Compliance & Security
CherryChat is built for schools and clinical providers serving nonverbal individuals. CherryChat's compliance program documents our controls for FERPA, COPPA and data protection. CherryChat is designed to support schools' FERPA and COPPA obligations. Schools remain responsible for their own compliance. We will sign a school's standard data privacy agreement on request.
Last updated: August 2026
1. Purpose
This Acceptable Use Policy ("AUP") defines the rules for using CherryChat. By using the Service, you agree to follow these rules. Violations may result in access revocation and account termination.
2. Authorized Access
You may access student data only if you have a legitimate educational or clinical interest in that student's records. Access is determined by your role (teacher, co-teacher, TA, specialist, admin, or guardian) and is enforced server-side. Attempting to access data outside your authorization is prohibited.
3. Prohibited Activities
- •Accessing student data from classrooms or students you are not assigned to.
- •Sharing login credentials, student PINs, or home codes with unauthorized individuals.
- •Taking screenshots or exporting student PII to personal devices or accounts.
- •Using student data for AI training, marketing, advertising, or any purpose outside the Service.
- •Attempting to bypass authorization controls (role injection, classroom ID injection, token forgery).
- •Exceeding rate limits or attempting brute-force attacks on any endpoint.
- •Creating student profiles without required parental consent (COPPA).
- •Uploading offensive, copyrighted, or inappropriate content to boards or symbols.
- •Reverse-engineering, scraping, or disrupting the Service.
- •Using the Service for emergency communication or crisis intervention (call 911 for emergencies).
4. Data Protection
Users with access to student PII must take reasonable steps to protect it: use strong passwords, do not share accounts, log out of shared devices, and report suspected breaches to their CherryChat admin within 24 hours.
5. AI-Assisted Features
CherryChat uses AI to draft SOAP notes, generate practice coaching messages, and assist with board building. AI outputs are suggestions only. Users must review and verify all AI-generated content before relying on it. Users are responsible for the accuracy of any content they finalize.
6. Enforcement
Violations are detected through audit logging and automated security monitoring. Confirmed violations result in immediate access revocation. Repeated or serious violations may result in permanent account termination and notification to the user's school or organization.
7. Reporting Violations
Report suspected violations or security incidents to your CherryChat admin.
8. Changes to This Policy
We may update this AUP from time to time. Material changes will be reflected in the "Last updated" date. Continued use of the Service after changes constitutes acceptance.