Compliance & Security
CherryChat is built for schools and clinical providers serving nonverbal individuals. CherryChat's compliance program documents our controls for FERPA, COPPA and data protection. CherryChat is designed to support schools' FERPA and COPPA obligations. Schools remain responsible for their own compliance. We will sign a school's standard data privacy agreement on request.
Last updated: August 2026
1. Overview
CherryChat ("we", "us", or "our") is an augmentative and alternative communication (AAC) platform designed for use in educational settings. We take the privacy of students and educators seriously. This policy describes what data we collect, how we use it, and the choices available to you.
2. Data We Collect
- •Student profiles: name, avatar, accessibility settings, and communication preferences.
- •Communication data: messages, symbol selections, and sentence constructions created during sessions.
- •Session data: attendance, participation timestamps, and modeling event logs.
- •Staff accounts: name, email, and role within a classroom.
- •Boards & symbols: custom boards, uploaded images, and personalized symbol sets.
3. How We Use Data
We use the data above to provide the AAC communication experience, enable real-time classroom sessions, generate progress reports for educators, and maintain audit trails for compliance. We do not sell student data to third parties.
4. Students under 13
When a school sets up CherryChat for its students, the teacher records that the school consents on parents' behalf for school use. A guardian gives consent separately for home access and for family and friends chat. Guardians can change or withdraw their consent at any time from their Dashboard. A student without recorded consent can't log in.
5. FERPA Compliance
Student education records maintained by CherryChat are treated as FERPA-protected data. Staff access to student data is audit-logged. Schools can configure data retention periods per classroom; messages and session logs older than the retention period are eligible for automatic deletion.
6. Data Retention
Each classroom has a message retention period, set to 365 days by default. Messages and session logs older than that period are automatically deleted. This is separate from deleting an account, which removes all of a student's records. Ending a plan does not delete a classroom right away. See When a plan ends.
7. Data Security
CherryChat's security controls are documented and tested internally. This is not a third-party certification. Data is encrypted in transit and at rest by our hosting provider. Student login requires a class code and PIN; staff login uses authenticated sessions. Access to student data is restricted to authorized staff within the same classroom, enforced server-side with Row-Level Security (RLS). Student sessions use HMAC-signed tokens with 12-hour TTL and mid-session revocation capability. We record views and exports of student data, edits to student data, consent changes, student deletions, message views, session launches, board pushes, data retention purges, clinical data access, and security events. Rate limiting prevents brute-force attacks.
8. AI & LLM Data Handling
| Feature | What is sent |
|---|---|
| SOAP note drafts (credential-verified SLPs only) | Session message labels and goals, with student and guardian names removed |
| Practice coaching | Goals, history and message labels, with names removed |
| Progress summaries | Message logs, with names removed |
| AI board builder | A board structure request, including grid size, category names and board vocabulary |
| PDF or PNG board upload | Only the uploaded board file |
| Literacy Library reading buddy | The student's own message and the book title |
| Book symbol suggestions | Board symbol labels, to match a book's words |
| Lesson and book content tools | No student records |
Student and guardian names are removed before student records are sent to AI.
CherryChat uses AI providers (OpenAI, Anthropic and Google) for the features listed above. Student and guardian names are removed before student records are sent. We are confirming with our platform provider that these providers do not keep prompts or use them to train models. We will update this page when that is confirmed.
9. Audit Logging
All sensitive actions are recorded in an audit log, including: student data views, exports, edits, consent changes, deletions, message views, session launches, board pushes, clinical data access, and security events. Logs include the actor's identity, role, the affected student, timestamp, and a description. When a student is deleted, audit entries are anonymized (name replaced with "[deleted student]") to preserve the trail without retaining PII.
10. Your Rights
Schools and guardians can ask to see, correct or delete student information. Send a message from the Help page and choose the topic Privacy request, or contact your school. We respond within 30 days. Deletion covers all of the student's records, including SOAP notes. Clinicians can export their notes first. Keeping clinical records for as long as their state or license requires is the clinician's responsibility.
11. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be reflected in the "Last updated" date. Continued use of CherryChat after changes constitutes acceptance of the updated policy.