Privacy, Security & Student Data Handling

Last Updated: April 2026

Crosscut Innovations, LLC ("we," "our," or "us") operates the Spell Again web and mobile spelling practice Service (the "Service" or "App"). This document is both our legal privacy policy and our plain-language summary for parents, teachers, and school buyers. If you are evaluating Spell Again for a classroom, school, or district, §2 (Data we collect, by account type), §5 (Security controls), §6 (Subprocessors), and §7 (DPA and privacy review) are the most relevant sections.

1. Overview

Spell Again is an educational spelling practice Service for learners from Pre-K through 12th grade. We sell three ways: directly to families (free and Plus plans), directly to individual teachers (Classroom plan), and by lead-capture to schools and districts (pilot engagements). In all three cases the product is the same; what changes is how the account and consent relationship works.

2. Data we collect, by account type

We collect only what the Service needs to function. The exact fields depend on who creates the account and how they sign in.

Usage telemetry that supports the Service itself (which list a student is practicing, per-word correct/incorrect attempts, XP earned, device type and operating system for bug triage) is collected for all account types.

3. How we use the data

• Provide and maintain the Service (sign-in, saved lists, progress tracking)
• Generate word audio (pronunciation, definition, example sentence) via our TTS subprocessor
• Show a teacher their students' progress and classroom-level analytics
• Sync rostered classes when a school has connected an SSO provider
• Send transactional email (email verification, subscription receipts) via our email subprocessor
• Detect abuse and protect student login endpoints through rate limiting
• Debug issues and improve the Service

We do not sell student data, share it with advertisers, or build advertising profiles. The Service carries no third-party ad SDKs and shows no ads.

4. Authentication methods

Spell Again supports multiple sign-in methods so teachers can pick one appropriate for their grade level. In every case, the tokens that let a user sign in are generated and validated server-side; they are never stored unprotected in the student's browser or printed on anything that isn't intended for that specific student.

• Email + password — for teachers, parents, and adult learners. Firebase Auth handles password hashing and rate limiting. Password resets require email verification.
• Class sessions — teacher starts a session in the admin dashboard, students tap their name on a roster. The session code is short-lived; all join requests are IP-rate-limited with hashed IPs (no raw IP stored).
• QR login cards — printable per-student cards with server-issued tokens (24-hour in-class or 7-day take-home variants). Tokens are redeemed through a rate-limited Cloud Function.
• Login code + password — each student gets a simple code and a grade-appropriate password. Teachers can reset passwords from the admin dashboard.
• Magic links — teacher emails a one-click sign-in link to a parent. 30-day validity. Single-use on the server side once redeemed.
• SSO — Clever, Google Classroom, and ClassLink are implemented in code and available for pilot engagements. OAuth state is HMAC-signed and bound to a same-browser nonce cookie. Access and refresh tokens are stored encrypted at rest with AES-256-GCM; the key lives in Google Secret Manager.

5. Security controls

• Encryption in transit — all Service traffic is HTTPS. Firebase endpoints enforce TLS.
• Encryption at rest — user data lives in Google Firebase (Firestore + Cloud Storage), which encrypts data at rest by default. OAuth tokens for SSO connections are additionally envelope-encrypted with AES-256-GCM before they are written to Firestore. Each envelope carries a key fingerprint so the master key can be rotated with a grace window.
• Role-based access — Firestore security rules scope reads and writes by role. Teachers cannot read other teachers' classrooms. Students cannot read other students' progress.
• Server-issued auth tokens — QR tokens, magic links, and class-session codes are generated, stored, and validated in Cloud Functions. The ssoTokens collection is Cloud-Functions-only at the rules layer.
• IP rate limiting on student login endpoints — unauthenticated endpoints (join-session, redeem-QR, redeem-magic-link, SSO start/callback) are rate-limited per hashed IP. Raw IP addresses are never stored.
• Principle of least privilege — internal tooling uses scoped service accounts; production secrets are bound to the specific Cloud Functions that need them.
• No third-party advertising SDKs — the Service is free of ad trackers.
• Audit logging — Cloud Functions log correlation IDs on errors so we can investigate failures without exposing user data in public-facing error messages.

6. Subprocessors

We use the following providers to operate the Service. Each is a Service-specific, necessary component.

We notify existing paying customers by email if we add a material subprocessor. Schools and districts under a DPA receive 30 days' advance notice of any new subprocessor and a right to object.

7. DPA and privacy review

A Data Processing Addendum is available on request for schools and districts. It covers: the scope of processing, named subprocessors, security controls described in §5, breach notification, data export on termination, and deletion timelines. For procurement reviews we are also happy to walk through our privacy posture on a scoping call before a pilot begins.

To request a DPA or start a privacy review, contact support@spellagain.com.

8. Children's Privacy (COPPA) and FERPA positioning

Spell Again is designed for educational use by children under parental or teacher supervision. Our practices are COPPA-aligned and we support school use under FERPA.

Age Verification

Direct account creation requires users to confirm they are 13 years of age or older, or that they are a parent or teacher creating an account. We do not allow children under 13 to create accounts directly.

Student Accounts (School-Consent Exception)

Teachers may create student accounts using login codes, QR cards, class sessions, or magic links under the COPPA school-consent exception. In this capacity, the school or teacher acts as the parent's agent and provides consent for the collection of student information for educational purposes. Student accounts created by teachers collect only the data listed in §2 under "Student account (created by teacher)" — never email addresses, profile photos, or billing information.

Student data is never used for advertising or shared with third parties for commercial purposes. We treat student data we process on a school's behalf as a "school official" under FERPA's school-official exception: we only use it to provide the educational service the school directed.

Parental Rights

Parents and guardians have the right to:

• Review their child's personal information
• Request deletion of their child's data
• Refuse further collection of their child's information
• Request that their child's data not be shared with third parties

To exercise any of these rights, or if you believe your child has provided personal information without proper consent, please contact us at support@spellagain.com. We will respond to verified requests within 30 days and take steps to remove such information from our servers.

9. Your Rights — access, export, deletion

You have the right to:

• Access your personal data that Spell Again holds.
• Correct inaccurate data.
• Export your lists and progress. Teachers can export CSV and PDF reports per student or class directly from the admin dashboard. For a bulk account-level export, contact us.
• Delete your account and associated data. Families and individual teachers can trigger account deletion from the app's profile screen. Deletion removes the account from Firebase Auth and deletes the associated profile, progress records, spelling lists, sharing links, leaderboard entries, billing records, and stored profile photo. Security audit records are retained for up to seven years for safety and compliance. For a student account created by a teacher, the request comes from the teacher or a parent/guardian.
• Opt out of analytics where applicable.

For access, bulk export, or any rights question, email support@spellagain.com. We respond to verified requests within 30 days.

10. Data Retention

We retain your personal data only for as long as necessary to provide you with the Service and as described in this Privacy Policy. Account deletion removes identity, progress, lists, and audio references within 30 days; aggregated and anonymized usage logs may persist for troubleshooting. We will also retain and use your data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.

Waitlist signups. If you join a waitlist on our checkout page, we store only the email address and plan you submit, and use them solely to contact you when that plan becomes available — never for other marketing. We delete waitlist entries once the availability notice is sent, or within 12 months of signup, whichever comes first. To be removed sooner, email support@spellagain.com.

Pilot inquiries. If you submit the pilot request form on our School & District Pilots page, we store the details you provide — name, work email, role, organization, approximate student count, timeline, message, and any marketing attribution (UTM parameters or ad click IDs) — and use them solely to respond to your inquiry. These are adult business contacts only; the form collects no student data. We retain pilot inquiries for up to 24 months after our last contact with you, or delete them earlier on request to support@spellagain.com.

11. International data transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. Our Firebase project's primary region is us-central1.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For schools and districts under a DPA, we notify the contract contact directly of material changes. You are advised to review this Privacy Policy periodically.

13. Contact

If you have questions about this Privacy Policy, our security controls, or our data practices, please contact us at:

Crosscut Innovations, LLC
5435 North Garland Ave., Suite 140-145, Garland, TX 75040
Email: support@spellagain.com