Privacy Policy

What Cherrypicker is

Cherrypicker is an independent academic planning tool operated by Enzo Emami for students, especially Foothill and De Anza students planning transfer pathways, degrees, certificates, coursework, and schedules. It is not an enrollment system or an official academic record. A voluntary pilot or collaboration does not itself authorize access to college-held student records.

Information you provide

Depending on the features you use, you may provide:

• selected colleges, universities, majors, transfer goals, degree or certificate goals, and a primary goal;
• completed or in-progress courses, grades, units, quality points, terms, college, and transfer or other credit information;
• future-quarter plans, manually added courses, preferred schedules, tracked CRNs, registration priority group, availability, modality and campus preferences, and instructor preferences;
• optional profile details: preferred name, pronouns, residency category for planning, first community-college term, expected transfer term, and answers about a prior bachelor’s degree, prior UC attendance, or concurrent high-school enrollment;
• free-text planning notes you type into the planner;
• instructor ratings, optional review text, course and term context;
• CSU articulation progress you enter manually, including course codes and an optional note;
• planning-group names, expiry dates, group goals, and the specific courses or redacted busy-time blocks you choose to share if you use Friend Mode;
• bug reports and the optional context you include;
• if you apply to the Cherrypicker Challenge, your name, a personal email address, the case you chose, and your written answer (Cherrypicker does not ask for a student ID); and
• messages you send to the scheduling assistant or to Ask.

Cherrypicker uses this information to run its core account functionality: academic planning, scheduling, progress and requirement tracking, the personalized Ask AI assistant, and the account features described throughout this policy.

Optional academic information and pilot participation

Uploading a transcript and adding academic or profile information are optional. Features that assess your academic journey may be incomplete without the relevant information. Adding coursework manually saves it as you make changes; uploaded course rows are saved after your review and confirmation. Providing information authorizes the processing described here and in the Terms; it does not transfer ownership of your records or authorize us to retrieve records from your college.

The planned three-month collaboration with Phi Theta Kappa (PTK) is supported by the De Anza College Honors Society and is voluntary. Participation does not give PTK, college representatives, or other participants access to your private academic records. Pilot evaluation reports supplied by Cherrypicker are limited to aggregated, deidentified findings. No reported group may contain fewer than ten participants, and that minimum alone is not enough: findings must also be checked for identification through rare details, quotations, other available information, or comparisons between reports. Identifiable academic records and screenshots are not included in those evaluation reports.

Pilot evaluation may address usability, interface comparisons, bugs, data-handling practices, and overall AI usage. This policy does not activate new tracking or grant coordinators access to student-level usage records. A separately described survey or usability test may collect feedback you choose to provide. Its notice must identify who collects it and what will be shared. Account data is not automatically made available to a pilot coordinator. General Terms, default-on preferences, and Google sign-in are not a blanket FERPA authorization for a college to disclose records. Any future college-record integration or institutional service requires an appropriate legal basis and separate arrangements first.

Google sign-in information

Cherrypicker uses Google OAuth through Supabase Auth. Google and Supabase may provide Cherrypicker with your name, email address, profile image, and Google account identifier. Cherrypicker uses this information to authenticate you, create and manage your account, associate saved information with your account, and display account information such as your name, email, or initials.

Signing in with Google does not request your Google password or access to Google Drive, Gmail, Calendar, contacts, or school-portal credentials — sign-in asks only for basic identity information and no custom scopes. Google account information from sign-in is stored and processed through Supabase authentication and is not sold. It is shared only with service providers that operate the service, when required by law or safety needs, or as described under “When information may be shared.” Cherrypicker separately offers an optional Google Calendar sync feature, described in the next section, that asks for a distinct, narrower Google authorization only if you choose to turn it on.

Google Calendar sync (optional, free)

Cherrypicker’s Scheduler can optionally add your planned class meetings to Google Calendar. This is a separate authorization from Google sign-in: nothing about it happens unless you press “Add to Calendar” and complete a distinct Google consent screen, and an account can be used fully without ever granting it.

That authorization requests exactly two Google scopes: free/busy status on your primary calendar (when you are busy, never event titles, guests, or locations), and access limited to a secondary calendar, “Cherrypicker Classes,” that Cherrypicker itself creates. Cherrypicker cannot read, modify, or delete events on your existing personal or work calendars. It only ever updates or deletes a calendar event it created, identified by an id it stored at creation time — never by searching your calendar for a course name.

If you connect Google Calendar sync, Cherrypicker stores an encrypted refresh token and a record of which calendar events it created for you, tied to your account, so it can keep your synced schedule current. Disconnecting revokes the authorization with Google and deletes the stored token and event records; your “Cherrypicker Classes” calendar and the events already on it are left in place, since disconnecting means Cherrypicker should stop acting on your behalf, not that your calendar entries should be removed. Deleting your Cherrypicker account deletes the stored token and event records along with your other account data.

Cherrypicker’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. That information is used only for the sign-in and Calendar features described here; it is not sold, not used for advertising, and not used to train AI models.

Transcripts and academic records

You may upload an unofficial transcript PDF, up to 8 MB, for parsing. The PDF is sent through Cherrypicker’s server to a separate transcript-parsing function hosted on Vercel. That function temporarily writes the PDF while it parses it, deletes the temporary file afterward, returns structured course rows, and does not intentionally persist the PDF. Responses are marked not to be cached.

The parser first uses automatic, rule-based extraction. Before you upload, a checkbox labeled “Help read unclear transcript lines with AI” is shown, checked by default. While it is checked, if the parser flags between one and twenty lines it cannot read confidently, those lines may be sent to Anthropic’s API. Those lines can contain course names, grades, units, quality points, and other text appearing in the line; email addresses and long ID-like numbers in them are masked before sending. The full PDF is not sent to Anthropic by this feature. If you uncheck the box before uploading, no transcript lines are sent to Anthropic for that upload; unclear lines are shown for you to enter manually. You can also skip the upload and enter courses manually. Reviewing results happens after processing, not before an AI request. Confirmed structured rows may be stored with your account; the PDF itself is not stored in Cherrypicker’s database.

Information stored with Supabase

For signed-in users, Supabase may store:

• authentication records and account metadata received through Google;
• a profile with display name, goals, primary goal, scheduling constraints, registration group, tracked CRNs, and last transcript-update quarter;
• confirmed structured transcript course rows;
• your saved plan, manually added courses, current, draft and saved schedules, and related planner choices such as course colors, so every device you sign in on shows the same ones;
• instructor reviews and their course or term context;
• manually reported CSU articulation progress;
• your Privacy & personalization settings;
• if you use Friend Mode: planning-group records, your membership and its sharing scope, and hashed (never plaintext) invite codes;
• if you connect Google Calendar sync: an encrypted Google refresh token and a record of the calendar events Cherrypicker created on your behalf, described under “Google Calendar sync”;
• anonymous product insights: see “Aggregated and deidentified information” below — that feature is not active yet, so no planning contributions are currently stored under it;
• historical subscription state, such as status, plan, and period end;
• bug reports, rate-limit records, and account-related identifiers used to enforce ownership and abuse controls.

Public catalog, section, requirement, articulation, link, seat-cache, and community data also live in or are designed to load into Supabase. Instructor review ratings, text, and course or term context are readable as community data; the account that wrote each review is not shown to other users or visitors, but review text is public, so do not include identifying details. Manually reported CSU course lists and notes are visible only to the student who entered them. Both are separate from ordinary transcript coursework saved in Past coursework. Non-hidden bug reports are public, but the public bug-report interface and database permissions do not expose the reporter identifier.

Information kept on your device

Cherrypicker uses browser local storage for essential preferences and app state, including theme, onboarding status, goals, plans, manually added courses, chosen schedules, tracking, review prompts, and—in demo or signed-out mode—academic rows, reviews, constraints, and CSU manual entries. Some signed-in features also keep a local copy or device-only state. When you are signed in, your plan, manually added courses and schedules are also saved with your account, and signing out removes that copy from the browser. Clearing site data in your browser removes this device storage.

Supabase uses cookies or similar browser storage to maintain authentication sessions. Cherrypicker uses PostHog for limited product analytics and service diagnostics, with random browser and session identifiers rather than your account identity. It measures broad page categories, onboarding steps, feature use, generation outcomes, timing, and technical AI usage and estimated costs. It does not send student records, grades, course selections, messages, prompts, responses, full URLs, or account details to PostHog. Session recordings, automatic click capture, and advertising tracking are disabled, and PostHog is configured to discard IP addresses. Browser storage keeps the random analytics identifier; clearing site data removes it. Product analytics is skipped when your browser sends “Do Not Track” or Global Privacy Control. Cherrypicker does not track you across other websites.

AI features

Cherrypicker sends limited information to Anthropic, its AI service provider, so a model can return a response. This happens in four places:

• Ask. Cherrypicker has one AI assistant, reached from every “Ask” button in the app. A request contains the last few messages of your current conversation plus grounding data Cherrypicker assembles deterministically: public course, prerequisite, articulation, and current section information. When Personalized Ask is on—the default—it also includes the transfer goals you selected and the part of your saved plan the question is about: planned courses by quarter, your target transfer quarter, the planner’s own recorded reasoning, your planning notes, and the course codes your Past Coursework records as completed or in progress (codes only—never your grades, terms, or transcript text). Ask can also carry out a small, fixed set of Cherrypicker actions on your own plan—removing a class it can verify you already completed, moving or removing a class you asked it to, locking one in place, or opening a screen. Cherrypicker validates every one of those against your current plan before it happens, and never creates or edits coursework records.
• Plan generation. Cherrypicker’s deterministic planner builds, validates, scores, and chooses your plan; no model ranks or selects it. A model is used for one thing: if you typed new planning preferences, that text and the planner’s ordered term labels are sent to be turned into structured preferences (for example “keep Spring light”) that the deterministic planner then enforces. With the preferences box empty or unchanged, Generate Plan sends nothing to any model.
• Schedule preferences. Cherrypicker reads common preferences (“nothing before 10”, “I work Tuesdays 4 to 6”) with a deterministic parser and sends nothing anywhere. Unresolved text or clauses may be sent to Anthropic to interpret your preferences. If you use the conversational preference review, its bounded conversation, including your descriptions and the assistant’s proposed constraints, is sent as well. These requests do not automatically attach your transcript or saved plan. Schedules themselves are generated by Cherrypicker’s deterministic solver.
• Transcript parsing. Only when the upload’s AI option is on, and only the individual lines the deterministic parser flags as low-confidence, as described above.

Turning Personalized Ask off excludes automatically attached goals, plan information, planning notes, and coursework context from Ask requests, and if Cherrypicker cannot confirm your saved setting, Ask treats it as off for that request; Ask keeps working from public course, prerequisite, articulation, and section-availability sources. The automatically assembled Ask coursework context contains course codes and completion status, not stored grade fields. However, personal information or grades you type into messages or notes can be included in an AI request, and enabled transcript recovery can include grades as described above. This setting does not disable the other AI features or remove information already in a conversation or already processed by a provider. Avoid entering student IDs, passwords, or unnecessary sensitive information into AI text fields.

Anthropic acts as a service provider processing this information to return a response to Cherrypicker under the applicable service terms. Anthropic’s commercial API policies describe no model training by default and standard retention of inputs and outputs for up to 30 days, subject to contractual, safety, and legal exceptions. This is not a promise of zero retention or immediate provider-side deletion. See Anthropic’s training policy and retention policy. Using a provider does not remove Cherrypicker’s own applicable privacy obligations.

Friend Mode

Friend Mode is optional sharing between people, not a public feature. Having Friend Mode enabled in your settings does not make your schedule visible to anyone. Information is shared only inside a planning group you intentionally join, and only after several separate steps: someone creates a group and gives you a single-use invite code directly, you redeem that code, and you then explicitly accept the membership. There is no way to find, request, or be added to another person’s group by searching for their name or email address.

Within a group, each member chooses what they share—by default, nothing. You pick which of your own course codes, and whether redacted busy-time blocks, a lunch preference, or a display label, the group’s schedule optimizer may use. Group scheduling results are computed in your browser from what members have chosen to publish.

Leaving a group, or the group expiring or being deleted by its creator, cuts off access immediately; this cannot recall copies another member already saved. Rejoining requires a new invite. Turning Friend Mode off in your settings stops you from creating or joining groups going forward and does not delete your plan, schedule, or other academic data.

Optional community support

One-time contributions are processed by Stripe. We retain a private payment ledger, a stable supporter number, and your recognition preferences. Public recognition requires explicit opt-in and displays only your chosen name or pseudonym, optional affiliation, and supporter number. Your account email, payment identifiers, contribution amount, and academic information are never part of the public archive. Rename or withdraw your listing in the Support panel. Account deletion removes your public listing and recognition name; minimal payment records remain for accounting and dispute handling.

Cherry's twenty-message monthly allowance stores your account identifier, UTC month, request identifier, a request hash, and reservation state. The quota tables do not store prompts, responses, grades, or transcript content.

Aggregated and deidentified information

This feature is not active yet. Turning Anonymous product insights on does not currently send, store, or aggregate any planning data — the code that would collect and aggregate it exists in Cherrypicker’s codebase, but nothing in the running product calls it, and no automated job runs it on a schedule. No insights are published in the product today. The setting is on by default and can be changed at any time. A stored preference is not blanket permission for a new research project or a college disclosure.

If Cherrypicker activates this feature, it is designed to work as follows: with Anonymous product insights on, planning information such as the courses and terms in your plan would be stored under your account identifier — pseudonymous rather than anonymous at that stage — until aggregated; only the published aggregates would be deidentified. A published statistic would be computed only for groups of at least 10 students—smaller groups dropped entirely rather than published—and would report a size range instead of an exact count. The contributions would cover planned courses, terms, unit loads, planned transfer duration, and backup courses; grades, transcript rows, and contact details would not be among them.

Turning this setting off ensures nothing of yours is ever contributed once the feature is active, and deletes anything already stored for your account under it. Before activating it, Cherrypicker will explain the collection, purpose, recipients, retention, and controls in an updated notice and obtain any additional permission required. A minimum group size alone does not establish that a report is deidentified.

Your privacy choices

Account Settings → Privacy & personalization holds the choices described above: Personalized Ask, Anonymous product insights, and Friend Mode, each on by default, plus Opportunity personalization when that feature is available. Each is independent, each can be changed at any time, and a change applies going forward. Cherrypicker does not overwrite a setting you have changed; the Ask read-failure limitation is described under “AI features.” You can also sign out or delete your account as described under “Access, correction, retention, and deletion.”

Service providers and external sources

Cherrypicker relies on Supabase for authentication and database services, Vercel for web hosting and transcript-function infrastructure, Anthropic for the AI processing described above, PostHog for the limited analytics and diagnostics described above, Google for OAuth sign-in and, if you connect it, Calendar sync, and Stripe for optional support contributions and historical billing management. Stripe receives the billing information you give it and an identifier linking the subscription to your account; no transcripts, coursework, grades, goals, or other academic data are sent to Stripe. Repository automation may run through GitHub Actions. The app also links to or uses public academic information from sources such as Foothill, De Anza, FHDA, ASSIST, UC, CSU, institution websites, and RateMyProfessors. Those third parties have their own privacy practices.

Where your information is processed

Cherrypicker’s database and sign-in records, including their backups, are hosted by Supabase on Amazon Web Services in Montreal, Canada. Supabase stores its service logs in the European Union, and its support staff may access data from other countries when needed to help or to respond to a security problem. Pages, server functions, and the transcript parser run on Vercel; server functions run in the Washington, D.C. area of the United States, and pages may be delivered through Vercel’s worldwide network. AI requests go to Anthropic, a United States company. The limited analytics and diagnostic data described above is sent to PostHog US Cloud. Google and Stripe process the information described above under their own policies. Cherrypicker does not promise that all information stays in one country, and this section will be updated if a hosting location changes.

How information is used

Cherrypicker uses information to provide authentication, save and evaluate academic goals and coursework, generate plans and possible schedules, remember preferences, show account information, process transcripts, operate community reviews and bug reports, prevent abuse, troubleshoot the service, and improve academic data and features. The planned product-insights collection described above is dormant. Separately, product analytics and technical telemetry record broad feature use, operation, model, token counts, latency, estimated cost, success, and coarse error category. These diagnostics exclude student messages and academic content and do not activate the separate planning-contributions feature. Hosting, authentication, and security providers may also process request metadata, such as IP addresses, request times, and error or access logs, to operate and protect the service. These operational records are separate from the inactive product-insights feature.

Cherrypicker does not sell personal information.

When information may be shared

Two different things are worth keeping apart. Service-provider processing is Anthropic, Supabase, Vercel, PostHog, Google, and Stripe handling information so they can perform a function Cherrypicker asked them to perform. User-directed sharing is you choosing to show something to another person, through Friend Mode or a public community feature. Friend Mode existing does not mean Cherrypicker sells or discloses schedules; group sharing is separate from the public community submissions described above.

Information may be disclosed:

• to the service providers identified above so they can operate Cherrypicker;
• to the members of a planning group you intentionally join, limited to what you choose to share with that group;
• when you intentionally submit information to a public feature, such as a review or non-hidden bug report;
• to comply with law, legal process, or a valid government request;
• to investigate abuse, protect users, enforce terms, or protect rights and service security; or
• as part of a merger, reorganization, acquisition, or transfer of the project, subject to applicable law and continuing privacy and contractual restrictions; notice alone does not authorize a new use of protected student records.

Access, correction, retention, and deletion

You can review and edit coursework in Past coursework, and download a copy of your account data, plus the plan and schedules saved in your browser, with “Download my data” in Account Settings. Contact the address below for anything the download does not cover, correction, or deletion assistance. We may need to verify your identity before acting. Cherrypicker cannot change an official college record; direct official-record requests to the college. If Cherrypicker ever maintains records on behalf of a college, applicable institutional procedures, legal deadlines, and restrictions on destruction will also apply.

Account information is kept while your account is active and as needed to provide the service. Public community submissions may remain until deleted, withdrawn, moderated, or no longer needed. Operational records and provider backups may have separate retention periods for security, legal obligations, recovery, or dispute resolution. Account deletion does not establish immediate deletion from every provider log or backup. A pilot ending does not automatically delete an independently maintained account; any separate participation or institutional agreement may impose additional handling requirements.

Some records end sooner. Planning groups carry a required expiry date, after which member access ends; a group’s creator can delete it, and leaving a group ends your access immediately while keeping the minimal record that you were a member. Turning off anonymous product insights deletes the contributions stored for your account right away.

A signed-in user can choose “Delete account” from the account menu or Account Settings. The current deletion endpoint deletes the Supabase Auth user; every account-owned database table is configured to delete its rows for that user when the account is deleted. This includes every category of Supabase-stored account information described earlier in this policy — your profile, transcript rows, reviews, manually reported CSU progress, Privacy & personalization settings, Friend Mode group membership, subscription and entitlement records, rate-limit records, bug reports, and, if connected, your Google Calendar sync credentials and synced-event records. Deleting your account also deletes your Stripe customer record, which cancels any Cherrypicker Premium subscription immediately and removes your saved payment method, so you are not charged again; it does not automatically refund the current billing period. If Stripe cannot confirm the cancellation, your account is not deleted and you can try again. Stripe keeps its own records of past payments and invoices as the law requires. Device-local data is separate: clear Cherrypicker’s site data in your browser to remove it. If account deletion is unavailable or fails, email the contact below to request help with account and associated-data deletion.

Security

Cherrypicker uses access controls and server-side handling intended to limit unauthorized access, including database row-level rules for private account data. The public community categories described above have different visibility. No online service can promise perfect security. Use care with sensitive information and do not put student IDs, passwords, full transcripts, or other private information into public reviews or bug reports.

Children’s privacy

Cherrypicker is intended for college planning and is not directed to children under 13. Cherrypicker does not knowingly collect personal information from children under 13. If you believe a child under 13 provided personal information, contact Cherrypicker so it can be reviewed and deleted.

Changes to this policy

The October 15, 2026 revision introduces limited PostHog product analytics and content-free service diagnostics, identifies the US Cloud destination, and explains browser privacy-signal handling. It does not activate planning-contributions collection, session recordings, advertising tracking, or sharing of academic records with PostHog.

This October 11, 2026 revision adds no new kind of data or use. It states that the pilot is supported by the De Anza College Honors Society, where information is hosted and processed, explains that Cherrypicker does not track you across other websites (and so does not act on Do Not Track signals), and states how information from Google APIs is limited.

This September 30, 2026 revision adds one storage location and no new kind of data: when you are signed in, your plan, manually added courses, schedules and related planner choices are now saved with your account, as well as in your browser, so the same plan appears on every device you sign in on.

The September 22, 2026 revision reflected new privacy controls: a choice before each transcript upload about AI recovery, with identifiers masked in anything sent; Personalized Ask treated as off whenever your setting can’t be confirmed; manual CSU progress private to you and review authors no longer shown; a “Download my data” button; account deletion that also cancels billing; and a Challenge application that no longer asks for a student ID. It does not introduce a new kind of data collection.

This policy may change as Cherrypicker’s features and providers change. The updated policy will be posted here with a revised “Last updated” date. Material changes will be identified with a new date and notice through the service or another appropriate channel. Changes do not retroactively authorize new uses of data or override a separate signed pilot or institutional data agreement. Additional permission will be obtained where required before a materially different use.