Privacy

The short version

• You don't need an account for the library, builder, checker, data sheets, compliance tools, or the workspace.
• Builder drafts, the goal checker, PDF and spreadsheet generation, and the workspace all run in your browser.
• Local mode (default): workspace data is stored only on your device. We never receive it.
• Cloud mode (Pro, opt-in): workspace data is stored in our US-hosted database so it syncs across your devices. It is used only to provide the service and is covered by our Student Data Privacy Agreement.
• We don't sell data, show ads, use data for advertising, or train AI models on it.
• You can export and delete everything, in either mode, at any time.

Goal tools: please don't enter student information

The goal builder, checker, and data sheets are not built to hold student records. Use a generic label such as “the student.” Drafts are saved only in your browser's localStorage, shared links point to public templates only, and nothing you type is sent to us.

Workspace: two modes

Local mode

The workspace stores your caseload in your browser's storage on the device you are using. IEP Atlas has no copy and cannot see, recover, or delete it. Download a backup regularly from the workspace settings, and clear the workspace before leaving a shared computer. Clearing site data in your browser deletes the workspace.

Cloud mode (IEP Atlas Pro)

If you subscribe to Pro and turn on cloud sync, your workspace is copied to our database and kept in sync across the devices you sign in on. In this mode we process student education records on your behalf. The categories you may store are:

• Student identifiers: name or initials, date of birth, grade, school.
• IEP status: IEP and evaluation dates, services and minutes, disability category if you enter it.
• Goals, baselines, and targets.
• Performance data: session dates, durations, cueing and assistance levels, scores, attendance.
• Session plans and notes, and to-dos that mention a student.
• An optional Medicaid identifier, if you choose to record one for documentation.

Cloud data is encrypted in transit and at rest, isolated per account at the database level, and accessible to our staff only with your permission for a specific support request. The vendors involved are listed on the subprocessors page. Before enabling cloud sync, confirm that your district permits the tool and that you have the authority to store these records with a third party.

What else we collect

• Anonymous usage events, such as “data sheet created” or “goal copied,” with the template ID and type of sheet. Events contain no free text, no student data, no user ID, and no IP address. Search terms are recorded only if they already appear in our public library. If your browser sends Do Not Track or Global Privacy Control, no events are sent.
• Page analytics through Cloudflare Web Analytics, which doesn't use cookies.
• Account data, if you create an account: your email address, subscription status, and the goal collections and presets you save. Saved goal collections strip student labels and baselines. If you choose “Continue with Google,” Google shares your name and email address with us; we don't receive your Google password or any other Google data. Square handles payment details; we never see or store card numbers.
• Support email, if you write to us. Please don't include student records in support messages.

Retention and deletion

• Local workspace data: kept until you clear it. We hold nothing to delete.
• Cloud workspace data: kept while cloud sync is on. When you delete a student, turn off sync, or delete your account, the data is removed from active systems within 30 days and from encrypted backups within 90 days.
• If a Pro subscription lapses, sync pauses and your cloud data stays available to export for 90 days, then is deleted on the same schedule.
• Account email and billing records are kept as long as needed for tax and accounting law after the account closes.

Your rights

You can export your full workspace as a file at any time, in both modes. In cloud mode you can also delete individual students or the whole workspace from your account, and ask us to confirm deletion in writing. Parents and eligible students who want to see or correct a record should ask the school, which controls the record; we help the school respond.

What we don't do

• No advertising, no behavioral tracking, no sale or rental of data, no data brokers.
• No use of workspace or account data to train machine-learning models.
• No disclosure to third parties except our listed subprocessors, or as required by law, and we notify you first when the law allows.

Security incidents

If we confirm unauthorized access to cloud workspace data, we will email the affected account holders within 72 hours with what happened, what data was involved, and what we are doing about it, and we will help with any notices the school must send.

Medicaid documentation

Service logs and other Medicaid-oriented exports are support documents assembled from your own entries. They are not claims and are not reviewed or submitted by IEP Atlas. Your district's billing process, parental consent requirements, and state rules still apply.

Minors, schools, and compliance claims

IEP Atlas is for adult professionals and parents. It is not directed to children, and we don't knowingly collect information directly from anyone under 18. We don't claim that using IEP Atlas makes you or your district compliant with FERPA, IDEA, HIPAA, or state student-privacy laws; compliance depends on how the tool is used and on your district's policies. In cloud mode we agree to act as a “school official” under FERPA on the terms in the Student Data Privacy Agreement, and districts that need a signed agreement should contact us before staff enable sync.

Changes and contact

We will post changes here and update the date above; changes that reduce protections for student data get 30 days' notice by email to cloud-sync users. Questions, export, or deletion requests: support@iepatlas.com.