Each practice sees only its own spellers
Access rules are enforced by the database itself, not just hidden on screen — a practitioner can only open records for spellers they work with.
Spellio Security & Privacy
Every speller's words deserve protection.
Spellio holds some of the most personal things a family can share — session videos, transcripts, goals and progress. Here's how Spellio keeps that information private and in the right hands.
Who can see what
Access is limited by design
Every record in Spellio belongs to a speller, and only the people working with that speller can open it.
Team members see only assigned spellers
In group practices, invited practitioners see only the spellers the practice head assigns to them. Joining a practice never opens its whole caseload.
Sharing needs a parent's signature
Another independent practitioner can join a speller's care team only after the parent signs a release in their portal. They can't change anyone else's work, and never see private notes, intakes or billing.
Private notes stay private
Practitioner-only notes are visible to the practitioner who wrote them — never to families or other practitioners.
Families see only their own child
Parent accounts open only their own speller's records, and parents can't edit or delete sessions a practitioner logged.
Records & documents
Files stay private and unchanged
Sensitive files are never published, and the records families rely on can't be rewritten after the fact.
Private file storage
Session videos, transcripts, signed agreements, progress reports, invoices and income reports are kept in private storage — never at a public link. Files open through temporary links that expire within an hour.
Signed documents can't change
When a parent signs, Spellio saves a locked copy with a digital fingerprint. Editing a template later never changes what a family already signed.
Issued invoices are locked
Once an invoice is issued, its number and amounts can't be quietly changed.
Payments & communication
Money and messages with consent
Families stay in control of how they're charged and contacted.
Card details go straight to Stripe
Cards are entered on Stripe's secure checkout pages. Spellio keeps only the card brand, last four digits and expiry date — never the full card number.
Consent before any charge
A family signs a card authorization before a card on file can be charged, and that signed authorization is kept with the card.
Reminders only with permission
Automated reminders go only to families who agreed to them during intake, and families can change that choice any time in their portal.
Services we rely on
Who helps run Spellio
Spellio uses a small number of trusted services to do its job. Here's what each one is used for.
- Lovable CloudHosts Spellio, its database, file storage and sign-in.
- StripeProcesses Spellio subscriptions and family payments to practitioners.
- Email deliverySends account emails, invoices and reminders from notify.spellio.co.
- Spellio AIWhen you write a lesson with AI, Spellio sends the lesson topic, settings and your writing rules — not speller records.
- Google Drive (optional)Only if a practitioner connects their own Google account; session logs are saved to the folders they choose.
Questions, or found a security issue?
Practices and families can reach us about security, privacy, or paperwork their practice needs. If you think you've found a vulnerability, please tell us privately first so we can fix it quickly.