Privacy

How Galley handles your data · 6 November 2026

Who we are

Galley is run by Askja Aviation S.L. (CIF B-21992342), Marbella, Spain. Contact: [email protected]. Data protection officer: Arnthor Birgisson, [email protected].

What we keep

Your account (email, name), your profile (role, operator, home base, the town you live in if you set it, aircraft), rosters and duties you import, FTL settings and the notes you add to roster findings (they can mention fatigue), per diem and expense records with receipt photos, invoice details, logbook entries, your licence, medical certificate (class, expiry and photo), passport and other document photos you add, your CV if you make one (it can include your date of birth, nationality and phone), what you share in the Crew Lounge (your crew card with avatar or photo and, if you add it, your gender for meet-ups; posts, tips, stories, messages with photos, videos, voice notes and files; check-ins by city or airport, with the hotel only when you share it with friends), your Meet profile and what you do in Meet (see Meet and Something more), notification settings and push tokens with the phone model, when you agreed to the terms, reports you make and reports about what you post.

Why

To run the app for you: legality checks, per diems, statements, invoices, logbook and CV, and the crew features you choose to use. Your medical certificate details are health data: Galley uses them only to show your documents and remind you before they expire. We do not sell your data. Galley shows no ads. On our website, Google Ads measures which of our own ads bring crew to Galley, with cookies only if you accept (see Cookies and advertising).

Who sees it

Only you, unless you share it: friends and crew see what you share in the Lounge (your photo only friends, unless you choose all crew); family links and calendar links show your roster to whoever has the link until you renew it. Partners never see your data. Your operator sees only that you joined. Crew who switched on the same Meet mode see your Meet profile, under the rules in Meet.

Processors

Supabase (database and storage, EU), Anthropic (reading rosters, receipts, documents and logbook pages, only after you allow it in the app; Galley Help, the AI assistant for hotel stays booked in Galley: your messages and the booking details it needs; Translate and What did I miss? in chats, only when you tap them: the words of those messages; and catering orders you send in a caterer’s language, with the caterer’s replies: their words, not the allergies and diets Galley writes from its fixed list; not used to train models), Cloudflare (website), Apple, Google and RevenueCat (subscriptions), Stripe (payments for operator plans and flight bookings), Duffel and the airlines (flight searches and tickets), Nuitée and the hotels (hotel searches and bookings: for a booking they receive the guest’s name, e-mail and phone, and Nuitée takes the payment), Resend (e-mail notifications, receiving e-mails you forward to [email protected] or your roster address, e-mails you send to [email protected] or in reply to a stay e-mail, and caterers’ replies to orders sent in their language), HubSpot (our contact list: your name, e-mail, role, seat, base, operator, language, plan and per diem total, where your first visit to galley.aero came from if you accepted cookies there, and e-mails about Galley, which you can switch off), Expo, Apple and Google push services (notifications and app updates), Photon by komoot and Nominatim (OpenStreetMap place search: they receive what you search for and your IP address), OpenFreeMap (map images) and Frankfurter (exchange rates; no personal data), Google (Google Ads on galley.aero, only with your consent).

Cookies and advertising

The Galley app on iPhone and Android uses no advertising cookies or ad trackers. On galley.aero (the website and the web app) we use one advertising tool, Google Ads. Its cookies are set only if you click Accept in the cookie banner. Until then, and if you click Reject, Google’s tag sets no cookies and receives no ad click identifier. It only sends Google cookieless signals (that a page was viewed or an action happened, the consent status and the technical data your browser sends, such as IP address and browser type), which Google uses to estimate in total how many visits our ads bring. Legal basis for these signals: our legitimate interest in measuring our own advertising (GDPR art. 6(1)(f)). What it does: when you came to galley.aero from one of our Google ads, it tells us whether that visit led to creating a Galley account, searching for or booking a hotel, tapping the App Store or Google Play button, or opening an operator’s job application page. For this, Google’s tag sets cookies on galley.aero (such as _gcl_au; Google keeps these up to 90 days) and sends Google the ad click identifier, the page address, the action, and technical data your browser sends (IP address, browser type). We don’t send Google your name, e-mail or crew profile, we don’t use Google’s enhanced conversions, and we don’t use it to show you ads elsewhere (ad personalisation stays off). Legal basis: your consent (GDPR art. 6(1)(a); LSSI-CE art. 22.2). Recipient: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which may transfer data to Google LLC in the United States under the EU–US Data Privacy Framework. Google’s use is described at policies.google.com/technologies/partner-sites. How long: your choice is kept in your browser for 12 months, then we ask again. Google’s cookies last up to 90 days. Withdrawing: “Cookie settings” at the bottom of galley.aero, or Profile › Account › Cookie settings in the web app, at any time; choosing Reject switches the tag off and deletes its cookies on galley.aero. Withdrawing doesn’t affect what was measured before. Where you came from: only if you click Accept, your browser also keeps for up to 90 days where your first visit came from (the campaign tags in the link, such as utm_source, and the ad and campaign numbers HubSpot adds to our ad links; Google’s click identifier; the site that linked to us and the first page you saw). If you create an account, we save it with your account and copy to our contact list in HubSpot the campaign tags, the ad and campaign numbers, whether you came from a Google ad (yes or no, not the identifier), the first page and the date, to count which of our ads bring crew to Galley. It isn’t shared with Google. Legal basis: your consent, as above.

Visit statistics

Plausible: to count visits to galley.aero’s public pages (the website, the job, hotel and guide pages, and the web app before you sign in), we use Plausible Analytics. It sets no cookies and stores nothing on your device. It receives the page address (never a private one), the site that linked to us, the campaign tags in the link (such as utm_source), your browser and device type and your country; it uses your IP address only to work out the country and to tell one day’s visits apart, and doesn’t keep it. It also counts actions such as creating an account or tapping the App Store button, never with your name, e-mail or crew profile. Legal basis: our legitimate interest in knowing how our website is used (GDPR art. 6(1)(f)). Recipient: Plausible Insights OÜ (Estonia), which keeps the data in the EU. Microsoft Clarity: only if you click Accept in the cookie banner, Microsoft Clarity shows us how our public pages are used: where people click, how far they scroll, and recordings of visits with everything typed into fields hidden. It is never used in the app or after you sign in. It sets cookies on galley.aero (_clck, up to 1 year, and _clsk, 1 day) and receives the pages you visit, your clicks and scrolling, your browser and device type and your IP address. Legal basis: your consent (GDPR art. 6(1)(a); LSSI-CE art. 22.2). Recipient: Microsoft (Microsoft Ireland Operations Limited, Dublin, for the EU), which processes Clarity’s data in the United States under the EU–US Data Privacy Framework. Withdrawing works as for Google Ads above: choosing Reject switches Clarity off and deletes its cookies on galley.aero.

Days you open Galley

On each day you use Galley, we note the date, which of its main parts you opened (Today, Roster, Travel, Jobs, Lounge, You) and whether on iPhone, Android or the web. Nothing you see or type, no times and no location. We use it only to improve Galley, keep it 13 months and after that only as weekly totals without names, and never share it with your operator or partners. Legal basis: our legitimate interest in improving the app (GDPR art. 6(1)(f)).

Roster e-mails

If you switch on roster e-mails, you get a private address (roster-…@in.galley.aero). E-mails you forward to it are read with Claude only to put your own duties in your roster. Galley keeps the duties, not the e-mail; Resend, our e-mail provider, receives it and holds it for a limited time. Galley never replies to these e-mails and never contacts your operator. Turn it off in Roster › Keep my roster in sync; the address then stops working.

Slot e-mails (CTOT)

If ForeFlight’s slot e-mails reach your roster address (you add it as a recipient in ForeFlight, or forward e-mails from [email protected] to it), Galley reads them without AI and keeps only the slot: call sign, airports, date, times, regulation and taxi time, for two days after the flight. Only e-mails from ForeFlight, or forwarded from your own Galley e-mail address, are read; anything else is ignored. A slot message you paste is read on your phone; only one it can’t read is sent to Claude, after you agree. Galley never replies to these e-mails and never contacts ForeFlight, ATC or your operator.

Airline confirmations you forward

If you forward an airline’s booking confirmation to [email protected] from your Galley e-mail address, Galley reads it to put your flight on your roster and the fare in your expenses. It is read from its text; only when that fails is it read with Claude. Galley keeps the flights, the expense and a PDF copy of the confirmation as its receipt in your private receipts, deleted with your account; Resend, our e-mail provider, receives the e-mail and holds it for a limited time. E-mails from addresses that are not on a Galley account are not read. Galley never replies to them and never contacts the airline.

Flight bookings

When you book a flight we send your name, date of birth, email, phone and, only if the airline requires it, passport number, expiry and issuing country to Duffel and the airline to issue the ticket. These traveller details are kept encrypted only until the booking is made (at most 24 hours) and then deleted. The passport number you book with is remembered on your phone only, never on our servers (a passport photo you add to your documents is kept with your documents). We keep the booking record (route, flight, date, price, booking reference) for your roster, expenses and our accounts. Your card details go to Stripe and are never seen or stored by Galley.

Galley Help

Galley Help is the AI assistant for hotel stays booked in Galley, in the app, on galley.aero and by e-mail ([email protected], or a reply to a stay e-mail). It always says it is an AI, and you can ask for a person at any time. It reads only your own Galley hotel bookings, the hotel’s details and Nuitée’s booking status; never your flights, roster or documents. Card numbers, passwords and ID numbers are removed before a message is stored, but please don’t send them. Your messages and the booking details it needs are processed by Anthropic (Claude) for Galley only, under its data processing terms (for the EEA, Anthropic Ireland, with the EU standard contractual clauses), and aren’t used to train AI models. A person from the Galley team can read the conversation to help you and to check Galley Help’s answers; while Galley Help is new, a person checks every answer before it is sent (the one exception: if you write that you are in danger, it tells you at once to call the emergency number). Why: to answer you about your booking (the booking contract) and to keep the answers right (our legitimate interest). How long: the model’s working data is deleted after 90 days; a conversation is anonymised 12 months after it closes. E-mails from addresses that aren’t on your booking or account get general answers only, never booking details.

Translate and What did I miss? in chats

In a chat, Translate (on a message you hold) and What did I miss? (in a busy group, trip or community chat) are done by Claude, Anthropic’s AI, through Galley’s server, and only when you tap them. For Translate, only that message’s words are sent. For What did I miss?, the unread messages’ words and the first names of who wrote them are sent, at most 300 messages. Anthropic processes them for Galley only, under its data processing terms (for the EEA, Anthropic Ireland, with the EU standard contractual clauses), and doesn’t use them to train AI models. Galley keeps neither the words it sends nor the answer: the translation or summary shows only on your phone, and nobody in the chat sees that you asked. Why: you asked for it. Reading a voice note (Show text) is different: it happens on your iPhone and nothing leaves it.

Catering orders in the caterer’s language

When you choose to send a catering order in the caterer’s language, Galley sends the order’s own words (the dishes, your notes and requests, where to deliver) to Claude, Anthropic’s AI, through Galley’s server, to translate them into that language and English and to read the translation back to you. Allergies and diets that Galley recognises are written from a fixed list in the words of food law and are not sent to Claude; a diet line it can’t read is. Anthropic processes the words for Galley only, under its data processing terms (for the EEA, Anthropic Ireland, with the EU standard contractual clauses), and doesn’t use them to train AI models. The order as sent, in both languages, is kept with the order; its diets, allergies and requests are cleared 90 days after the flight, as for any order. The caterer’s replies to these orders come to a Galley address: Galley keeps them with the order, translates them into your language with Claude, sends you a notification and forwards them to your e-mail; they are deleted 90 days after the flight. Which language a caterer writes in is learnt from its replies and kept with the caterer, not with you. Why: you asked for it (the order is a service you request); for the caterer’s replies, our legitimate interest in getting them to you.

If someone books a room for you

A crew colleague or your operator can book a Galley hotel room in your name. They give your name as on your ID and, if they choose, your e-mail and a note for the hotel. We use them to book the room with Nuitée and the hotel, and to e-mail you your stay details (hotel, dates, room, booking number and who booked; never the price). If your e-mail matches a Galley crew account, the stay also shows in your My trips, read-only; “Not my stay” hides it. The person who booked sees the guest names they entered and manages the booking. Why: to provide the stay booked for you (the booking contract) and our legitimate interest in telling you about it. We keep these details with the booking, as for any hotel booking (see Keeping).

Travel preferences

Your travel preferences and frequent flyer, hotel and car rental membership numbers are stored for you only and deleted with your account. Airline programme numbers go only to Duffel and the airline: with your own flight searches, and when you book a fare that takes the programme, so you get its prices and the miles are credited.

Catering

Caterers you add (business contact details, tips) and your ratings are visible to signed-in crew. Your catering orders are kept for you only, as your order history; your operator never sees them. Galley e-mails your order to the caterer you pick ([email protected], replies come to you) and sends you a copy. Special diets, allergies and requests you add (they can say something about a passenger’s health or religion) go only to that caterer, and are cleared from your order history 90 days after the flight. Write them without names (“1 pax gluten free”), and keep passenger names out of orders. If you pay in Galley, the payment goes through Stripe to the caterer; Galley never sees your card. An e-mail you forward to [email protected] is read (with Claude) only to add that caterer and its menu; the caterer’s business details and menu are shared with crew. Galley does not keep the e-mail itself; Resend, our e-mail provider, receives it and holds it for a limited time.

Receipts to your company’s app

If you choose an expense or accounting app in Profile › Where your receipts go (for example Holded or Xero), Galley e-mails it the receipts you switch on: the file, with the merchant, date, amount, how you paid, the city and your name, one receipt per e-mail from [email protected]. That app belongs to your company (or to you), which then holds the receipt under its own privacy terms. Your operator may suggest the app; nothing goes until you switch it on, and you can stop it there at any time. Galley keeps a list of what it sent (what, where, when), deleted with your account.

Trip bills

If you start or join a trip bill, the crew on it (Galley crew in that trip’s chat, and the names added from the roster’s crew list) see its receipts: who paid, the merchant, date, amount and each person’s share, and who has paid whom. Crew who aren’t on Galley see nothing; their name and share are on the bill for the Galley crew on it. The ways to get paid you add (a phone number for Swish or Bizum, your Revtag, PayPal.me name, Wisetag link, or an IBAN with the account holder’s name) are shown only to crew who owe you on an open bill, and only until they have paid. Galley never moves money: you pay in your own app, and Galley keeps only your “I’ve paid” and the other person’s confirmation. Receipt photos stay in your private receipts. Your operator never sees trip bills. A bill is deleted 90 days after everyone has paid, or a year after the trip if it is never settled; your ways to get paid when you remove them or close your account.

Jobs

Only if you switch on “open to work”: operators with an active plan or confirmed by Galley see an anonymous card (roles, types, bases, availability, hours bands from your logbook, valid ratings and medical, whether you are verified). Never your name, photo, e-mail or current operator. Your name, e-mail and phone go to an operator only when you accept its request or apply to its job. You can hide from your own operator and switch it off at any time.

Location

Only for the location features you switch on, and when you tap “Crew hotel near me”. The phone watches a few places for the night (your hotel, the airports on your roster, crew-guide places near the hotel) and tells Galley when you arrive or leave; Galley never stores a GPS track. We keep your hotel stay (you only; the Galley team sees counts per hotel, never who), Crew Trail visits you confirm (others see counts from two crew up, never who), and “at this airport” while you are there, for two hours at most (a count for crew, your name for friends, or friends only, as you choose). “Share my location” sends your position only to the friends you pick, only while you share. “Nearest airports” in the weather sorts airports by your position on your phone and doesn’t send it. On Android, Galley uses your location only while the app is open. Hotel notes you add (Wi-Fi, breakfast, crew rate) are visible to signed-in crew. “Crew hotel near me”: when you tap it, the app asks for your position, rounded to about 100 m, and sends it to our hotel search and to Nuitée only to find hotels around you for that search. Galley doesn’t store it. If you landed in the last few hours, it searches around that airport instead and doesn’t use your position. Meet uses the city from your roster or your check-in, never your phone’s location.

Crew Rest (wellbeing)

Your IMSAFE answers are never saved: this phone only remembers, for your next report, that all six were fine. Your fatigue week, the jet lag plan and the breathing guide are worked out on your phone from your roster and are not stored. Your alcohol limit and which Crew Rest reminders show on Today are kept with your account. A fatigue report is written in your own e-mail app and goes only to whoever you send it to. Calls and e-mails to peer support and crisis lines go from your phone; Galley doesn’t record them. If your operator gives us its alcohol policy and support programme, its crew see them in Crew Rest. Your operator never sees anything from your Crew Rest. On galley.aero, Crew Rest is left out of Google’s measurement.

Paloma

When you send Paloma with The way home on, Galley keeps one page for that trip at galley.aero/p/…: your first name, the moment (landed, on the way home, home safe), your few words (deleted after 24 hours), the city only if you added it, what the children call you and their bedtime if you set them, and your home time from your roster. Anyone with the link sees that page, the dove on the way home and the nights until you are home; never airports, flights, aircraft, passengers or other crew. The page and its links are deleted 12 hours after you are home (at the latest after 21 days); Close my way-home pages in the Paloma sheet deletes them at once. Galley keeps nothing about who opens the page: no account, no cookies, no visit statistics. The message itself goes from your own phone, in the app you choose.

Feedback

When you send a note from “Something wrong or missing?”, we keep it with your name, e-mail, the screen you sent it from and the app version, so we can fix things and reply. Only the Galley team reads it.

Operator enquiries

When you ask about the operator plan on galley.aero/operators, we keep your name, work e-mail, company, role, crew size and message, and add them to HubSpot to answer you. We send you Galley news for operators only if you tick the box, and every e-mail has an unsubscribe link.

Community safety

Galley checks the words in what crew post (stories, messages, tips, notes and crew cards) against a list of words that break the community rules: some are refused, others go to the Galley team to review. A report you make goes to the Galley team with a copy of what you reported.

Meet

Meet stays off until you switch it on, one mode at a time: Friends, Something more (dating) or Networking. Before Meet opens, you agree to its rules; Galley keeps which version you agreed to and when. Only verified crew who switched on the same mode see you, and only where you are too: in the same city tonight, on nights your rosters put you both in the same city this week (Galley Pro), or at your base. Galley works out the city from your roster or your check-in, never from your phone’s location, and never shows a distance, a hotel, a time or a flight. Your operator, partners and industry accounts never see Meet or whether you use it. What Galley keeps: the modes you switch on and your pauses; your Meet profile (up to six photos and your answers to up to three prompts, shown with the name, role, aircraft type and status from your crew card; for Networking, what you’re open to and what crew can ask you about, with your operator; for Something more, see Something more (dating)); the city of tonight and the next seven nights and your days off at home, from your roster, which nobody can read: Galley only compares them; who said hi to whom, your matches and your chats; and safety records (blocks, reports and Galley’s decisions). Galley removes location data from your photos when you upload them. For two days, Galley also keeps who was shown to whom in Meet, to decide who may see Meet photos and to take reports. Who sees it: crew in the same mode see your profile when the rules above match. A hi stays private until you both say hi, except that Galley Pro members see who said hi to them. Galley works out lines such as “Both in Geneva on Thu” from your roster when it shows them, and doesn’t store them. Days off together appear only to your matches, only if you both switch it on, and only as dates. Galley shows how many crew are in Meet in your city this week, from three up, never who. At most once a day, Galley may tell you that someone new will be in your city, without a name; you can switch this off in Meet settings. Why: to run Meet for you, the service you ask for (GDPR art. 6(1)(b)). Safety records: our legitimate interest in keeping crew safe (art. 6(1)(f)) and our duties under the EU Digital Services Act (art. 6(1)(c)). Galley never sends Meet data to your operator, HubSpot, Plausible, Clarity, Google, advertisers or crash reports.

Something more (dating)

Something more is for dating, for crew aged 18 and over: you confirm it, and Galley keeps only that you did and the date, never your date of birth or your age. Something more needs your explicit consent, which Galley asks for on its own screen before it opens. Your gender, who you want to see (women, men or everyone) and what you do in Something more can reveal your sexual orientation or say something about your private life, so GDPR art. 9 protects them as special categories of data. Galley uses them only to choose which crew see you in Something more and which crew you see. Galley shows your gender and who you want to see to no one, not even on your profile, and keeps no record of your sexual orientation as such. Crew who see you in Something more can tell that you are open to meeting someone of their gender, and you can tell the same about them. In Something more, crew see the name you choose (your first name if you choose none), your Meet photos, your role and aircraft type, never your operator. Your full name, username, crew card and Lounge photo stay hidden from a match until you tap Show who I am in that chat; Galley keeps whom you showed and when. By default, crew from your own operator don’t see you in Something more; you can add up to 10 more operators whose crew don’t see you, and whom you don’t see, and you can block anyone. While your roster or a check-in puts you in a country where same-sex relationships are against the law, Galley hides you from Something more if you look for crew of your own gender. You can choose Show me anyway in Meet settings; it lasts until you leave that country. Galley decides this when it picks the day’s crew and keeps no record of it. Legal basis: your explicit consent (GDPR art. 9(2)(a) and art. 6(1)(a)). You can withdraw it at any time by switching Something more off in Meet settings. Galley then deletes your gender and who you want to see at once, and hides your Something more profile. Your Meet photos are deleted 30 days after every Meet mode is off, or at once when you remove them. Withdrawing doesn’t affect what Galley did before. Galley keeps a record of when you gave and withdrew your consent, which text you saw and in which language, for three years after you withdraw it, to show that it asked.

Photo check

To show crew that your photos are really you, Galley asks for a short selfie. A person at Galley compares it with your photos by eye. No software compares faces, and Galley creates no face template. Galley deletes the selfie as soon as that person decides, at the latest 7 days after you sent it, and keeps only the result and the date. Why: to protect crew from fake profiles (our legitimate interest, GDPR art. 6(1)(f)).

Meet safety

Blocking is silent: the person isn’t told. A report still works after an unmatch, and Galley keeps a copy of what you reported. If two different crew report you within 30 days, Galley hides your Meet profile until a person at Galley has looked at the reports, and tells you why, that an automatic rule hid it, and how to reply. A person reads every Meet report, and Galley doesn’t send Meet reports to AI services. Photos and videos from a new match stay blurred until you tap them. Share my date opens Share my location with a note: your position goes only to the friends you pick, until the time you set. Meet’s notifications never show a name, “Something more” or the word “dating” on your lock screen. Why: our legitimate interest in keeping crew safe (GDPR art. 6(1)(f)) and the Digital Services Act (art. 6(1)(c)).

Keeping (Meet)

Galley keeps the crew you passed (Not now) for 90 days, so it doesn’t show them again too soon. A hi nobody answers is deleted after 30 days. After an unmatch, Galley hides the chat from both of you at once and keeps it for 90 days, so either of you can still report it; a chat under report stays until the report is closed. Your Meet photos and answers are deleted 30 days after every Meet mode is off. Reports and Galley’s decisions stay in our moderation records (see Keeping). Everything else in Meet is deleted with your account (within 30 days, as for all your data).

Licence checks

To verify you, Galley reads your licence or attestation photo for the name, issuing country, licence level and validity, and keeps what it read with the result. Galley approves clear cases automatically; only a person at Galley can turn you down, and a person checks a sample of automatic approvals every week. A confirmed work e-mail at your operator can also verify you. Galley never stores licence numbers.

Your rights

You can see, correct, export or delete your data at any time; delete your account in the app (Profile › Account › Delete account), at galley.aero/delete-account or by email. You can complain to the Agencia Española de Protección de Datos (aepd.es).

Keeping

We keep your data while you have an account and delete it within 30 days after you close it. We keep, without your name or contact details, the records of flight and hotel bookings made through Galley for as long as accounting and tax law requires, and a short copy of reported content in our moderation records.