What we access, what we never touch, and how you switch it off.
Plain answers, no jargon. First Officer reads your spending so it can find value you already earned. It never moves money, never holds your credentials, and never sells your information. Everything below is a commitment you can hold us to.
Five commitments, in one place.
If you read nothing else on this page, read these.
Read-only, always
Every connection you grant is read-only. First Officer can see transactions and balances. It cannot move money, open accounts, close accounts, redeem points, or make a purchase. There is no mode in which it can.
Our software never holds your credentials
You connect through your provider's own sign-in. Our software and AI tools never see, receive, or store your passwords, and we never ask you to send them in the thread. If anyone claiming to be First Officer asks for a password, it is not us.
Nothing moves without your approval
Applications, transfers, and bookings happen only after you say yes in writing, in your own thread. A recommendation is a recommendation until you approve it.
We do not sell or rent your data
Your information is not sold, rented, or shared with advertisers, data brokers, or card issuers for marketing. We take no affiliate commissions, so there is no incentive to steer you anywhere.
You can revoke at any time
Revoke any connection from the provider's own settings whenever you want, without telling us first. Access ends immediately. You can also ask us to delete your data at any point, and we will.
You choose how much we see. Each level is optional.
Three levels, and you can stop at any of them or step back down at any time. More access means better advice, and less access still works.
Screenshots only
What it reads: only the numbers in an image you choose to send. What it never reads: anything else. Nothing is connected to any account. This is the same as texting a balance to a colleague.
Email connection
What it reads: travel, rewards, and expense messages, so bookings, transfers, and expiring credits can be tracked. What it never reads: the rest of your inbox, and it never sends mail as you. Granted through your email provider's official sign-in and revocable there.
Card and spend connection
What it reads: transactions and balances, so the desk can route spend to the right card. What it never reads or stores: your login, your full card number, and your account credentials. Read-only, revocable from your bank or from Plaid at any time.
The companies that help run the desk, and why.
First Officer is a small operation built on established infrastructure. These are the services that may process your information, and the only reason each one does.
Database and application hosting
Where your profile, spend context, and history are stored, on managed Postgres infrastructure in the United States, encrypted at rest and in transit.
WhatsApp Business Platform
Delivers the messages in your thread. Meta handles message transport under its own terms, the same as any WhatsApp Business conversation.
AI processing
Powers the agents that read your spend and draft recommendations. Anthropic processes this data to return a response and does not use business API traffic to train its models.
Read-only card and bank connections
Handles the connection itself when you choose Level 3, so your credentials go to Plaid and your bank, never to us.
Payments
Processes your $550 monthly fee. Your card details go to Stripe directly. We never see or store a full card number.
Transactional email
Sends receipts and account email when message delivery is not the right channel.
Your data has an expiry date too.
While you are a client, we keep what we need to do the work: your spend context, your portfolio, and your thread history, so the desk does not ask you the same question twice. When you cancel, connections are severed immediately and your data is deleted within 30 days, except records we are required to retain for tax and accounting, which are held by Stripe under its own retention rules. You can request deletion at any time, including while you are still a client, and you can ask for a copy of what we hold.
What we will do, and how fast.
If we confirm a security incident affecting your information, we will tell you directly in your thread within 72 hours of confirming it, describe what happened in plain language, say what data was involved, and tell you what to do next. We will not wait for a press cycle and we will not bury it in an email footer.
Black box AI, or a glass box.
Most AI products hand you an answer and ask you to trust it. Ours shows its work, every time, because a recommendation you cannot check is just a confident guess.
Black box
An answer appears. No source, no chain of reasoning, no caveats. You either trust it or you do not, and you have no way to tell which you should do.
Glass box
An answer with the card rule it came from, the merchant code it depends on, the source it was pulled from and the date it was verified. If we cannot show the work, we do not send the recommendation.
You can audit us
Every claim is checkable, which means the desk cannot quietly drift into confident nonsense, and you never have to take our word for a number.
Built into the foundation from day one.
No credential storage
Connections are read-only, always. Our software and AI tools never see, collect or store passwords, card logins or banking credentials, and nothing moves without your written yes. The one exception is deliberate and human: when you engage the $500 award search, you work directly with a human specialist. They find the space; you claim it in your own account, which is the only place your points ever sit. Our software and AI layer is never in that loop.
Row level isolation
Every client's data lives in its own row, isolated at the database level. Patterns flow into the shared brain. Records never do.
No affiliate money
Nobody pays us to recommend a card. The only person who pays us is you, which is the only arrangement where our advice can be trusted.
What we do not claim.
We are not certified
First Officer does not hold SOC 2, ISO 27001, or any similar certification today. If that is a requirement for your business, tell us before you sign up.
We are not a financial advisor
We are an educational and advisory service for rewards and business spend. We are not a bank, lender, broker, or licensed financial, tax, or legal advisor.
We do not guarantee outcomes
Award availability, transfer bonuses, and issuer rules change without notice. We report what we actually capture, and we never promise a specific result in advance.
Read the full Privacy Policy, the Terms of Service, and the Do Not Sell My Info notice, or ask the desk anything on this page directly.
Your Competitors Route Their Spend. Do You?
A 20-minute spend check, in your messages. Your capture number, computed. An honest no if the math says no.
One real redemption, every weekday.
The newsletter behind the desk: what the desk booked on request, what it cost in points, and what it would have cost in cash. Free, and you can leave whenever you like.