Plain-language summary: Galley Desk collects your work email and employee number to verify that you are an active American Airlines flight attendant. We use Stripe to process payments and Supabase to store your data securely. We do not sell your personal information to anyone.
1. Who We Are
Galley Desk ("we," "us," or "our") is a subscription software service built for American Airlines flight attendants. We provide tools including PBS bid analysis, contract reference, duty day calculation, and related features designed to help flight attendants navigate their workday.
Our service is operated from North Carolina. All disputes are governed by North Carolina law and subject to the jurisdiction of Mecklenburg County courts.
For privacy questions, contact us at hello@galleydesk.com.
2. Information We Collect
Account Information
When you create an account, we collect a personal email address of your choice and a password (stored as a secure hash via Supabase Auth). Your personal email becomes your Galley Desk login. We do not store your password in plain text.
Employment Verification Information
To confirm you are an active AA flight attendant, we use a two-step process: first, we send a one-time verification code to your @aa.com address to confirm active AA employment. Second, you enter your AA employee number, which is cross-referenced against the APFA seniority roster — information accessible to all AA flight attendants through their union. Once verified, we record your employee number, seniority number, domicile base, hire date, equipment group, and base rank to personalize your bidding tools. Your @aa.com address is not retained after verification. Your employee number and seniority profile remain stored for as long as your account is active.
Payment Information
Subscription payments are processed by Stripe. Galley Desk does not store your credit card number, CVV, or full card details on our servers. Stripe returns a customer ID that we store in order to manage your subscription status. You can review Stripe's privacy practices at stripe.com/privacy.
Usage Data
We collect basic usage information such as which tools you interact with and general activity logs. This data is used to improve the service and troubleshoot issues. It is not linked to any advertising profile. How we handle your conversations with the AI Concierge is described separately below.
AI Concierge Conversations
Each time you use the AI Concierge or the bidding assistant, we record a small set of non-identifying labels about the exchange, such as the general topic, whether the assistant answered, and which contract sections it referenced. These labels never include the text of your message or the assistant's reply, and they are not linked to your account.
The text of a conversation is stored in only four situations:
- You turn on "Help improve the assistant" in Settings. This setting is off by default and is entirely optional. While it is on, we store the text of your messages and the assistant's replies so we can review them and improve the assistant's coverage and accuracy. You can turn it off at any time, which stops any further text from being stored.
- The assistant fails to answer. When the assistant replies that it does not have the information, we store that one exchange even if the setting above is off, so we can find and fix the gap. Nothing is stored when the assistant answers normally.
- You tap the thumbs-down button on a reply. Tapping thumbs-down sends us that one question and answer so we can review what went wrong. The button tells you this before you tap it, and a thumbs-up never sends any text.
- You tell the assistant its answer was wrong. If your next message corrects the answer you just got, for example by giving it the right date or telling it you were not asking about that, we store that one earlier question and answer so we can see what it got wrong. An answer that reads as confident and is wrong is the hardest kind for us to find, and your correction is the only signal that it happened. Only the exchange you corrected is stored, not the correction itself and not the rest of the conversation.
In all four cases the same protections apply: before any text is stored we remove direct identifiers such as email addresses, phone numbers, and employee and seniority numbers; the stored text is not linked to your account or to any other identifier we hold about you; and it is deleted automatically within 60 days.
Service Tracker and Preference Sheets
Service Tracker is a scratchpad for running a cabin service. What you type into it — including any passenger names, seat numbers, meal choices, and drink orders — is stored in your browser on that device and is not sent to us. Clearing it with "New flight," or clearing your browser data, removes it.
There is one exception, and it only happens if you ask for it. If you turn on Sync in order to move a sheet between your own devices, such as from your phone to your iPad, that sheet is uploaded to your Galley Desk account so the other device can load it. Sync is off by default and applies only to the flight you are working on.
While Sync is on, please note:
- The uploaded sheet includes any passenger names you have typed. If you would rather not upload them, leave the name fields blank or use initials — everything else still syncs.
- The sheet is deleted automatically within 24 hours of the last change, whether or not you clear it yourself. Tapping "New flight" deletes the uploaded copy immediately.
- It is stored only so your own devices can read it back. It is not used to improve the product, is never sent to the AI Concierge or any AI model provider, and is not analyzed or shared.
You can also move a sheet between devices without uploading anything, by using the offline transfer code, which you copy from one device and paste into the other.
Sharing with another flight attendant. You can invite another flight attendant onto a sheet you are working, so you can run a cabin together. If you do:
- They must have their own Galley Desk account. There is no anonymous access.
- You choose, each time you share, whether passenger names are included. If you share without names, the names are removed before the sheet is sent to them, so their device never receives them.
- They can see and edit the sheet while the share is active. You can stop sharing at any time, which removes their access immediately, and access ends anyway when the sheet is deleted.
- Only you can end the flight and delete the sheet. Someone you invited can leave it, but cannot delete your copy.
Connecting Your American Airlines Account
The Galley Desk phone app and the Galley Desk Chrome connector can keep your schedule up to date and show open time by reading your own information from American Airlines' crew systems (FA Portal and TTS). This is optional. Here is exactly how it works:
- You sign in on American Airlines' own page. In the phone app, AA's real sign-in page (aa.com) opens inside the app. On a computer, you sign in to AA in your own Chrome browser as usual. Galley Desk never shows its own form for your AA login.
- We never see, store or transmit your AA username, password or verification codes. They go only to American Airlines. Galley Desk does not read AA's sign-in page, and nothing you enter there reaches our servers.
- Your AA sign-in stays on your device. AA keeps you signed in on your phone or in your browser, the same way any web browser does. That sign-in is never copied to Galley Desk's servers or shared with anyone.
- What we read, and what we keep. After you sign in, the app or connector reads the same screens you can already see: your HI-1 and HI-2 schedule, your TTS calendar, and open time listings. From these we save your trips (sequence numbers, dates, positions), schedule items such as vacation or sick days, and AA's monthly pay figures (projected credit, guarantee and pay no credit) to your Galley Desk account so we can show your schedule and estimate your pay. We do not store the full text of these screens. Open time listings are shown to you and are not saved.
- Read only, and only yours. Galley Desk never makes changes in AA systems. It does not pick up, drop or trade trips for you. It reads only your own information while you are signed in, and never shares it with other flight attendants.
- Your trip details. From your FA Portal schedule we also save, for your own trips only, each flight's aircraft type, your layover hotels and hotel and shuttle phone numbers, and whether a flight was cancelled, so the Trip page can show them.
- Crew lists stay on your phone. If you turn on crew lists in the phone app, the app reads the crew on your own flights from your FA Portal session and keeps them only on your phone, so it can show who you're flying with and who you've flown with before. Crew names, employee numbers and seniority are never sent to Galley Desk's servers or shared with anyone. Turning crew lists off deletes them from your phone.
- Matching accounts. Your HI-1 and FA Portal schedule show your employee number. If it does not match the employee number on your Galley Desk account, the schedule is not saved.
- Disconnecting. You can sign out of AA on your phone from My Schedule in the app, delete the app, or remove the Chrome connector at any time. Your saved trips stay in your Galley Desk account until you remove them or close your account.
Friends on Layovers
Friends is optional. It lets two Galley Desk members see when they will be on a layover in the same city.
- Invite only, and both people agree. Someone only becomes your friend when they accept your invite link, QR code or code, or you accept theirs. Nobody can search for you.
- You choose what each friend sees. One friend at a time: hidden, the days you work and your layover cities, those plus your hotels, or your full schedule (trip numbers, positions, report times and routes). Sick days, vacation and other absences are never shared.
- It uses only your own Galley Desk schedule. Layovers come from the trips already saved in your account. No information about other crew members is used.
- You can hide anytime. Ghost mode hides all your layovers from every friend, and you can hide a single trip. Removing a friend stops sharing in both directions right away, and deleting your account removes all friend connections.
Friend Profiles and Messages
- Profile. You can add a photo, the name friends see, your commute city, languages, positions you like to work, a phone number, a short note about you, and your Logbook totals. All of it is optional and is shown only to your friends. The one exception is your name and photo, which members you have flown with can see if you both turn on Who You've Flown With (below). Your employee number and seniority are never shown.
- Messages. Friends can message each other and ask to fly a trip together. Messages are stored encrypted on our servers so they can reach both phones, are not read by us unless one of you reports them, and are deleted automatically after 90 days. You can delete a conversation for yourself at any time.
- Reporting and blocking. Any message or profile photo can be reported, and reports are reviewed within 24 hours. Blocking someone removes them as a friend and stops messages in both directions.
- Notifications. If you allow notifications, we store your phone's notification token to tell you about new messages and shared layovers. Signing out or deleting your account removes it.
Who You've Flown With
This is optional and off until you turn it on in your Logbook.
- Both people turn it on. We match your Logbook with the Logbooks of other members who also turned it on, and only those members. Two members match when both their own imported histories show the same working flight on the same day.
- What a match shows. The other member sees your name, your photo if you added one, your base, and the flights you worked together. Nothing else from your Logbook or schedule is shown, and your employee number and seniority are never shown.
- Only members' own records. Matching uses only the history each member imported into their own account. Galley Desk does not use crew lists or any information about people who are not members.
- Off anytime. Turning it off removes you from every other member's list right away. Blocking someone hides each of you from the other.
Feedback
If you submit optional feedback through the app (for example, during the subscribe flow), that message is stored in our database and used solely to improve the product.
Cookies and Local Storage
We use browser local storage to maintain your login session. We do not use advertising cookies or third-party tracking pixels.
3. How We Use Your Information
- To verify your eligibility as an AA flight attendant
- To create and manage your account and subscription
- To deliver personalized PBS bidding analysis based on your seniority and domicile
- To process subscription payments and handle billing events via Stripe
- To send transactional emails (verification codes, subscription confirmations, admin notifications) via Resend
- To send optional product update emails, if you opted in during signup
- To improve and debug the service
- To improve the AI Concierge using conversations you have chosen to share, exchanges the assistant failed to answer, and replies you have flagged with thumbs-down, as described in Section 2
- To enforce our Terms of Service
We do not use your information for advertising, behavioral profiling, or sale to third parties.
4. How We Share Your Information
We share personal data only with the following service providers, and only to the extent necessary to operate the service:
- Supabase — database and authentication infrastructure
- Stripe — payment processing and subscription management
- Resend — transactional email delivery
- Anthropic — AI model provider that powers the concierge and bidding AI features. Queries you submit are processed by Anthropic's API. We do not send your name, employee number, or payment information to Anthropic.
- Vercel / Railway — cloud hosting infrastructure for the frontend and backend applications
We may disclose information if required by law or to protect the rights, property, or safety of Galley Desk, our users, or the public.
We do not sell, rent, or trade your personal information.
5. Data Retention
We retain your account data for as long as your account remains active. If you cancel your subscription and request account deletion, we will remove your personal information from our active database within 30 days. The non-identifying labels and aggregated usage data described in Section 2, which cannot be linked back to you, may be retained indefinitely to improve the service. Conversation text you choose to share through "Help improve the assistant" is deleted automatically within 60 days, regardless of your account status. A Service Tracker sheet uploaded through Sync is deleted automatically within 24 hours of its last change, regardless of your account status.
To request deletion of your account and data, email us at hello@galleydesk.com.
6. Security
We take reasonable technical and organizational measures to protect your information. These include encrypted data transmission (HTTPS), hashed password storage, AES-256 encryption at rest via Supabase, row-level security controls in our database, and restricted access to production systems.
No system is completely secure. If you believe your account has been compromised, contact us immediately at hello@galleydesk.com.
7. Your Rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion of your account and personal data
- Opt out of product update emails at any time (reply to any email or contact us directly)
- Cancel your subscription at any time via the billing portal in the app
To exercise any of these rights, email hello@galleydesk.com. We will respond within 30 days.
Deleting your account. You can permanently delete your account yourself in Settings, in the app or on the website, or by emailing us. Deleting cancels any active subscription immediately and removes your login, profile, saved schedule and pay information. Hotel reviews you wrote stay published without your name, and Stripe keeps records of past payments as required by law. Details: galleydesk.com/delete-account.html.
8. Children
Galley Desk is intended solely for adult American Airlines flight attendants. We do not knowingly collect information from anyone under the age of 18. If we become aware that a minor has created an account, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will notify subscribers by email. Continued use of the service after an update constitutes acceptance of the revised policy.