Data Retention and Deletion

Effective date: 2 November 2026

This notice explains how Marcy's Lab Pte. Ltd. handles retention and deletion for Spelling Stars. Read it with our Privacy Policy and Terms of Use.

Contact product.spelling-stars@marcys-lab.sg for deletion help or questions about your family's information.

1. Ending your family account

The intended account-closure process gives you seven days to change your mind before permanent deletion begins. Closing the family account covers you and every linked child.

Deletion starts in one of two ways. You ask for it, through the "Delete my account" request described in section 2. Or the account has gone dormant: if a family without a current subscription has not signed in for six months, we may close it. Before we do, we email the parent or guardian, and the seven-day cancellation window in section 3 still applies from that notice. Closing a browser, or simply not signing in for a shorter time, never counts as a deletion request.

2. Requesting deletion

Once this feature is available:

Open the parent or guardian's Account page and choose Delete my account.
Review the data that will be deleted and the exact cancellation deadline.
Complete a fresh sign-in check, no more than five minutes before confirmation.
Confirm with the separate Delete my account button.

Only the parent or guardian managing that family can initiate this self-service flow. Contact support if you cannot access the account; we will verify the requester's authority before acting.

After a confirmation by the parent / guardian, we will set up a deletion workflow to remove the account and its related metadata after the full seven-day period.

We send a notice to the verified recovery email with the scheduled deletion date and cancellation instructions. An email-delivery failure does not cancel an accepted deletion request.

3. Cancelling the deletion within seven days

Before the deadline, sign in, complete a fresh authentication check and select Keep my account. Signing in alone does not cancel deletion, and an email link alone cannot cancel it.

A successful cancellation ends the pending deletion; nothing was withdrawn in the meantime.

Once permanent deletion has begun after the full seven-day period, it cannot be reversed through account recovery. If processing is delayed by a technical failure, the request stays pending while deletion is retried, and the family keeps ordinary access.

4. What permanent deletion removes

The intended finalisation removes the following family information from active systems:

The parent or guardian profile, recovery email, linked sign-in records and credentials.
Every linked child profile, PIN material and personal settings.
Family sessions, remembered-device access and recovery/notification tokens.
Owned private/family lists and original public catalogue lists.
Assignments, words, learning metadata and list-specific audio references.
Quiz attempts, answers, scores, results and learning history.
Family-scoped pending jobs, request identifiers and related personal audit data.

This is intended to be complete family cleanup, not indefinite deactivation or merely removing an owner label from retained private lists.

Two records outlive the family by design: the deletion receipt described in section 6, and keyed hashes that let us recognise a returning family and refuse a repeat free trial: one of the parent or guardian's email address and, if the family ever connected a Google account, one of that Google account's identifier, so a family that comes back through Google under a different address is still recognised. They contain no readable email, no name and no family identifier, and they are kept for twelve months after deletion (section 5). If a parent or guardian changes the family's email address, the hash of the old address is kept for twelve months from the change and then removed the same way.

5. Retention schedule

We keep data only for as long as needed for its stated purpose or as required by applicable law. The following schedule separates account data from temporary processing and operational records.

Data	Retention or deletion rule
Active family profiles, saved lists and results	Retained to provide the service while the account is active; included in whole-family deletion. A family without a current subscription that has not signed in for six months may be closed after an email notice (section 1).
Practice timing and time away	For each session: when it started, how long it took, the time taken over each answer and how often each word was replayed, each Learn it run and how long it lasted, and how often and for how long the app was left or was not in front. Shown only to the child's parent or guardian, and kept for seven days, counting the day of the session in Singapore time; the daily sweep removes it after that. Scores and missed words follow the rule above.
Starred words and practice results	Starred words and practice results are kept until the dictation is deleted, or the child or the family is deleted.
Family pending deletion	Ordinary access for seven days, then removal.
Worksheet image submitted for text extraction	Processed in app memory during the request; not intentionally stored as an image by the reviewed upload route. Provider retention applies separately.
Saved extracted words and passages	Retained as list content and removed with the owned list/family.
Generated audio	One file per word, narrator and speed, shared by every list that uses that word. Deleting a family removes its lists' references; a file no list uses any more is removed by the weekly sweep after 30 days without use. A file still used by another family's list stays.
Expired/revoked family-device records	Current cleanup threshold: 30 days after expiry/revocation, processed by a weekly sweep; whole-family deletion is intended to remove family records at finalisation.
Provider-call diagnostic rows	Current default threshold: 7 days, processed by a weekly sweep. Family-linked personal data remains within the intended final deletion scope.
App email delivery records	Each service email we send (recipient address, subject, body and delivery status) is kept for 30 days, then removed by the weekly sweep. Whole-family deletion also removes every record addressed to that family's parent or guardian at finalisation.
Sign-up requests	The email address and a hashed one-time code, and a keyed hash of the address to limit sign-up emails, kept up to 2 days.
General application/hosting logs	Kept by our hosting platform (Fly.io) under its default retention, which is short and set by the platform, not archived by us. Log lines carry request and account identifiers and list names, never a child's answers, and are used to diagnose faults reported to us; we aim to resolve a reported problem within three to five working days.
Beta applications, invitations, support and feedback	The beta application form no longer collects anything. An application already held has the parent or guardian's name, email address, a note about the children and how you heard of us. A waiting application is removed after 90 days; an approved one is removed the moment its invitation is issued. An invitation expires after 14 days; an expired or redeemed invitation keeps no readable code. Support and feedback emails stay in our mailbox until the matter is closed.
Feedback sent from our feedback page	The kind of feedback, the message, the email address given for a reply (if any), the page it came from, the screen size, browser and app version, and a keyed hash of the network address or its network block — never the address itself. The email address is used only to reply. Feedback may be processed by automated tools to sort it and draft replies. Deleted by the daily sweep 12 months after it was sent, or sooner on request: tell us the email address you gave, or the message if you gave none. A copy reaches our mailbox in a daily summary email, which follows the support and feedback email rule above.
Database and off-site backups	The database is backed up automatically once a day. Each backup is encrypted and held with an off-site storage provider. We keep it for no more than 30 days from creation, use it only to restore the service after a failure, and reapply every deletion completed since it was taken before the service is reachable again. A family deleted from the live service could persist in such a backup for at most that period. Generated audio is not backed up; it is made again when it is needed.
Keyed hashes of the parent or guardian's email address and of any Google account identifier the family connected	Kept for twelve months after family deletion, or, for an old email address, for twelve months after the family changes it, to recognise a returning family and prevent repeat free trials; they contain no readable email, name or family identifier, and are then removed by the weekly sweep. A Google account the family disconnected is still covered until then.
Deletion receipt	Kept for 90 days after family deletion, then removed. Holds only a random internal family identifier, the deletion time and a version stamp; it exists so that restoring a backup cannot bring a deleted family back (section 6).
Monthly usage counts	For each family and each month: how many new words its lists added, how much audio was made for them, how many worksheet photos were scanned, and how often a plan limit was reached. Used to apply the plan's limits and, as totals that never name a family, to check our running costs. Kept for 13 months, then removed by the daily sweep; included in whole-family deletion.
Sign-in days	The days on which each parent or guardian and each child signed in (no time of day, device or network address), and hourly totals of sign-ins that name no one. Used, only as totals that never name a family, to see how many families use the service, whether they return, and when demand peaks. Kept for 13 months, then removed by the daily sweep; included in whole-family deletion.
Plan and payment records	Your plan, any promotion code you used and your payment history, with Stripe's references (never a card number). Kept while the account is open; included in whole-family deletion, when the Stripe customer record and saved card are deleted too; of a promotion code only an unnamed count of its uses remains. A service code names your family and is deleted with it. Stripe keeps its own record of each payment as the law requires of it.
Daily visit totals for our public pages	Daily totals only — no IP address, user agent, session id or other personal data. Kept for 13 months.

The operational thresholds above are code defaults, not verified production guarantees. A weekly sweep means deletion is not performed exactly when a threshold is reached; downtime or failure can delay it. Set and verify publishable maximum periods before removing this draft notice.

6. Backups, copied lists and shared audio

Our intention is that nothing tied to a deleted family survives. Exactly four things do, each for a stated reason and period: the daily database backups, for up to 30 days (section 5), the deletion receipt, the keyed hashes of the parent or guardian's email and of any connected Google account's identifier (section 4), and generated audio that another family's list still uses. Nothing else is kept.

Backups. The database is backed up automatically once a day, encrypted, and held with an off-site storage provider. We keep each backup for no more than 30 days, use it only to restore the service after a failure, and reapply every deletion completed since it was taken before the service is reachable again. Generated audio is not backed up; it is made again when it is needed.

Minimal deletion receipt. When a family's deletion completes, we write a small record to private file storage, outside the database and so outside any database backup. It holds only a random internal family identifier, the time of deletion and a version number. It holds no email address, nickname, child detail or list content. Its purpose is to stop a restored backup from bringing a deleted family back. We keep it for 90 days, three times the longest life of a backup, then remove it.

Other families' catalogue copies. If another family copied a list from a deleted family, that copy stays with the family that made it. On deletion we remove the copy's link to the original list and the school and class names it carried from the original, so nothing on the copy points back to the deleted family. The words and other learning content of the copy remain. Removing those fields does not prove that free text in a list is free of personal details. Please do not put personal details in list text.

Shared generated audio. A spoken word is stored once and shared by every list that uses it with the same narrator and speed, so deleting one family cannot remove a file another family still uses. Unreferenced audio is removed by the weekly sweep after 30 days without use. A passage a parent or guardian typed is spoken audio of that parent or guardian's own text; do not put personal details in a passage.

7. Provider-held and device-held copies

Deleting active Spelling Stars data does not automatically erase provider abuse-monitoring logs or every copy outside our active database. We must apply the relevant provider deletion procedures and disclose any applicable retention. Stripe keeps its own records of payments made, under its legal obligations, after your account and its Stripe customer record are deleted.

Microsoft, which turns list text into speech, states that it does not retain or store the text sent to its real-time text-to-speech service or the audio it generates, so it holds no copy of either. OpenAI documents endpoint-specific retention, including standard abuse-monitoring retention of up to 30 days for relevant API calls, subject to exceptions and approved controls. Resend's published retention depends on the plan and configuration. These periods concern our service's use of those providers, not closure of your Spelling Stars account alone. See OpenAI's data controls and Resend's data-retention information. Which provider holds a copy, and for how long, depends on the provider we use at the time; this notice and section 4 of the Privacy Policy name the current ones.

Emails already delivered to recipients, user downloads and browser-held preferences are outside the app's direct deletion control. Clear site data and saved downloads on shared devices if needed.

8. Deleting only part of a family account

Deleting a single child or a single list happens immediately and has no seven-day cancellation window; only whole-family deletion has that.

Deleting a child removes the child's profile, PIN, settings, assignments, starred words and every quiz attempt, practice result and result at once. The family's lists stay, because a list may also serve another child.

Deleting a list removes its words, its assignments and every child's attempts, results, starred words and practice results on that list at once. Shared audio files stay for other lists that use them (section 6).