Privacy Policy

Last updated 2026-09-23.

The short version

SpellingTestMaker can be used without an account — every test, print and practice session works with nothing typed in but the words themselves. An account is only needed to keep a list beyond its 30-day draft, publish one for other people to use, or sync your results and progress between devices, and creating one means giving us an email address.

A test you take, a sheet you print or a practice session you run stays on that device unless you choose to save a list under an account or sign in — nothing is sent to us just for using the spelling test maker. Once you create an account, the lists, results and word-by-word progress tied to it are also kept on our server so you do not lose them if you lose the device.

The site is paid for by advertising, and advertising involves cookies. That is the main thing this policy exists to explain, and you can opt out — see “Advertising” below.

Who is responsible

This site is operated by SpellingTestMaker (“we”, “us”). For anything in this policy, including any request about your data, write to contact@spellingtestmaker.com.

Under the GDPR we are the “controller” of the limited personal data described here.

What we collect

We collect the following, and nothing else:

• Request logs. Like every web server, ours records the IP address, the page requested, the time, the referring page and the browser’s user-agent string. This is how we keep the site up and spot abuse. These logs are kept briefly and then discarded.
• Advertising data. Our advertising partners set cookies and read device identifiers in order to select and measure ads. This is described in detail under “Advertising”.
• Account data. If you create an account we hold the email address you registered with and a password — the password is checked by our authentication provider (Supabase Auth) on our behalf, and we never see or store it ourselves — plus, if you set them, a display name and whether you are signing in as a teacher, a student, or both.

We do not ask for your name, email address or any account credentials unless you choose to create an account — see “Accounts” below for exactly what that involves and how to have it deleted.

What you type into the spelling test maker

Taking a test, printing a sheet or running a practice session by itself needs no account and sends nothing to us: the words, the marking and that browser’s spaced-repetition schedule are held in its own local storage and never leave the device. You can confirm this for any of those actions by opening your browser’s network inspector — no request goes out while you take a test, mark it or print it.

That stops being true the moment you save a list under an account, publish a list, or sign in on a second device to sync: at that point the list’s title and words, your results and your per-word progress are sent to our server so they can be kept for you and, if you publish, shown to other people. What is sent and who can see it is described in “Accounts” and “Published lists” below.

Cookies

A cookie is a small file a site asks your browser to keep. We use them in these ways:

• Strictly necessary — remembering a preference you set, such as a theme or a unit default. These are set by us, contain no identifier that is useful to anyone else, and cannot be switched off without breaking the feature they support.
• Advertising — set by our advertising partners to select ads, cap how often you see the same one, and detect fraud. These are the cookies that consent actually matters for.
• Sign-in — one cookie (`stm_session`) that keeps you signed in for up to 30 days. It is set by us, read only by our own server, marked HttpOnly and Secure so page scripts and other sites cannot read it, and is never used for advertising or shared with anyone. It exists only once you have created an account; “Sign out”, or clearing it, ends the session.

Your browser can block or delete cookies at any time through its own settings. Blocking the strictly necessary ones will make preferences stop sticking; blocking the rest has no effect on whether the site works.

Advertising

This site shows ads supplied by Google and, through Google, by other advertising vendors. We are paid per impression and click; that revenue is what makes the site free to use.

What you should know about how this works:

• Google, as a third-party vendor, uses cookies to serve ads on this site.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• You may opt out of personalised advertising by visiting Google’s Ads Settings at adssettings.google.com.
• You may opt out of personalised advertising by many other vendors at once at aboutads.info/choices (US), youronlinechoices.eu (EU/UK), or networkadvertising.org/choices.
• Opting out stops ads being personalised. It does not stop ads appearing, and it does not reduce how many you see.

If you are in the European Economic Area, the United Kingdom or Switzerland, a consent banner appears before any advertising or analytics cookie is set, and your choice is passed to our advertising partners. You can reopen that banner and change your mind at any time using the “Cookie settings” link in the footer.

We also honour the Global Privacy Control (GPC) signal. If your browser sends one, we treat it as an instruction to opt out of the sale or sharing of your personal information as those terms are defined by US state privacy law.

Why we are allowed to process this (GDPR)

For visitors in the European Economic Area and the United Kingdom, our legal bases are:

• Legitimate interests — keeping the site available, secure and free of abuse, which is what the request logs are for. You may object to this; see “Your rights”.
• Consent — for advertising and analytics cookies, collected through the banner described above and withdrawable at any time.

Your rights

Wherever you live, you may write to us and ask what we hold about you, ask us to correct or delete it, or object to how we use it. We will answer.

If you are in the EEA or UK, the GDPR gives you the rights of access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent at any time and to complain to your national data protection authority.

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon or another US state with a comprehensive privacy law, you have rights to know, delete, correct and obtain a copy of your personal information, and to opt out of targeted advertising and of the “sale” or “sharing” of personal information. We do not sell personal information for money. Serving personalised advertising may nonetheless count as “sharing” under California law, which is why the opt-out and GPC handling above exist. We will not discriminate against you for exercising any of these rights.

To exercise any right, email contact@spellingtestmaker.com. If you have an account, tell us the address it is registered under and we can locate everything tied to it — your profile, your lists, your attempts and your word-progress cards. If you do not have an account, we hold very little that can be linked to you, and we will tell you so plainly rather than ask you to prove who you are.

How long we keep things

Request logs are retained only as long as they are useful for security and debugging, on the order of days to a few weeks, and are then deleted or aggregated beyond recognition. Cookies expire on the schedule set by whoever placed them; advertising cookie lifetimes are set by the advertising vendor, not by us.

Where your data goes

The site is served from a global content delivery network, so a request is answered by whichever location is nearest to you. Our advertising partners are global companies. This means your data may be processed in countries other than your own, including the United States. Where EU or UK data is transferred, our providers rely on the European Commission’s standard contractual clauses or an equivalent approved mechanism.

If you have an account, the account itself and the lists, results and progress tied to it are stored in a Postgres database run by our infrastructure provider (Supabase, on servers in the EU) and are not shared with our advertising partners or with any other site.

Children

This site is a general-purpose utility. It is not directed to children, we do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA/UK), and we have no way to identify a visitor’s age. If you believe a child has provided us with personal information, write to contact@spellingtestmaker.com and we will delete what we can find.

Security

The site is served over HTTPS. We keep the amount of data we hold small, which is the most effective security measure available to a site like this one: data that was never collected cannot leak. No system is perfectly secure, and we do not claim otherwise.

Changes to this policy

If this policy changes materially we will update the date below and, where the change affects how we use your data, say so on the site. Continued use after a change means the updated policy applies.

Contact

Questions, requests and complaints: contact@spellingtestmaker.com. We read this mailbox.

Accounts

An account is optional. It exists for three things only: keeping a list beyond its 30-day local draft, publishing a list so other people can take it, and syncing your lists, results and word-by-word progress between devices. Everything else on the site works without one.

To register we ask for an email address and a password. Authentication itself — checking the password, issuing and verifying sign-in links — is handled by our authentication provider (Supabase Auth, also called GoTrue) on our behalf; we never see or store your password ourselves. If you set a display name or a role (teacher, student, or both), that is stored against your profile.

Signing in sets one cookie on this site, described under “Cookies” above. We do not receive or store anything from any other site you may be signed into.

Published lists

Publishing a list requires a confirmed email address. A published list’s title, its words and example sentences, and the display name you choose to show as its author (or nothing, if you leave that blank) are shown on a page of their own at a public URL, and that page can be found by search engines and read by anyone who has the link — publishing is public by design; that is the point of the feature.

The public page also shows how many people have taken the list and the average score, calculated from everyone’s attempts. It does not show who took it or what any individual person answered.

You can unpublish a list at any time from your account, which takes its page down for new visitors, or delete it outright. If your account is later deleted, a list you published stays up under no named author rather than disappearing — the words are not removed just because the account behind them is — but you can unpublish or delete it yourself first, or ask us to under “Deleting your data” below.

Deleting your data

You can delete or unpublish any list you own yourself, from your account page, at any time — this is immediate and does not require writing to us.

To delete the account itself and everything tied to it — your profile, your lists, your attempts and your word-progress cards — email contact@spellingtestmaker.com from the address the account is registered under. We do not currently offer a self-service “delete my account” button; this is a manual step we carry out on request.

Signing out removes the session cookie from that browser but does not delete the account or anything stored against it — it only ends that browser’s session.