Privacy Policy

1. Who we are

spelvi is developed and operated by Maxim Bekmetov, an independent developer (“we”, “us”). He is the controller of the personal data described here. You can reach him at hello@spelvi.com. This policy covers the spelvi apps for iOS and Android and the website spelvi.com.

2. What we collect

• If you don't sign in — nothing that names you. Your saved words, lessons and progress stay on your device. The app creates a random install identifier so our servers can apply the free plan's daily limits; it isn't derived from your hardware and isn't linked to your identity.
• Account (optional) — if you sign in with Apple or Google: your email address, your display name if the provider shares it, and the provider's account id, so your progress can sync across devices.
• Synced learning data — for signed-in users: saved words and word lists, lesson and grammar progress, streaks and goals, your library, book highlights and notes, and news articles you bookmark (their title, link, source, date and a short excerpt — never the article text).
• What you ask the app to work on — the words you look up, the sentence around a word you tap, text you ask the AI helpers about, and your voice when you use speaking features. See sections 4–6 for where that goes.
• Usage & diagnostics — app events (for example which screens are opened, or that an exercise was completed and its score), crash reports and performance measurements, collected with Google Firebase (Analytics, Crashlytics and Performance Monitoring). They carry a random per-install id plus a few settings (your study and translation languages, whether you have Pro, app version, theme), and the SDKs add device model, operating system and locale. This data is pseudonymous — it doesn't include your name or email, but it isn't anonymous either. Nothing is collected until you agree: the app asks once, after setup, and the SDKs stay off until you answer yes. You can change your answer at any time in Settings → About → Share usage & crash data; switching it off also deletes the analytics data still on your device and any crash reports not yet sent.
• Age range from the app store — where a law requires it (for example Texas), the app asks Apple's Declared Age Range or Google Play Age Signals for your age band (under 13, 13–15, 16–17 or 18+). The band stays on your device and is used only to apply age rules: under 13, accounts and diagnostics are unavailable. It is never sent to us, to analytics or to anyone else. Elsewhere the app store answers nothing and no age is requested.
• Purchases — Apple or Google process the payment; we receive the subscription status, and our subscription provider Adapty links it to your install and, if you're signed in, to your account id. We never see your card details.
• Security records — our servers see your IP address with every request. We don't keep general access logs. We do keep a short security log of sign-in events (signing in, refreshing a session, registering or renewing an install identifier, deleting an account) with the IP address and a one-way hash of the account or install id, and daily usage counters that may be keyed by IP address to stop abuse.
• Launch waitlist — if you join the waitlist on spelvi.com, we store your email address and when you signed up, and use it only to tell you when spelvi launches.
• Website — spelvi.com counts visits with GoatCounter, which uses no cookies and builds no profiles. Fonts are served from our own site. Your light/dark theme choice is kept in your browser's local storage and never sent to us.

We do not collect contacts, precise location, photos or advertising identifiers, and there are no ads or advertising trackers in spelvi.

3. Why we use it, and on what basis

• To provide spelvi — dictionary lookups, lessons, AI helpers, pronunciation scoring, sync and your account. Basis: performing our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and fair — free-plan limits, rate limits, fraud and abuse prevention. Basis: our legitimate interest in running a secure service (Art. 6(1)(f)).
• To fix bugs and improve spelvi — diagnostics and usage events. Basis: your consent (Art. 6(1)(a)), asked for in the app before anything is collected; you can withdraw it at any time with the switch in Settings.
• To apply age rules the law requires — the app store's age band, where a law makes us use it. Basis: legal obligation (Art. 6(1)(c)).
• To send the launch email — waitlist only. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by replying to the email or writing to us.
• To meet legal obligations — for example responding to lawful requests (Art. 6(1)(c)).

We don't build advertising profiles, we don't sell or rent personal data, and we don't make automated decisions about you that have legal or similarly significant effects.

4. Voice & pronunciation

The microphone is used in three places: dictating a search, pronunciation scoring, and spoken practice conversations. For scoring and conversations, your recording is uploaded to servers we run ourselves, turned into a score, feedback or a transcript, and not stored. The app deletes its copy from your device as soon as it has been sent. In a conversation, the transcript of what you said (not the audio) is then sent to an AI provider to write the reply — see section 5.

Dictating a search uses your device's built-in speech recognition, which may send the audio to Apple or Google to be transcribed. That processing is governed by their privacy policies, not ours.

5. AI features

Translations of example sentences, definitions and words the dictionary doesn't cover are made the same way: the text goes to our servers, which answer from our dictionaries or a cache when they can and otherwise from the language models below.

The AI helpers — explanations, a word's meaning in the sentence you found it in, stories from your saved words, grammar feedback, and practice conversations — send the relevant text through our servers to a language model. The model runs either on a server we operate ourselves or at one of these providers: Groq, Google (Gemini API) or Cloudflare (Workers AI). What is sent is the text itself — for example the sentence you tapped and the word in it, or the list of words for a story — never your name, email or account id.

We don't use your content to train models. Some providers' terms allow them to use API inputs to improve their own services (Google's free Gemini API tier does), which is one more reason we send only the text. To save time and cost, answers are cached keyed by the text they were produced for, not by who asked.

6. Services the app contacts directly

To fetch dictionary data and books, the app talks to some public services directly rather than through our servers. Each of them receives your IP address and the request itself, and handles it under its own privacy policy:

• Datamuse — an English search that found nothing, to suggest spellings;
• Wiktionary, Free Dictionary API and Tatoeba — the word being looked up;
• Google Books — the title of a book whose description is shown;
• book and audiobook catalogues — Open Library, Internet Archive, LibriVox, Project Gutenberg, Bloom Library, Global Digital Library, Standard Ebooks and Aozora Bunko — when you browse, open or download a book;
• ZenQuotes — to fetch the quote of the day.

News. Lists of headlines come through our own proxy, so publishers don't see your IP address while you browse them. When you open a news article, your device loads that article page directly from the publisher's website to show its text — the publisher then sees your IP address and the app's name, as with any page you open in a browser. The article text is shown only on your screen: it isn't saved and never reaches our servers. The app loads no tracking pixels or counters from publishers.

7. Processors & sharing

We share personal data only with service providers who help us run spelvi, only as much as each needs, and under agreements that restrict them to providing their service to us:

• Apple and Google — sign-in, app distribution and billing;
• Google Firebase — usage analytics, crash reports and performance monitoring;
• Adapty — subscription management;
• Cloudflare — content delivery and network protection; it also relays requests to AI providers;
• Groq, Google (Gemini API) and Cloudflare (Workers AI) — AI features, as described in section 5;
• Sentry — server error monitoring;
• our hosting provider in Estonia, which runs the server that holds accounts.

We may disclose information if the law requires it, and would pass it to a successor if spelvi were ever transferred — under this same policy.

When you share a word list. Sharing a list is the one case where you publish something yourself. The list — its title, its words and the example sentences attached to them — is copied to a public web page that anyone with the link can open. Your name and email are never attached to it, and it isn't linked to your account, so deleting your account doesn't remove it: email us the link and we'll take it down.

8. Where your data is stored

Accounts and synced data live on a server in the EU (Estonia). Backups of that database, and the processing of recordings, speech and part of the AI requests, run on servers we own and operate ourselves, some of them outside the EU; no third party has access to them. Several providers in section 7 — Google, Cloudflare, Groq, Adapty and Sentry — process data in the United States and other countries. Where personal data from the EU goes to a provider outside it, we rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework. Everything travels encrypted (HTTPS).

9. How long we keep it

• Account and synced data — until you delete your account; then removed at once.
• Database backups — up to 90 days, on a rolling basis.
• Security log — 30 days.
• Usage counters — 7 days.
• Recordings — not kept; discarded as soon as they are scored or transcribed.
• Diagnostics — Firebase keeps user- and event-level analytics for at most 14 months (aggregated reports without identifiers may be kept longer) and crash reports for 90 days.
• Waitlist emails — until you unsubscribe, and no longer than 12 months after launch.
• Shared word lists — until you ask us to remove them.

10. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or US state laws such as the CCPA), you have the right to:

• access your data and get a copy of it in a portable format — email us and we'll send your synced data as a file;
• correct it;
• delete it — in the app (Settings → Delete account) or, without the app, by email;
• restrict or object to processing;
• withdraw consent at any time, without affecting what happened before — for diagnostics, simply switch them off in Settings;
• complain to the data protection authority where you live or work.

To use any of these, write to hello@spelvi.com from the address linked to your account. We answer within one month, free of charge.

11. Children

spelvi is intended for people aged 13 and over, or older where the law of your country sets a higher age for consenting to online services on your own. We don't knowingly collect personal data from younger children: where the app store tells the app that a user is under 13, account sign-in and diagnostics are unavailable (see Age range from the app store). If you believe a child has given us personal data, contact us and we'll delete it.

12. Security

Data is encrypted in transit, access to our servers is limited to us, and the app never stores your sign-in credentials in plain text. No system is perfectly secure; if a breach ever put your data at risk, we would tell you and the authorities as the law requires.

13. Changes

If we change this policy, we'll update the date above; for significant changes we'll also tell you in the app or by email before they take effect.

14. Contact

Questions about privacy? Email hello@spelvi.com. Every message is read by a person.