Privacy Policy

1. Who we are

Spell It Now (spellitnow.com) is operated by Mikasa Labs LLC, a California limited liability company ("Mikasa Labs LLC," "we," "us"). This policy explains what happens to information when you use the site. It covers spellitnow.com and nothing else; sites we link to have their own policies.

Mikasa Labs LLC is the controller of the information described below, except where section 8 says Google acts as an independent controller for its own purposes.

2. The short version

Spell It Now is a static website. There is no account, no login, and no server we run that stores your data. The text you type is converted in your browser and is not sent to us. Almost everything the site remembers about you is stored on your own device and never transmitted.

The parts that do involve someone else are analytics, which run only if you allow them, and Google AdSense, which is described in section 5.

3. What we collect

Text you type

The text itself is never transmitted. What you enter into the converter, decoder, practice drills, speed challenge, or games is processed entirely inside your browser.

If you allow analytics, we do send Google measurements of how you used the tool, and some of those are derived from your text: the number of characters you converted, decoded, or copied. We do not send the characters themselves, and we do not send the code words they produce.

The "Listen" feature uses your browser's built-in speech synthesis. No audio or text is sent to us. Depending on your operating system, your device may use a cloud voice provided by your browser or OS vendor; that is a relationship between you and that vendor, not with us.

If you use "Share," the link we build puts your text in the URL fragment (the part after #). Browsers do not transmit the fragment to a web server, so text shared this way does not reach our hosting records. It is still visible to anyone you send the link to, and it may be saved in your browser history.

Links shared before July 27, 2026 put the text in a query string instead, which is sent to the server. If you open one of those older links, the text appears in our hosting records for that one request; the site then rewrites the link to a fragment so it is not sent again.

Stored on your device

The site uses your browser's localStorage for the following. None of it is sent to us or to anyone else, except that your consent choice determines the consent signal we send to Google. Our code reads these values in your browser to make the site behave the way you asked; we never receive them:

• theme - light or dark appearance.
• spellitnow-alphabet - which spelling alphabet you selected.
• spellitnow-consent - your privacy choices and the policy version they were made against.
• spellitnow-analytics-consent - a consent value from an earlier version of the site. It is read once, migrated, and deleted.
• spellitnow-progress - practice statistics, per-letter accuracy, streaks and achievements.
• spellitnow-speed-records and spellitnow-speed-runs - speed challenge best times and run history.
• spellitnow-daily - daily puzzle results: whether you solved the day's puzzle and with how many clues, your current and best streaks, and totals of puzzles played and solved.

Separately, if you allow analytics, Google's SDK creates two IndexedDB stores on this domain, firebase-installations-database and firebase-heartbeat-database, holding an installation identifier and SDK usage counters.

Clearing your browser's site data removes all of it permanently. More about what is stored on your device is in our Cookie Policy.

Hosting records

The site is served by Firebase Hosting, a Google service. As with any web server, Google records standard request information on our behalf: IP address, user agent, timestamp, referring page, and the address of the page requested. We use this to deliver the site and to investigate abuse and errors.

Analytics, only if you allow it

If you allow analytics, the converter page loads Firebase Analytics (Google Analytics 4). It collects a Firebase installation identifier, an analytics identifier stored by Google, device and browser characteristics, an approximate location derived from your IP address, which features you used, and engagement measurements.

Analytics runs only on the converter at spellitnow.com. It is not loaded on the Games, Learn, About, Contact, or legal pages at all, whatever your consent choice is.

If you email us

We receive your email address, your message, and anything you choose to put in it. We use it to answer you.

4. What we do not collect

Stated plainly because these are the questions people actually have. As of the effective date above, Spell It Now has:

• No accounts, logins, passwords, or user profiles.
• No database or backend operated by Mikasa Labs LLC. The site is static files.
• No cookies written by our own code. Google's scripts can set cookies on this domain, and those are listed in our Cookie Policy.
• No contact form. The Contact page publishes an email address and nothing more.
• No newsletter, mailing list, or marketing email.
• No payments, and no financial information of any kind.
• No error tracking, session recording, heatmaps, or A/B testing tools.
• No chat widget, support widget, or CRM.
• No sale of personal information for money.

5. Advertising and Google AdSense

We want to be precise here, because this is the part of the site that involves a third party whether or not you interact with it.

No ads are currently displayed on Spell It Now. Ad slots are disabled in the site's code, and Google's automatic ad placement is switched off in our AdSense account.

Whether loading Google's AdSense tag amounts to "sharing" personal information for cross-context behavioral advertising under California law depends on what Google does with what it receives, which is Google's decision and not ours. We therefore treat advertising as opt-in, honor Global Privacy Control, and keep the opt-out control in section 11 available whether or not the law requires it.

The AdSense script is nevertheless present in the page. Every page of the site loads Google's AdSense library, because Google requires it to be present in order to review and verify a site for its advertising program. Our application is pending. This means your browser requests a file from a Google server, and Google therefore receives your IP address, your user agent, and the address of the page you are on. That happens on every page, before you interact with anything. We cannot avoid it while remaining in the review process, so we disclose it instead.

It runs in a consent-denied state unless you have said otherwise. Before the AdSense script loads, we send Google a Consent Mode signal. Unless you have already allowed advertising or analytics, that signal sets advertising storage, advertising personalization, ad user data, and analytics storage to "denied," and sets functionality and security storage to "granted." Google states that with advertising storage denied it will not set new cookies for advertising purposes, and will not use previously set google.com and doubleclick.net cookies except for spam and fraud purposes. We cannot independently verify what happens inside Google's tag.

If we are approved and turn ads on, we will update this policy and the effective date, and ads will be served according to your consent choice. Google's own description of how it uses data for advertising is at Google advertising technologies.

6. Legal bases (EEA and UK)

If the GDPR or UK GDPR applies to you, our lawful bases are:

• Consent (Article 6(1)(a)) for analytics and for any advertising cookies or identifiers. You can withdraw it at any time, as easily as you gave it, using the "Preferences" control in the footer of every page.
• Legitimate interests (Article 6(1)(f)) for hosting records, which we need in order to serve the site, keep it available, and investigate abuse. Our interest is operating a website; the data is limited to what any web server necessarily receives.
• Legitimate interests (Article 6(1)(f)) for answering an email you chose to send us.
• Legitimate interests (Article 6(1)(f)) for the request your browser makes to Google's server to fetch the AdSense script, described in section 5. That request discloses your IP address and user agent to Google and happens before you interact with anything, because a script cannot be fetched conditionally from the page's head. Our interest is remaining in Google's review process so the site can be funded without charging users. You can object to it, and a content blocker prevents it outright.

Storing and reading information on your device is separately governed by ePrivacy rules. We treat your theme, alphabet, progress, speed, daily-game and consent storage as strictly necessary or explicitly requested by you, and everything else as requiring consent.

7. Cookies and local storage

Our own code writes no cookies. The site stores the eight localStorage items listed in section 3 on your own device. Google's analytics script, which loads only with your consent, sets cookies on this domain (_ga and a related _ga_ cookie) to recognize a returning browser. Google's AdSense script may set cookies on Google's own domains.

More about what is stored on your device, including these, is in our Cookie Policy.

Global Privacy Control. We honor GPC. If your browser sends the GPC signal, we force analytics and advertising consent to "denied" on every page, disable the "Accept all" control so it cannot be overridden by accident, and tell you we have done so. We do not act on "Do Not Track," which has no agreed meaning.

8. Who receives information

Google is the only company that receives information through your use of this site. That includes email you choose to send us: our mailbox runs on Google Workspace. Depending on where you are, the receiving entity is Google LLC or Google Ireland Limited. Google receives information in four distinct capacities:

• Firebase Hosting - serving the site and keeping request logs. Google acts as our processor under the Google Cloud Data Processing Addendum.
• Firebase Analytics (Google Analytics 4) - with your consent, on the converter page only. Google acts as our processor for this, and for its own purposes as an independent controller. See Firebase Privacy and Security.
• Google AdSense - as described in section 5. For ad serving and measurement Google acts as an independent controller under its advertising controller terms, meaning it decides how it uses that data, not us.

• Google Workspace - the mailbox behind the address we publish for contact, privacy requests, and legal notices. Google acts as our processor for the mail you send there.

Google's overall privacy policy is at policies.google.com/privacy.

We may also disclose information if we are legally required to, to comply with lawful requests, or to protect the rights and safety of users or the public. If Mikasa Labs LLC or Spell It Now is acquired or merged, information may transfer as part of that transaction; we will update this policy to reflect it.

Fonts are self-hosted. The typefaces this site uses are served from our own domain. No font CDN is contacted, and no third party receives anything when a page loads its fonts.

9. International transfers

Mikasa Labs LLC operates from the United States. Google serves this site from a global content delivery network and processes the information described above in the United States and in other countries where it operates infrastructure.

For EEA and UK personal data we rely on the transfer terms in each of Google's applicable agreements: the Google Cloud Data Processing Addendum for hosting, the Firebase Data Processing and Security Terms for analytics, and the Google Ads Controller-Controller Data Protection Terms for advertising, which incorporate the European Commission's Standard Contractual Clauses. Google LLC is also certified under the EU-US Data Privacy Framework. Email us if you would like copies of these terms.

10. How long information is kept

• On your device: until you clear your browser's site data. We cannot delete it for you, and we cannot see it.
• Hosting records: retained by Google on our behalf for its standard Firebase Hosting logging period.
• Analytics: event-level data (which pages and features were used) is kept for 2 months. The identifiers Google uses to recognize a returning browser are kept for 14 months from your last visit, not 14 months from collection: the period restarts each time the same browser returns, so for a regular visitor it does not expire. It expires 14 months after you stop visiting. Aggregated reporting, which is not tied to you, is not subject to these limits.
• Email you send us: kept as long as needed to deal with your message and for a reasonable period afterwards for our records.

11. Your choices

• Use Preferences in the footer of any page to review, change, or withdraw your analytics and advertising choices at any time.
• Turn on Global Privacy Control in your browser to refuse optional storage automatically, everywhere, without interacting with our banner.
• Clear your browser's site data to erase every locally stored preference, progress record and speed result.
• Use your browser or an extension to block the Google scripts entirely. The converter, decoder, practice mode and speed challenge all work with them blocked.

12. Your rights

Because we operate no account system and hold no database of our own, there is usually very little we could look up about you. The exceptions are an email you have sent us, the hosting records described in section 3, and, if you allowed analytics, data held by Google that is not linked to your name. If you want us to look in the hosting records, tell us the approximate date and time of your visit.

To exercise any right below, email hello@spellitnow.com. Requests are handled by a person, not an automated system. We aim to respond within 30 days and will tell you if we need longer where the law allows it. To verify a request we will generally need to correspond with you at the email address the information is associated with; we will not ask you for more identifying information than the request requires. You may use an authorized agent where the law provides for one. We will not treat you differently for exercising any of these rights.

EEA and UK

• Access, rectification, erasure, restriction, and portability of your personal data.
• Objection to processing based on legitimate interests.
• Withdrawal of consent at any time, without affecting processing already carried out.
• Complaint to your national supervisory authority, or to the UK Information Commissioner's Office.

United States, including California

• The right to know what personal information is collected, and to access, delete, or correct it.
• The right to opt out of sale, sharing for cross-context behavioral advertising, and targeted advertising. Use the Preferences control in the footer, or send Global Privacy Control, which we honor on every page.
• The right to appeal a refused request, where your state provides one. Our refusal will tell you how.

We do not collect or use sensitive personal information for any purpose that requires a "Limit the Use of My Sensitive Personal Information" link.

Canada, Australia, New Zealand, and South Africa

• Access to and correction of your personal information.
• Withdrawal of consent.
• Complaint to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, or the South African Information Regulator, as applicable to you.

13. Children

Spell It Now is a general-audience reference tool and is not directed to children under 13. We do not knowingly collect personal information from children, and because the site has no account system and no submission feature, there is very little for a child to disclose. If you believe a child has sent us personal information by email, contact us and we will delete it.

14. Security

The site is served over HTTPS. Because Spell It Now stores nothing on a server we operate, the usual risks of a breached user database do not apply to it. Deployment to our hosting uses short-lived, keyless credentials; no long-lived deployment keys are stored. No method of transmission or storage is completely secure, and we do not claim otherwise.

15. Changes to this policy

If we change this policy we will update the effective date above. If a change is material - a new recipient of your data, a new category collected, or ads being switched on - we will also reset the privacy banner so you are asked to make your choice again rather than having an old choice carried over.

16. Contact

Mikasa Labs LLC, California, United States.

Privacy questions, requests, and complaints: hello@spellitnow.com.