from children for advertising, profiling, or any purpose beyond running the app. Child information leaves the device only as described in Section 4 (Cloud Sync — a Pro feature a parent switches on), Section 5 (analytics), Section 6 (crash reporting) and Section 8 (on Android, the text of a spelling word sent to Google while a network text-to-speech voice is selected; with Enhanced Voice switched on, the text of the words in a spelling list sent to our servers to fetch pre-made audio; and dictation audio when transcription runs online), each with its legal basis stated there.
• We do not use behavioral advertising or serve ads of any kind.
• We do not sell, rent, or share any user data with third parties for marketing purposes.
• We do not collect biometric data from children. Custom voice recordings (made by parents) are stored exclusively on-device and are never transmitted.

2b. Parental Gates and Verifiable Parental Consent

These are two different things, and we describe them separately because they do different work.

The parental gate is access control, not consent. Parent-only settings are protected by a PIN, Face ID / Touch ID, or a math problem a young child cannot readily solve. Its job is to keep a child out of the Parent Center. It is not verifiable parental consent under COPPA, and we do not rely on it as such.

Analytics and crash reporting do not require verifiable parental consent. Each collects only a persistent identifier and technical data, used solely for support for the internal operations of the app — measuring stability and aggregate feature usage, and nothing else. That use falls within the exception at 16 CFR § 312.5(c)(7), which permits collection of a persistent identifier for internal operations without verifiable parental consent. We go further than the rule requires: analytics is off by default, is enabled only after a parent or legal guardian acknowledges it during setup, and can be switched off at any time (Section 5a).

Cloud Sync does require verifiable parental consent, and this is how we obtain it. Cloud Sync is the one feature that sends a child's spelling lists, profile nickname and progress to our servers (Section 4). Before it can be switched on, every one of the following must happen:

• A Pro subscription, including a free trial, must be started through the App Store or Google Play, or a Pro license bought through our online store. Each is a transaction on the parent or legal guardian's own payment account, and Apple, Google or our store sends a confirmation of it to that account holder — the method described at 16 CFR § 312.5(b)(2)(ii).
• The parent or legal guardian must sign in with their own adult Apple ID or Google account. A child's account cannot enable Cloud Sync.
• The parent or legal guardian must explicitly consent on the sign-in prompt, which says what Cloud Sync stores and that tapping Continue gives consent. A link to this Privacy Policy sits beside the sign-in buttons. Nothing is uploaded before that tap.

Once Cloud Sync is on, we email the signed-in address to confirm it, with instructions for switching it off and deleting what has been synced. In a covered region, Cloud Sync also stays off for a child's account without verified parental or legal-guardian consent (Section 2d).

Passing the math gate is not one of those steps. On its own it does not enable Cloud Sync and does not authorise any collection of a child's information.

Consent can be withdrawn at any time. Switching Cloud Sync off stops further collection, and Settings > Delete All Data removes what has already been synced (Sections 2c and 10).

2c. Parental Rights

As a parent or legal guardian, you have the right to:

• Review all data stored by the app. All data is visible within the app itself (spelling lists, scores, profiles, recordings).
• Refuse further collection. You may revoke consent for optional features (Cloud Sync, microphone, camera) at any time through your device's Settings or the app's Parent Center. Anonymous usage analytics can be turned off at any time with the Share anonymous usage toggle in the app, under Parent Center > Legal & Privacy > Privacy; turning it off stops all further analytics collection. To additionally clear the anonymous identifier already assigned to the installation, use Settings > Delete All Data. Crash reporting (Section 6) is separate from this toggle and continues to run so the app stays stable.
• Request deletion. You may delete all app data at any time using Settings > Delete All Data. For Cloud Sync users, this also deletes all data from our servers. You may also contact us at support@monthlybalance.com to request deletion.

2d. Age Signals (Age Assurance)

To comply with U.S. state app-store accountability laws (such as Texas SB 2420), which apply to both the Apple App Store and Google Play, when the app starts in a covered region it asks the device operating system for an age category (for example, "under 13," "13–15," "16–17," or "adult") and whether a parent or legal guardian has verified the user's age. On iOS and iPadOS this uses Apple's Declared Age Range framework; on Android it uses the Google Play Age Signals API. These are built-in operating-system features, not separate advertising or tracking services.

We use this signal for a single purpose: to determine whether the user is a child without verified parental or legal-guardian consent. If so, analytics and Cloud Sync stay off for that session. Crash reporting still runs as described in Section 6.

Retention — none. The age information is evaluated on the device, in memory, and immediately discarded. It is not stored, not sent to our servers, not attached to any profile, and not used for advertising or profiling. It is re-checked each time the app starts. The age category is provided by Apple Inc. (Declared Age Range) on iOS and Google LLC (Google Play Age Signals) on Android.

3. Data That Stays on Your Device

The following data is stored on your device. Cloud Sync (Section 4), which a parent or legal guardian switches on, is what sends items from this list to us.

Without Cloud Sync, one item on the list can still reach a third party: on Android, the text of a spelling word is sent to Google while one of the engine's network text-to-speech voices is selected (Section 8, which also covers dictation audio sent to Apple or Google when transcription runs online). With Cloud Sync and Enhanced Voice both switched on, the text of the words in a list is sent to our servers to fetch pre-made audio, as described in Section 8; nothing else on the list goes with it. Analytics (Section 5) and crash reporting (Section 6) send technical data of their own rather than anything on this list. Custom voice recordings, photos, and the parent PIN are never transmitted by us in any case.

• Spelling lists and words
• Custom voice recordings of words (recorded by parents; these are never synced or uploaded, even with Cloud Sync enabled)
• Test scores, stars, and progress
• Focus Words practice history — a per-word record of whether each spelling attempt was correct, kept only while a parent or legal guardian has Focus Words enabled (see Section 3a)
• Child profile nicknames
• Sticker and theme selections
• Photos taken for OCR word scanning (processed by the platform's built-in text recognition, running locally on the device; photos are never uploaded or stored beyond the scanning session)
• Parent PIN and biometric preferences
• App engagement counters — how many spelling tests have been finished, how often a parent or legal guardian opens the Parent Center, and when a word list was last heavily edited. These are used only on the device itself, to decide whether the app should ask a parent or legal guardian to rate it. They are never transmitted to us or anyone else, and are never used to profile, target, or advertise to a child.

3a. Focus Words — Using a Child's Own Results to Decide What They See Next (Pro, Off by Default)

What the feature does. Focus Words is an optional feature of Spelling Stream Pro that changes the order in which a child's spelling words are presented. While it is enabled, the app keeps a record of that child's spelling attempts — the word, and whether the attempt was correct — and uses that record for a single purpose: deciding which words that child is shown first in practice, in the spelling and written tests, and in the games. A word the child has missed is presented earlier than it otherwise would be, until they have spelled it correctly consistently.

Why we disclose this separately. The other progress data described in this Section records what happened. The Focus Words record additionally determines what the app does next for that specific child. That is a different purpose, so we state it plainly here rather than leaving it inside a general reference to "progress."

It is off by default, and a Pro subscription does not turn it on. Purchasing, holding, or restoring a Pro subscription does not enable Focus Words. A parent or legal guardian is asked once, in plain language, with an option to enable it and an option to decline. The setting can be changed either way at any time in Parent Center, which sits behind the parent lock; a child cannot enable or disable it. If it is declined or left off, word order is unaffected — list order or shuffled, as each screen is set — and no record of a child's results is used to reorder anything.

What this record is never used for. It is not used for advertising or marketing, and it is not used to profile a child for advertising or marketing purposes. It is not sold, rented, or shared with third parties. It is not used to rank or compare a child against any other child, and it does not produce any score, grade, or level reported outside the app. It does not change what counts as a correct answer.

Where it is stored. The record is stored on the device, alongside the other data listed in this Section. If a parent or legal guardian enables Cloud Sync (Section 4), it is synced as part of that child's progress data and is then covered by everything Section 4 states about synced data, including its storage location and the parent's ability to delete it.

Turning it off, and deleting the record. Switching Focus Words off in Parent Center stops the app from using the record to order words. To delete the underlying practice history itself, along with all other app data, use Settings > Delete All Data (Section 10); for Cloud Sync users this also deletes it from our servers.

4. Cloud Sync (Pro Feature, Optional)

If a parent explicitly enables Cloud Sync, the following data is synced via Google Firebase/Firestore (operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043):

• Spelling lists and words
• Child profile nicknames and progress, including the Focus Words practice history described in Section 3a where a parent or legal guardian has enabled that feature
• Stars, stickers, themes, and reward data
• The parent's email address, from their Apple ID or Google account (used for sign-in, to send the one-time email confirming Cloud Sync was switched on, and, only if a parent or legal guardian chooses “Reply by email” on the feedback form, to fill in the reply address, which they can change)

Not synced: Voice recordings, photos, PIN settings, and biometric preferences are never synced and always remain on-device only.

Cloud Sync requires:

• An active Pro subscription
• The parent to sign in with their Apple ID or Google account — not a child's account. A device that cannot sign in for itself, such as a child's tablet, can instead be connected using an activation code as described in Section 4b
• Explicit consent during setup

Synced data is stored in Google Cloud data centers located in the United States and is encrypted in transit (TLS) and at rest. Parents can delete all cloud data at any time from Settings > Delete All Data.

4a. Overseas Disclosure

Monthly Balance Capital LLC is a United States company, and our cloud infrastructure is located in the United States. Two service providers are not: Brevo (Sendinblue SAS) is located in France and processes our transactional email in the European Union, and Shopify (Shopify Inc.), which runs our online store, is located in Canada. Both are described in Section 9.

If you use Spelling Stream outside the United States and enable Cloud Sync, your personal information leaves your country and is stored in the United States. The information transferred is the parent's email address (from their Apple ID or Google account; used for sign-in, to confirm by email that Cloud Sync was switched on, and to fill in the feedback reply address only if a parent or legal guardian asks for a reply) and the synced spelling lists, profile nicknames, and progress described above. If you enable analytics or a crash occurs, anonymous usage identifiers and technical crash data are also sent to the United States. More broadly, the third-party services listed in Section 9 are operated by United States companies, and any data they receive — as described in that section — is processed in the United States. The exceptions are Brevo (Sendinblue SAS), a French company that handles our transactional email in the European Union, and Shopify Inc., a Canadian company that runs our online store for anyone who chooses to buy a Pro license that way. No children's data is ever sent to Brevo.

The United States is not currently the subject of an adequacy or comparability assessment under the Australian Privacy Act 1988 or the New Zealand Privacy Act 2020, and its privacy laws differ from those of Australia and New Zealand. We disclose your information overseas to our own and Google's United States infrastructure so that Cloud Sync, analytics, and crash reporting can function. We remain accountable for this information: it is encrypted in transit (TLS 1.2+) and at rest (AES-256), it is processed by Google LLC and our other providers under their data-processing terms, and we take reasonable steps to ensure it is handled consistently with this Privacy Policy, Australian Privacy Principle 8, and New Zealand Information Privacy Principle 12. By enabling Cloud Sync you authorise this transfer of your information to the United States; if you do not enable Cloud Sync, your personal information does not leave your device on this basis.

4b. Connecting Another Device (Activation Codes)

Some devices cannot sign in for themselves — a child's tablet most often cannot use an adult's Apple or Google account. A parent or legal guardian can instead generate a short numeric activation code on a device that is already signed in, and type it on the second device to connect it to the same account.

A code is generated from the Parent Center under “Activate Another Device”, where the parent or legal guardian chooses what the code is for: activating an Android or Apple device that does not yet hold the Pro subscription, or enabling Cloud Sync on a device that already holds Pro but cannot sign in. Activating a device that does not yet hold Pro enables Cloud Sync on it at the same time. The data described below is recorded in the same way whichever option is chosen.

Codes are generated and checked on our Firebase servers. In the course of that:

• A code is never stored in readable form. It expires quickly, connects a single device, and cannot be reused.
• When a code is used, we record that the connection happened: a random identifier for that connection, the time, the platform of the device that joined (“ios” or “android”), and its general type (“iPhone”, “iPad” or “Android”) so a parent or legal guardian can tell their own devices apart. If that device is later disconnected, the time of the disconnection is recorded too. No device name, serial number, advertising identifier, or other hardware identifier is recorded, and this record is never used to profile, target, or advertise to a child. We do not record when a device was last used. It exists so a parent or legal guardian can see, and remove, the devices connected to their account.
• To stop automated guessing of other families' codes, we apply rate limits based on request origin. No readable IP address is stored, and it is never linked to any account, child, or profile.

An activation code grants access to the family account that created it. It never carries a password, and no password exists to carry.

5. Analytics

5.0 Website Analytics

The spellingstream.com website uses Google Analytics (GA4) (operated by Google LLC) to understand visitor traffic and behavior on the marketing site. Google Analytics is used on the website only — it is not present in the mobile app. The website is directed at parents, not children. Standard Google Analytics cookies and identifiers may be set when you visit the site. This data is used solely for understanding how visitors find and use our website.

Web fonts. The website loads the Inter typeface from Google Fonts (fonts.googleapis.com and fonts.gstatic.com, operated by Google LLC). Because those files are fetched from Google's servers rather than ours, your browser's IP address and user-agent string are visible to Google when a page loads, as they are for any resource served from another domain. These requests set no cookie, and we receive no data back from them. This applies to the website only — the mobile app loads no fonts from the network.

Global Privacy Control & Do Not Track. If your browser sends a Global Privacy Control (GPC) signal, this website honors it: Google Analytics is not loaded and no analytics cookie or identifier is set for that visit. We treat a "Do Not Track" (DNT) header the same way. Separately, and whether or not such a signal is present, we do not sell personal information and do not share it for cross-context behavioral advertising.

The checkout site. Purchases made with scholarship or education savings account funds are completed on redeem.spellingstream.com. Google Analytics runs on the activation page and the paid invoice page there, on the same terms as above, including the Global Privacy Control and Do Not Track handling. It does not run on the unpaid invoice page, where a parent types a student's name: that page makes no network request of any kind, and nothing typed into it leaves the browser. On the pages that do carry analytics, the address reported to Google is replaced with a fixed label before it is sent, so activation tokens and invoice identifiers are never included.

5.1 App Analytics

Within the mobile app, we use Google Firebase Analytics (operated by Google LLC) solely to understand aggregate app usage (e.g., which features are popular, crash-free session rates).

5a. Consent Required

Analytics serves only internal operations — measuring app stability (crash-free sessions) and aggregate feature usage. It is disabled by default and enabled only after a parent acknowledges it during the initial setup wizard; if it is not enabled, no analytics data is collected. A parent or legal guardian may withdraw that acknowledgement at any time by switching the Share anonymous usage toggle off under Parent Center > Legal & Privacy > Privacy, after which no further analytics data is collected. This anonymous, internal-operations use is covered under the COPPA rule's internal-operations exception (see Section 5c).

5b. What Analytics Collects

When enabled, Firebase Analytics may collect:

• Anonymous usage events (e.g., "game started", "test completed", "upgrade screen closed", "cloud sync failed")
• Anonymous details about those events, as counts and ranges only — which game was played, roughly how long it lasted, how many words it covered, the average length of those words, how many were answered correctly, and how far through a game a child was if they stopped early
• Device type and OS version
• Broad, non-identifying characteristics of the app installation, expressed as ranges rather than exact values: subscription tier (Free or Pro), roughly how long ago the app was installed, roughly how many word lists and child profiles exist, which visual theme is selected, and whether the parent voice-recording feature has been used at all
• Anonymous funnel and reward events — for example which upgrade screen was shown and whether it was closed or completed, which sticker or theme a child redeemed with their stars, which step of first-time setup was reached, and whether a word list was created by typing, speaking, or scanning a photo
• Anonymous technical failure codes — for example that a spoken word failed to play, or that a cloud sync attempt failed, and a short category for why. Never the underlying error text, file path, or account identifier
• A Firebase instance ID (a random, anonymous persistent identifier assigned to the app installation)

Firebase Analytics does not collect:

• Names, email addresses, or any personally identifiable information
• Spelling words, list titles, profile names, prize descriptions, test answers, or any other user-generated content
• Voice recordings, or the name of any recording file
• Location data

5c. Persistent Identifiers

The Firebase instance ID is a persistent identifier used solely for internal operations: aggregating anonymous usage statistics and measuring app stability. It is not used for advertising, user profiling, or any purpose beyond internal analytics. This use falls within the COPPA rule's support-for-internal-operations exception at 16 CFR § 312.5(c)(7) and does not require verifiable parental consent (see Section 2b). We still ask a parent or legal guardian to acknowledge it during setup, and keep analytics off until they do, because that is the right default — not because the exception depends on it.

We have configured Firebase Analytics with the following restrictions:

• ad_storage: denied
• ad_user_data: denied
• ad_personalization: denied

6. Crash Reporting

We use Google Firebase Crashlytics (operated by Google LLC) to detect, diagnose, and fix app crashes. Crash reports contain only technical diagnostic information (device model, OS version, the crash stack trace, and short non-personal app-state labels used to diagnose stability problems — for example which audio path was in use when sound failed to start) and do not contain any personal information, user content, spelling data, or voice recordings.

Unlike analytics (Section 5), Crashlytics runs for all users, including children, so that the app stays stable and works correctly. It is used solely for internal operations — maintaining and analyzing the functioning of the app and diagnosing stability problems — and the diagnostic data is never used for advertising, profiling, or to contact or identify any individual. This limited, internal-operations use of diagnostic data is permitted under the COPPA rule's support-for-internal-operations exception, and the technical crash data Crashlytics collects is not the kind of personal information that would otherwise require separate verifiable parental consent. Crash data is retained for 90 days (see Section 10c).

7. Subscriptions & Payments

Subscriptions are processed entirely by Apple Inc. through the App Store (on iOS) or Google LLC through Google Play (on Android). We do not collect or have access to payment information, credit card numbers, or billing addresses. Subscription management (cancellation, plan changes) is handled through your Apple ID or Google Play account settings.

Free trial (yearly Pro): The yearly Pro plan includes a 7-day free trial for first-time subscribers (one trial per Apple ID or Google account). If you do not cancel before the trial ends, your Apple ID or Google Play account is automatically charged for the yearly subscription and renews annually thereafter. You can cancel at any time during the trial through your Apple ID or Google Play account settings to avoid being charged. The monthly Pro plan does not include a trial.

8. Microphone, Camera, Speech & Feedback

• Microphone: Used by a parent in two ways: to record custom pronunciations of spelling words, and to add words by speech-to-text dictation (see the next item). Custom voice recordings are stored on-device only and are never uploaded, synced, or transmitted. They constitute biometric data under the updated COPPA rule and are collected only with explicit parental consent. Audio captured for speech-to-text dictation is handled differently: when transcription runs online, that audio is sent to Apple or Google solely to perform the transcription, as described in the next item.
• Speech Recognition (speech-to-text): Used only if a parent chooses to add spelling words by speaking them aloud instead of typing. The spoken audio is transcribed into text using the platform's speech recognition service — Apple Speech on iOS, Google speech recognition on Android. Depending on the device and network connectivity, this transcription may run entirely on-device, or the audio may be sent to and processed by Apple or Google. When transcription happens on-device, no audio leaves the device. When it happens online, the audio is sent to Apple or Google solely to perform the transcription. In either case, we use the audio solely to convert the spoken word into the text of a spelling word; it is never sent to our servers, never stored by us, and is not used for any other purpose. This feature is operated by a parent, requires explicit parental consent, and is separate from the on-device custom voice recordings described above.
• Text-to-Speech (reading words aloud): The app speaks spelling words aloud using the device's built-in text-to-speech engine. On iOS, Apple's voices are downloaded voice packs and synthesis happens entirely on-device — spelling words are never transmitted. On Android, some higher-quality Google Text-to-Speech voices (the engine's "network" voices) synthesize audio in Google's cloud: while such a voice is selected, the text of each spelling word is sent to Google LLC solely to generate the spoken audio. The word text is never sent to our servers, is never stored by us, and is not used for any other purpose. A parent or legal guardian can select an "offline" voice in the Parent Center's voice settings, in which case nothing is transmitted. Enhanced Voice, described next, is the one spoken-word path that does send word text to our own servers.
• Enhanced Voice (Pro, off by default): A parent or legal guardian can switch on Enhanced Voice in the Parent Center's voice settings. It reads spelling words in a clearer, pre-made voice instead of the device's own, and it requires Cloud Sync. When a list is opened, the app sends the text of the words in that list, and the accent selected, to our servers (Google Cloud — see Section 9) so it can return the matching audio files, which the device downloads once and keeps; after that they play offline. Nothing about the child is sent — no profile name, no results, no recordings. A word not yet in our audio library is queued for review and is not linked to any account. The words are never used for any other purpose. Switching Enhanced Voice off stops further requests; audio already downloaded stays on the device until a parent or legal guardian uses Delete All Data or Delete Account, or uninstalls the app.
• Camera: Used only if a parent chooses to photograph a printed spelling list for OCR scanning. Photos are processed on-device by the platform's own text recognition framework and are never uploaded or stored beyond the scanning session.

All of these features require explicit parental consent and the operating system's permission prompts (iOS or Android).

8a. Sending Us Feedback

The Parent Center contains an optional feedback form, reachable only after passing the parental gate. It is used by a parent or legal guardian, never by a child, and nothing is sent unless they choose to send it.

By default we do not ask for, and the form does not send, a name or an email address, so we cannot reply. When a parent or legal guardian taps Send, we receive:

• The message they typed (up to 1,000 characters) and, if they picked one, the topic — problem, idea, or other
• The app version, the platform (iOS or Android), and the operating-system version, so we can reproduce what they describe
• The subscription tier (free, trial, or Pro) and the anonymous RevenueCat App User ID already described in Section 9, so that a report about billing or Pro features can be matched to the right subscription if a parent or legal guardian asks us to follow it up

A parent or legal guardian can ask for a reply. The form asks them to choose “No thanks” or “Reply by email.” Choosing “Reply by email” adds the email address they enter (filled in from their Cloud Sync sign-in if they have one, and editable) to that feedback message. We use it only to answer that message. It is never added to a mailing list or used for marketing.

The message is stored in Google Cloud Firestore and a copy is emailed to our support address through Brevo (Sendinblue SAS), a French email provider, which processes it in the European Union. From the feedback form, Brevo receives the feedback message, the technical details listed above, and, only when a reply was requested, the email address given, used as the reply-to address on that email. Nothing else. No spelling lists, child profile names, progress data, voice recordings, or photos are ever included.

Please do not type a child's name or other personal information into the feedback box. Whatever is typed is sent as written.

9. Third-Party Services

We use the following specifically named third-party services:

Other than the speech-to-text transcription described in Section 8 — where, when performed online, a parent's spoken audio is sent to Apple or Google solely to be converted into spelling-word text — the Android "network" text-to-speech voices described in Section 8 — where the text of a spelling word is sent to Google solely to be spoken aloud — Enhanced Voice described in Section 8 — where, if a parent or legal guardian has switched it on, the text of the words in a list is sent to our own servers solely to fetch pre-made audio — the optional feedback form described in Section 8a — where a message a parent or legal guardian chooses to write is delivered to us by email — and the online store described in this section — where the student's legal name, typed at checkout by a parent or legal guardian, is sent to Shopify so it can be printed on the invoice their scholarship program requires — no third-party service receives children's personal information, spelling data, custom voice recordings, or photos.

10. Data Retention & Deletion

10a. On-Device Data

All on-device data (spelling lists, recordings, scores, profiles) persists until:

• The parent taps "Delete All Data" in Settings (immediate deletion), or
• The app is uninstalled from the device

On-device data (spelling lists, scores, profiles, and recordings) stays on the device for as long as the parent or legal guardian keeps it there. We never receive it, so we cannot expire it on a schedule; it is deleted when they delete it. Parents or guardians have complete control and may delete all data at any time using the in-app "Delete All Data" feature, or by uninstalling the app from the device.

10b. Cloud Sync Data

For users who enable Cloud Sync, synced data is retained on Google Cloud servers for as long as the user's account exists. Data is deleted:

• Immediately when a parent taps "Delete All Data" or "Delete Account" in Settings
• Within 30 days of subscription expiration if the account is not renewed (grace period for resubscription)

After deletion, data is purged from Google Cloud Firestore and cannot be recovered.

Three smaller records described in Section 4b are kept alongside it, and two from Enhanced Voice (Section 8):

• Activation codes. A code stops working shortly after it is created, or as soon as it is used, whichever comes first. It is never stored in readable form.
• Connected-device records. A random identifier, the time the device was connected, the platform, the device's general type, and, if it has been disconnected, the time that happened. These are kept for as long as the account exists and are deleted with it when a parent or legal guardian uses “Delete Account”. A record of a disconnected device is kept so the same device cannot silently reconnect itself.
• Rate-limit counters. Used only to stop automated guessing. No readable IP address is stored, and the counter is not linked to an account, a child, a profile, or any other record.
• Enhanced Voice request counter. A running count of audio requests held against the parent's or legal guardian's Firebase user ID, used only to limit how often the audio service can be called. It resets on a short cycle and holds no words.
• Consent records. The record of each Privacy Policy, Terms of Use and Cloud Sync consent (Sections 2b and 9) is kept after Cloud Sync data is deleted, including after Delete Account, because it is our proof that consent was given. It holds policy versions, a timestamp, the app version, the platform and the Firebase user ID, and no email address, name or child data.
• Enhanced Voice review record. A word not yet in our audio library, queued for review with no link to any account.

10c. Analytics & Crash Data

Firebase Analytics data is retained for 14 months from the date of collection, after which it is automatically deleted by Google. Crashlytics data is retained for 90 days.

10d. Requesting Deletion

Parents may delete all data at any time using the in-app "Delete All Data" feature, or by contacting us at support@monthlybalance.com. We will process deletion requests within 7 business days.

10e. Feedback Messages

Unless a reply was requested, feedback sent through the Parent Center (Section 8a) carries no name and no email address, so we have no way to contact the sender or to identify them from the message itself. It does carry the anonymous RevenueCat App User ID described in Sections 8a and 9, so that a report about billing or Pro features can be matched to the right subscription — and that identifier is also how we can find a message again. A parent or legal guardian who asks us to delete the feedback sent from their installation, and who can supply that App User ID, can have those messages deleted within 7 business days.

When a parent or legal guardian chose “Reply by email,” their email address is stored with that message and used only to answer it. They can ask us to delete the message and the address by replying to our email or writing to support@monthlybalance.com, and we will do so within 7 business days.

A reply email address is removed from the stored message automatically 90 days after the message was sent. The message itself, and the copy emailed to our support address, are kept while we work through what it reports and are not on a fixed deletion schedule; a parent or legal guardian can ask us to delete them, and any email conversation that followed, at any time, and we will do so within 7 business days. Please do not include anything in a feedback message that you would want removed later.

11. Data Security

We take reasonable measures to protect user data:

• On-device data is protected by the device's built-in encryption and passcode
• Cloud Sync data is encrypted in transit (TLS 1.2+) and at rest (AES-256) on Google Cloud
• Authentication uses Apple Sign-In or Google Sign-In. In both cases the app receives a token and never sees a password. Spelling Stream has no password of its own to collect, store, or lose.

No security system is perfect, and we cannot guarantee that unauthorized access or disclosure will never occur. If we determine that a security breach has affected your personal information, we will notify affected users and applicable authorities as required by law, typically by email to the address associated with your account and, where appropriate, by an in-app notice.

12. Your Rights (U.S. Residents)

As a U.S. resident, you have the right to:

• Know what information we collect and how it is used (this policy, and the app's Parent Center).
• Access and review all data stored by the app — it is visible within the app itself.
• Delete your data at any time using Settings > Delete All Data, or by contacting support@monthlybalance.com.
• Withdraw consent for optional features (Cloud Sync, microphone, camera) at any time through the app's Parent Center or your device settings. To stop analytics, switch off Share anonymous usage under Parent Center > Legal & Privacy > Privacy; to additionally clear the anonymous identifier already assigned to the installation, use Settings > Delete All Data.
• Non-discrimination: We will not deny, charge different prices for, or provide a different level of service because you exercise any of these rights.

We do not sell or share personal information. We do not sell personal information in exchange for money or any other valuable consideration, and we do not share personal information for cross-context behavioral advertising (as those terms are defined under the California Consumer Privacy Act / California Privacy Rights Act). We do not serve ads of any kind in the app.

California residents: Although our current operations do not meet the business thresholds that trigger the California Consumer Privacy Act / California Privacy Rights Act, we voluntarily honor the rights listed above for California residents. We do not use "Shine the Light" data-sharing practices. To exercise any right, contact support@monthlybalance.com.

Other U.S. states: Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) may have similar rights. We voluntarily honor the rights listed above for residents of those states. Contact us at the email above to exercise them.

Australia & New Zealand residents: If you are in Australia or New Zealand, you also have the right to:

• Access the personal information we hold about you.
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Most data is editable directly in the app's Parent Center; for the parent email or other account-level information, contact us using the details below and we will correct it or, if we decline, attach a statement of correction to the record.
• Withdraw consent to the overseas transfer described in Section 4a by disabling Cloud Sync (and analytics) at any time.
• Complain about how we handle your personal information, as described below.

Privacy Officer. Monthly Balance Capital LLC's Privacy Officer can be contacted at support@monthlybalance.com. We will acknowledge your complaint and respond within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au) in Australia, or the Office of the Privacy Commissioner (privacy.org.nz) in New Zealand.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be noted with an updated "Last Updated" date at the top. If we make material changes to how we collect or use children's data, we will obtain new parental consent before implementing those changes. Continued use of the app after non-material changes constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this privacy policy, your data, or your parental rights under COPPA, contact us at:

Monthly Balance Capital LLC
Email: support@monthlybalance.com
Phone: (602) 456-7189
Mailing Address: 4539 N 22nd St, Ste N, Phoenix, AZ 85016, USA