FERPA, COPPA & CIPA Compliance
Last updated: July 1, 2026
This page is written for the district technology and privacy teams who review Chou Chou Teach — including teams evaluating whether to unblock it. Our design goal is to give you the least to review: because the app collects almost no student information, most of the questions a privacy review asks simply don't apply. A downloadable PDF of this document is available for your files.
Download the compliance PDFStudent accounts
None — students never log in
Student data collected
First name + avatar only
Advertising / data sales
None, ever
Data privacy agreements
Signed on request (SDPC / NDPA)
Who we are & our role
Chou Chou Teach is a classroom points and behavior app for K-12 teachers. Teachers award positive points for behaviors they define; the app displays running tallies. When Chou Chou Teach processes student information, it does so as a school official / service provider acting under the direction of the teacher and their school, for the sole purpose of providing the service. The school remains the owner of, and the decision-maker for, any student records entered.
FERPA (Family Educational Rights and Privacy Act)
FERPA governs personally identifiable information from education records. Chou Chou Teach is designed to stay well inside its requirements:
- Data minimization. A student record is a first name (or nickname) and an avatar. We do not collect last names, photos, birthdates, addresses, contact information, government identifiers, or grades.
- School official exception. We act under the school's direction and use student information only to provide the service — the "school official" basis under 34 CFR § 99.31(a)(1).
- No secondary use. Student information is never sold, never used for advertising, and never used to build profiles.
- School control & deletion. Teachers can delete a class, its students, and its points at any time in the app. Districts can request deletion of associated data by email.
- Written agreements. We will sign your district's Data Privacy Agreement to memorialize these terms (see below).
COPPA (Children's Online Privacy Protection Act)
COPPA governs the online collection of personal information from children under 13. Chou Chou Teach is built so that this collection effectively doesn't happen the way COPPA is concerned about:
- Children don't use the app. Students have no accounts and never sign in, type, or interact with Chou Chou Teach. Only the teacher operates it.
- No direct collection from children. The limited student information present is entered by the teacher, not gathered from the child.
- School consent. Where a small amount of student information is processed, the school provides consent on parents' behalf for educational use, consistent with the FTC's COPPA guidance for schools.
- No ads or tracking of children. There is no behavioral advertising and no third-party ad tracking anywhere in the product.
CIPA (Children's Internet Protection Act)
CIPA requirements — internet filtering and an internet safety policy — apply to the school or district, not to individual applications. Chou Chou Teach makes CIPA compliance easy because it contains nothing a filter would need to block:
- No advertisements or sponsored content.
- No open chat, messaging, or direct communication between users.
- No public or user-generated content feeds students could browse.
- No links out to unfiltered or external third-party content.
- Nothing marketed or sold to students.
In short, Chou Chou Teach does not expose students to the categories of material CIPA is designed to filter.
Exactly what we collect
This is the complete inventory of what Chou Chou Teach stores. The student-facing footprint is intentionally tiny.
| Data | About | Why |
|---|---|---|
| First name or nickname | Student | Label the point card the teacher taps during class. |
| Avatar (one of a fixed set of cartoon characters) | Student | Let students recognize their own card at a glance. |
| Points / behavior tallies | Student | The core function — tracking positive behavior a teacher awards. |
| Name, email, profile image | Teacher | Create the teacher's account and sign them in (Google or email/password). |
| Class names, behavior lists, tool preferences | Teacher | Store the teacher's own classroom setup. |
| Subscription status & Stripe customer ID | Teacher | Manage billing. Card numbers are handled by Stripe and never reach us. |
| Server logs (IP, browser/device type) | Teacher (visitor) | Keep the service secure and reliable. Standard hosting logs. |
We do not collect student last names, photos, birthdates, addresses, phone numbers, emails, government identifiers, grades, or location data.
Subprocessors
We share data only with the vetted providers that run the service. None of them are permitted to use it for their own purposes.
| Provider | Role | Data |
|---|---|---|
| Cloudflare | Hosting, application runtime, and database (Cloudflare D1). | All application data at rest; server logs. |
| Optional teacher sign-in (OAuth). | Teacher name, email, profile image (only if the teacher uses Google sign-in). | |
| Stripe | Subscription payment processing. | Teacher billing details. No student data. We never receive full card numbers. |
Security
- Data is encrypted in transit (HTTPS/TLS) across the service.
- Authentication tokens (email verification, password reset) are stored only as hashes; passwords are stored as salted PBKDF2 hashes, never in plain text.
- Access to teacher and class data is scoped to the authenticated teacher who owns or co-teaches the class.
- Hosting and database run on Cloudflare's infrastructure, which maintains SOC 2 and ISO 27001 certifications.
Data retention & deletion
We retain data only while an account is active. Teachers can delete a class — and all of its students and points — at any time from within the app. To delete a teacher account and its associated data, or to request district-wide deletion, email support@chouchouteach.com.
Data privacy agreements & district sign-in
We're glad to complete your district's paperwork, including standard SDPC (Student Data Privacy Consortium) and National Data Privacy Agreement (NDPA) forms. We can also allowlist sign-in to your Google Workspace domain so only approved staff accounts can access the app. Email support@chouchouteach.com to start either.
Contact for reviewers
Privacy, security, or DPA questions go to support@chouchouteach.com. We aim to respond to district reviews within two business days.