CFI Desk Privacy Policy

This Privacy Policy explains how CFI Desk LLC handles personal information through cfi-desk.com, app.cfi-desk.com, and the installable progressive web app. CFI Desk is the product; CFI Desk LLC is its operator and the company referred to as “we,” “us,” or “our” in this Policy. It covers instructor records and Student View, including guardian-owned accounts, as well as Instruction Billing and support communications. Contact us at admin@cfi-desk.com.

CFI Desk is offered for U.S. use. Instructor accounts are for adults age 18 or older. Adult students may hold invited Student View accounts; for students ages 14–17, the parent or legal guardian owns the account and accesses the minor’s authorized view. Student View is not available for anyone under 14, including through a guardian account. Beta access is free. AI is not active, and there is no current app-store distribution.

1 Information provided by instructors

Account information includes your name and email address, account identifiers, and information needed to authenticate you. Supabase provides email-and-password authentication. Passwords are submitted through the authentication system; do not send them in support messages.

Profile preferences include your chosen home airport, time zone, time display settings, and appearance preferences. Your account may also have operational classifications, such as an administrative role or a demo designation.

An instructor may enter a student’s first name and last name, an email address, and an optional phone number, together with status and instructional notes. Training records include course enrollments, lesson activity, evaluations, and follow-up items. Scheduling information may include appointment times, a location entered by the instructor, and related notes. These records come from the instructor and can exist before an invitation or Student View account. For invitations, the instructor identifies the student as 14–17 or 18 or older. We do not collect student birthdates.

Course information includes the lesson materials and descriptions an instructor enters. Where a Course Library template is copied, we keep information identifying the source version and the resulting course. This does not publish the instructor’s private student records.

We do not request student FAA certificate numbers, medical certificate information, government IDs, or similar sensitive records. Do not include them in free-text fields or support messages. A future product need for additional sensitive information would require a defined purpose and updated disclosures, together with any required consent or safeguards before collection. The ability to type sensitive details into a note is not a request for that information.

2 Student View and guardian authorization

Information sources and invitation matching

For an adult student, the instructor supplies the student’s intended invitation email. For a student ages 14–17, the instructor enters the guardian’s email and the invitation goes to the guardian. Each single-use invitation is tied to one student record and one account email, expires after 7 days, and cannot be transferred to another email. The instructor may cancel it and issue a replacement. The recipient must use and verify the same email through normal account authentication. We retain invitation and access status information to manage pending, activated, expired, or revoked relationships without granting access through an unaccepted invitation.

Adult students directly provide or confirm their account information. A guardian directly provides or confirms their name, account email, and relationship or authority to the student. Authentication processes handle information needed to verify the intended email and secure the account. The guardian accepts the Terms as account holder, separately acknowledges the Privacy Policy, and separately attests that they are the parent or legal guardian authorized to access the student’s records. During beta, this process does not require government ID, birth certificates, driver’s licenses, or comparable documentary verification.

For ages 14–17, the account belongs to the guardian. The minor remains the subject of the instructor-controlled student record and does not own the login. Student information remains information about the minor regardless of who holds the account. This guardian-authorization requirement is a product requirement; it is not a claim that federal law requires the same process for every teenager.

We preserve evidence of authorization and the associated account/student relationship, including timestamps and policy or consent versions. We also record withdrawal and adult-transition events as applicable. Terms acceptance, Privacy Policy acknowledgment, and guardian authorization are recorded as distinct actions. We use this evidence to manage authorized access and address related questions. The retention periods appear in Section 11.

Visible records and separate account information

Student View is read-only for instructor-controlled records. Adult students or authorized guardians may see lesson date, title and status; student-facing feedback and debriefs; student-facing carryover or remediation information; and applicable billing records, receipts and payment history. Simplified correction history may explain changed hours or amounts and the reason. Private instructor notes and internal remediation or administrative notes are not shared through Student View. Internal actor IDs and backend audit metadata remain hidden.

An account holder may manage their own credentials and supported account-contact information. Changing a login email does not silently update the instructor’s student record. Instructor-maintained names or contact details, training records and billing entries remain read-only and must be corrected by the instructor or through a privacy request. Instructor revocation ends authorized Student View access without itself deleting or altering the record. Applicable privacy rights remain available.

Adult transition and withdrawal

Because we do not collect birthdates, there is no automatic transition at 18. Only the guardian can initiate it by declaring that the student has turned 18 and strongly confirming through password re-entry or another appropriate re-authentication method. The instructor has no separate age-transition control. We record the pending adult transition and notify the instructor in the app to send a new invitation to the adult student.

The adult student creates or claims their own account, accepts the current Terms, and separately acknowledges the current Privacy Policy. The new account links to the existing student record. Guardian access ends when the adult account is activated; the guardian’s account is not converted into the student’s account. Existing restrictions continue while the transition is pending. Historical guardian authorization and transition evidence is retained under Section 11.

A guardian may withdraw authorization with strong confirmation through re-authentication. Normal Student View access is suspended immediately and the instructor is notified. For 14 days, restricted access allows only downloading or exporting existing authorized records and requesting reassignment to another CFI Desk instructor. It does not provide continuing normal access to new instructor records. Normal access cannot resume without a new valid guardian authorization process. Withdrawal does not automatically delete instructor-created records. Contact admin@cfi-desk.com for assistance or a related privacy request.

3 Feedback and support information

When you submit in-app feedback, we receive its category and message, your account identifier, and the submission time. The form also sends available diagnostic context, including the page pathname, browser information, viewport dimensions, and device-reported time zone. The pathname sent by that form excludes the query string and fragment, but it can still contain record identifiers.

Where notification delivery is configured, the full feedback message and that diagnostic context, together with your account email, are sent to an administrative email recipient through Resend. An email copy is separate from the feedback record in the application database. Do not include unnecessary student details or sensitive documents in feedback.

If you email us, we receive your address and the contents of the message, including any attachments you choose to send. Google’s Gmail service handles messages sent to admin@cfi-desk.com. We use support communications to respond and investigate the issue raised.

Account deletion requests and cancellations include the account email, relevant identifiers, and request status and timestamps. Administrative notification emails may also contain those details.

4 Technical information and local device storage

Our hosting and authentication services process technical information needed to deliver and protect the service. Depending on their configuration, logs may include an IP address, request time, requested route, browser information, account identifiers, and error details. Administrative activity can create audit records. We also use aggregate operational counts, such as numbers of accounts or completed lessons, to understand use of the service.

Cookies support authentication and session management. Browser local storage retains certain preferences, an account identifier used for offline recovery, and recent weather results. IndexedDB, a browser database, stores supported lesson drafts and cached lesson-start information. These local records can contain student information and instructional notes. A service worker caches application resources used for supported offline recovery.

Some locally saved work reaches our servers only after synchronization succeeds. Offline saving does not mean that a server copy exists. The service does not support general offline access to every student, course, or calendar page.

Signing out clears the remembered offline recovery identifier, but it does not erase every lesson draft or cache from the device. Clearing site data can remove local information and may permanently destroy unsynchronized work. Removing a PWA icon does not reliably clear all browser site data. Account deletion on our servers cannot remotely guarantee erasure of copies on a disconnected device. Use your browser’s site-data controls on each device after preserving information you need.

Student View and Instruction Billing are online-only during beta. We do not provide offline access to Student View, billing history, receipts, payment records, or guardian-managed account information. Instructor lesson-draft storage is separate and does not establish offline storage for these features. An authorized person may deliberately download records or save a receipt as PDF; those copies are controlled separately from application storage.

5 Cookies and advertising choices

Essential cookies and site storage support the functions described above. You can manage them through your browser. Blocking essential storage may prevent sign-in or disrupt supported instructor offline functionality.

CFI Desk does not sell personal information or share it for targeted or cross-context behavioral advertising. The current service does not display third-party advertising. Disclosures to service providers for the purposes described in this Policy are separate from those advertising uses.

Our commitments not to sell personal information or share it for targeted or cross-context behavioral advertising apply to everyone, whether or not a browser sends a Do Not Track or Global Privacy Control signal. We do not authorize advertising networks to collect personal information through CFI Desk for tracking users across unrelated websites. Browser privacy signals do not replace a request to close an account or delete a record; those requests can be made through the process in Section 12. Essential account functions and the operational processing described in Section 4 remain subject to this Policy.

6 How we use information

We use account and training information to provide the instructor workspace, including saving records, displaying training history, and synchronizing supported lesson changes. Preferences help display information in the format you select.

We use technical information to maintain the service and investigate errors. Account identifiers and administrative records help enforce access controls, prevent misuse, and manage requests. Feedback and aggregate usage information help us understand problems and improve the application.

We use contact information for account confirmation, password recovery, and responses to requests. We may send essential service or policy notices. These functions are separate from any future promotional-email program, which would require its own applicable disclosures and unsubscribe process.

We also process information when reasonably necessary to comply with legal obligations or address a legal claim. We do not obtain permission for an unrelated new use merely because information is stored in CFI Desk.

We use invitation information and guardian contact details to connect the intended account to the correct record and obtain required authorization. Authorization evidence supports access, withdrawal, and transition handling. These uses are distinct from the instructor’s preexisting collection of information for training. Guardian contact information collected for authorization is not treated as a subscription to marketing messages.

We record policy versions and timestamps for Terms acceptance and separate Privacy Policy acknowledgment. When these policies first take effect, existing instructors must complete both actions before continuing into the application. Material Terms changes or other appropriate or required circumstances may require renewed acceptance; every immaterial wording change does not.

7 Instruction Billing information

Instructional charges and completion records

When an instructor chooses Instruction Billing, we store the instructor-level setting, separate default Flight Instruction, Simulator Instruction and Ground Instruction rates, per-student settings, and lesson-specific choices. Billing covers only the instructor’s instructional services. It does not track aircraft rental, fuel, school fees, club dues, or other third-party charges. Turning the capability on does not classify the entire account as an independent or school instructor account.

An individual lesson can use the student default, be billed, or not be billed. At Lesson Completion, instructors provide the actual billable instructional time, rather than using a scheduled block automatically. Ground lessons use Ground Instruction only; flight lessons may include Flight and Ground Instruction, and simulator lessons may include Simulator and Ground Instruction. Time is entered in tenths of an hour, with 0.1 hour equal to 6 minutes; hundredths are not supported. Charges use the entered time and component rates, with currency rounded to cents.

Completed records retain the actual billing state, applicable time and rates, resulting charges, and recorded payment status and related details at completion. Future instructor-rate or student-setting changes do not recalculate completed records. Turning billing off does not hide or erase existing billing history. Later payments or auditable corrections can update the current display while preserving prior entries. Historical records remain available according to the applicable access and retention rules.

Manual payments and audit history

Charges and payments are separate records and partial payments are supported. Instructors manually enter payment amounts and dates, payment-method labels, and limited notes or references. Displays may identify unpaid, partially paid, or paid charges. These records come from the instructor, not from a linked bank or external payment account.

Recording Zelle, Venmo, cash, check, or another external payment method does not cause CFI Desk to receive bank account information or payment credentials. CFI Desk does not connect to, initiate, process, receive, verify, transmit, or hold those external payments. This feature does not collect banking or payment-account credentials. Do not enter credentials, bank account numbers, or images of checks in billing fields or notes.

Billing corrections preserve the original value and corrected value, reason, timestamp, and instructor identity. Payment corrections or reversals preserve the original entry and correcting or reversing value with the same audit details. A payment cannot silently disappear through deletion. Reversing an entry changes only the instructor-maintained record and does not initiate or represent an external refund. Simplified correction history in Student View explains relevant changes without displaying internal account IDs or backend audit metadata.

Use of billing information and receipts

We use billing information to display instructional charges, recorded payments and outstanding balances, and to support correction history and exports. Summaries reflect entries in CFI Desk and are not independent verification of earnings or a legally enforceable debt. Adult students and authorized guardians can review the linked student’s billing history and payment status in read-only form. Other students are not entitled to that information.

Receipts or payment records may show the instructor or business name, student name, lesson date and type, applicable Flight, Simulator or Ground hours, each component rate, total charge, amount paid, remaining balance, payment date and method, and relevant correction or receipt date. They contain a notice that they are generated from instructor-entered records and are not independently verified payment confirmations. Receipt delivery is viewing within CFI Desk and printing or saving as PDF through browser or supported app functionality; it does not include automated receipt email.

Instruction Billing is separate from any future purchase of a CFI Desk subscription. If paid application plans are introduced, we will disclose their payment-data handling before collecting information for that purpose.

8 Service providers and other disclosures

Supabase provides authentication and the application database. Vercel hosts the application and marketing website. These services handle information necessary for their roles, including relevant technical requests. Resend handles administrative notification delivery when configured. Gmail handles the support mailbox and any notifications delivered to that mailbox.

Service providers supporting authentication and email delivery process the intended recipient’s email address and the message or verification information needed to deliver account confirmations, password recovery messages, invitations, and guardian-authorization communications. The information provided depends on the message and the provider’s role. These deliveries do not make a recipient a subscriber to marketing emails.

The weather feature sends the requested airport or station identifier from our server to AviationWeather.gov. That request does not include your student records or account email. The weather provider receives the server’s network request and associated technical information. Selecting a home airport is not the same as providing live GPS location.

Authorized personnel may access information as reasonably needed for administration, support, or security. Student records are associated with an instructor workspace or, during an applicable transition, a system archive. A linked adult student or guardian may see only records authorized for Student View or restricted transition access. Working for a school does not automatically grant that school access. We may coordinate an authorized privacy request with the instructor who maintains the record.

We may disclose information when legally required, to respond to valid legal process, or as reasonably necessary to address fraud or protect people’s rights and safety. Professional advisers may receive relevant information when assisting with those matters, subject to appropriate confidentiality obligations.

If the business is reorganized or transferred, information may be disclosed to advisers or a successor as necessary for that transaction, subject to appropriate safeguards and applicable law. A successor must handle the information consistently with applicable commitments unless a lawful change is made. We will update the operator information and provide any required notice.

A requested reassignment to another CFI Desk instructor requires appropriate adult-student or guardian authorization and the receiving instructor’s acceptance. Records disclosed through the authorized transfer remain subject to applicable privacy rights. Historical entries stay attributed to the original instructor and cannot be rewritten by the receiving instructor. CFI Desk and its administrator do not become the instructor of record when maintaining the system archive.

9 Student privacy and responsibilities

Instructors must have authority to provide student information and supply notices or obtain permissions required for their recordkeeping. They are responsible for accurate training and billing information, including payments and corrections. They should respond to reported errors and use the correction workflow. Guardian authorization for Student View is separate from the instructor’s responsibilities for records created before an account exists.

Adult account holders should provide accurate account information. Guardians must truthfully state their authority to access the minor’s record. A guardian-owned login does not turn the minor’s training or billing information into information solely about the guardian. Neither read-only access nor guardian authorization certifies instructor-entered information or transfers the student’s privacy rights.

For instructor-created records, we provide storage and processing for the instructor’s workspace and the limited transition workflows described here. Instructors or schools may have separate responsibilities for their collection and use. CFI Desk LLC remains responsible for its own processing. Contract labels do not override obligations imposed by law.

A student or a parent or guardian with appropriate authority may contact us about the student’s information without creating an account. We verify identity and authority before disclosing information or taking action and may consult the instructor about the record. Read-only UI permissions do not restrict legal privacy rights. An instructor’s preference alone is not a basis to disregard a legally required correction or deletion.

Student View is not offered for anyone under age 14, including through a guardian account. Minor students ages 14–17 do not own accounts; their authorized parent or legal guardian does. We do not collect student birthdates. Adult-entered student records can exist without Student View access. If you believe an unauthorized child account or access exists, contact us so we can investigate and take appropriate action. These eligibility rules do not claim that an under-13 direct-use consent program is available.

Students and guardians may dispute training or billing information. We preserve the record and audit history while the matter is addressed, subject to applicable privacy rights and retention limits. The instructor can correct it through the normal workflow, and an unresolved record may be marked disputed. CFI Desk does not adjudicate training performance or proficiency, or whether an external payment or amount is legally owed. Privacy requests remain a separate process and may require action regardless of an instructor’s position.

10 Planned AI Lesson Debrief

AI processing is not currently active. The planned feature is an optional, instructor-initiated Lesson Debrief generator during Lesson Completion. The input is limited to lesson-item SAT, UNSAT, or Incomplete status and instructor-entered line-item notes. An existing overall lesson note is not an input. Syllabus conversion and course building are outside this planned scope.

The AI produces a proposed debrief that the instructor reviews and may edit before saving and completing the lesson. Student profile or contact information, billing records, certificate details, account information, and other unrelated data are not sent merely because they are stored elsewhere in CFI Desk. Line-item notes may themselves contain student information; instructors should avoid unnecessary identifying or sensitive details. Once saved, a student-facing debrief is handled as a training record under this Policy.

Private instructor and student content is not authorized for general-purpose AI model training. Mentioning the feature here does not itself authorize sending existing records to an unspecified provider. Before enabling it, we will disclose the provider’s role and processing practices and obtain any required consent.

11 Retention and account deletion

Active records and invitation cleanup

Training and Instruction Billing records remain with the active instructor workspace until the applicable deletion, transition, or privacy-request lifecycle occurs. Receipts, payment entries and billing-correction history remain associated with the underlying billing record, rather than having an unrelated expiration while that workspace is active. Archiving within an active workspace does not necessarily delete a record. Retention remains subject to applicable law and privacy rights.

Invitations expire after 7 days. Unnecessary contact information associated only with a cancelled or expired invitation is deleted or de-identified within 30 days of cancellation or expiry, unless needed for an active security matter, dispute, legal obligation, or privacy request. This cleanup does not automatically delete contact information independently needed for an active account or an instructor’s authorized student record.

Guardian contact information used for an active guardian-managed relationship is retained while needed for that relationship. Limited evidence of guardian authorization, withdrawal, and adult transition is retained for 3 years after the guardian-managed relationship ends, subject to overriding legal requirements, including a requirement to delete sooner or retain longer. The evidence documents authority and access changes; it does not keep normal access active after withdrawal or adult-account activation.

Guardian withdrawal and instructor deletion

Guardian withdrawal immediately suspends normal Student View access and notifies the instructor. A 14-day restricted window permits only export or download of existing authorized records and a reassignment request. It does not expose new instructor records through normal access. Normal access cannot resume without new valid guardian authorization. After that window, restricted access ends; withdrawal does not itself delete the instructor’s training or billing records.

An instructor may request account deletion in Settings under Account and Security or by emailing admin@cfi-desk.com. During beta, an administrator processes it manually. The account remains usable while the request is pending, and a pending request may be cancelled before completion through the available controls. We handle requests within the time required by applicable law.

When instructor-account deletion takes effect, linked student records enter a read-only system archive for 14 days instead of being immediately destroyed. Authorized adult students or guardians may access and export preserved records under that transition workflow or request reassignment to another CFI Desk instructor. CFI Desk and the administrator do not become the instructor of record. A transfer requires appropriate student or guardian authorization and acceptance by the receiving instructor. Historical records retain the original instructor’s attribution and cannot be rewritten by the receiving instructor.

At the end of the 14-day instructor-deletion window, records follow the applicable deletion or retention rules. A transfer request alone does not guarantee preservation beyond that window or acceptance by another instructor. A completed authorized transfer allows the records to continue within the receiving relationship, subject to the same historical-record protections and applicable privacy rights. A guardian-withdrawal restriction cannot be bypassed by requesting a transfer.

Account closure and privacy requests

Closing an adult-student or guardian account ends that login’s access but does not automatically delete instructor-created records, which may predate signup. A separate request is assessed according to applicable privacy rights, recordkeeping obligations, and the purpose of each record. Legitimate instructional or billing needs, including resolving a dispute, may justify retention where lawful. An unpaid balance, dispute label, or general reference to recordkeeping does not authorize indefinite retention or defeat a legal deletion right.

Billing and payment corrections preserve prior entries for accuracy and accountability, but an audit trail is not an exception to required deletion. Limited guardian authorization evidence follows the 3-year rule above. Applicable legal requirements can override these periods or require a restriction on disclosure. Contact admin@cfi-desk.com for account closure or privacy requests.

Infrastructure copies and operational retention

Deletion does not guarantee immediate erasure of every backup, email copy, or local device record. We may retain limited information to document a request, comply with law, address disputes, or protect the service. Deletion-request audit records can include an email snapshot and request status after an associated profile is removed. Administrative audit logs may retain relevant identifiers. These infrastructure records have separate purposes from the product records and authorization evidence described above.

We determine retention for operational logs and administrative audit records by the period reasonably needed to investigate errors or misuse, secure accounts, and document administrative actions. Support correspondence and notification copies are retained while needed to resolve the request and related follow-up, or for a specific legal or dispute-related purpose. Backup copies remain subject to the service provider’s backup rotation and deletion processes. The invitation, transition, and guardian-evidence periods above do not represent the retention periods for these separate infrastructure copies. Applicable deletion obligations continue to apply to records restored from a backup.

We assess retention according to the purpose of each record and applicable requirements, rather than retaining information indefinitely because storage is available. Device-local instructor drafts and deliberate exports remain separately controlled as described in Section 4. Student View and Instruction Billing do not provide offline access.

12 Your choices and privacy requests

Instructors can review and change available profile information in Settings and edit supported student information in their workspaces. Adult students and guardians may manage their own login credentials and supported account-contact information. Their instructor-controlled records remain read-only. A student or authorized guardian may request access to personal information, correction, or deletion without editing the underlying record. Contact the instructor about record errors or admin@cfi-desk.com for account closure and privacy requests. Identify the request and your relationship to the account or student without including unnecessary sensitive documents.

Depending on where you live and whether a law applies to CFI Desk LLC, you may have rights to access or correct information, obtain a copy, request deletion, or opt out of certain processing. Some laws provide an appeal right if a request is denied. You may contact the same email address to appeal a response, and we will provide any additional information required by applicable law.

We may verify your identity and, where relevant, an authorized agent’s permission before acting. We will explain any legally permitted reason for declining a request. We will not unlawfully discriminate against you for exercising privacy rights. Some information is necessary to provide an account, so deleting it may prevent continued use of the service. Nothing in this Policy limits a right or complaint process available under applicable law.

13 Security and processing locations

The service uses authentication and database access controls to protect instructor workspaces. No internet service or device storage is completely secure. Protect your account and the devices used to access student records. Report suspected unauthorized access to admin@cfi-desk.com.

Information may be processed in the United States and in other countries where our service providers operate or provide support. U.S.-only eligibility is not a promise that all information stays in the United States. We use safeguards required by applicable law and do not offer a specific data-residency arrangement under this Policy.

14 Policy changes and contact

We will post the current Policy with its effective date and Privacy Policy version. For material changes, we will provide notice through the service or an account email, as appropriate, before the change takes effect when required. We will obtain additional consent where required. Updating this Policy does not itself override earlier promises concerning information already collected. This Policy is versioned independently from the Terms of Service. Updating one document does not, by itself, change the other document’s version or require renewed acceptance or acknowledgment of an unchanged document.

For privacy questions or requests, contact CFI Desk LLC at admin@cfi-desk.com.