BonusMaxx Privacy Policy

This Privacy Policy describes how Rainsend Labs LLC, a California limited liability company ("Rainsend Labs," "we," "us"), collects, uses, and shares information when you use the BonusMaxx mobile app, the bonusmaxx.app website, and related services (together, the "Service"). Rainsend Labs is the controller of this information.

The short version: we collect your linked-account transaction data through Plaid to recommend the best card for your spending; we store it with our database provider, Convex; we use privacy-conscious analytics (PostHog); our in-app Advisor sends your questions and card profile — never your name, email, or individual transactions — to Anthropic to generate answers. We never sell your personal information, and we never see or store your bank login credentials. You can disconnect banks or delete your account, and all associated data, at any time from within the app.

Questions: noah@rainsendlabs.com · Rainsend Labs LLC, 2108 N St., Ste. N, Sacramento, CA 95816

1. Information We Collect

Account information. You can use BonusMaxx anonymously or sign in with Apple or Google. When you sign in, we receive a unique account identifier and, depending on the provider and your choices, your name and verified email address. We use your email for account display and support only — it is never used as an advertising identifier or shared for marketing. We do not offer password accounts and never receive a password.

Profile and preferences. Information you enter during onboarding and use: first name, time zone, the cards you hold, spending categories and estimated monthly spend, optional travel preferences (such as home airport and destinations), an optional credit score range, and notification preferences.

Financial account data (via Plaid). When you link a financial account, we use Plaid Inc. to retrieve data from your financial institution. We request only transaction data (up to 24 months of history): transaction identifiers, amounts, dates, merchant names, pending status, and spending categories, along with the institution's name, the account's product name, and internal Plaid identifiers for the linked account and institution. We do not collect or store your bank username or password (those go directly from you to Plaid and your bank), account or routing numbers, account balances, or identity data from your bank. Plaid's access credential for your linked account is stored only in encrypted form (AES-256-GCM).

Advisor conversations. Questions you type to the in-app Advisor and the resulting conversation history (retained briefly — see Section 6).

Usage and device data. We use PostHog for product analytics: screens viewed, feature usage, onboarding progress, app lifecycle events, and app error reports, associated with your internal account ID and device information (model, OS version, app version) and IP-derived approximate location. Our analytics are engineered to exclude sensitive content: we do not send your transactions, merchant names, spending amounts, bank identifiers, email, or name to analytics, and session recording is disabled.

Push notifications. If you enable notifications, we store a push token and your device platform so we can send them.

Waitlist and support. If you join the waitlist on bonusmaxx.app, we collect your email address. If you contact us or send in-app feedback, we receive the contents of your message and your email if you provide it.

Website. bonusmaxx.app uses Cloudflare Web Analytics to measure aggregate page views and site usage. Cloudflare says this service does not use cookies, local storage, or fingerprinting for analytics. We also use PostHog on the website to measure pages viewed, the referring site or search engine you arrived from, approximate location derived from IP, browser and device details, and which links and buttons visitors click, including where on a page they click and how far they scroll. This uses cookies and local storage to recognize a repeat visit. Website analytics are not linked to any app account, we do not record website sessions, and PostHog never receives anything you type on the site. The site collects no personal information directly other than a waitlist email you choose to submit.

2. How We Use Information

We use the information above to: provide the Service — including matching transactions to your cards, tracking rewards and welcome-offer progress, and recommending which card to use; personalize recommendations and Advisor answers; send notifications you have enabled (such as bonus deadlines, posted fees, and expiring benefits); operate, debug, and improve the app; provide support; and comply with law. We do not use your information for third-party advertising, and we do not "track" you across other companies' apps or websites as defined by Apple's App Tracking Transparency framework.

3. AI Features (Anthropic)

Two features use large language models operated by Anthropic, PBC, called from our servers:

• Advisor chat: your question, recent conversation history, and relevant profile context — the cards you hold (product names, issuers, open dates, fees), spending categories and estimated spend, optional credit score range, travel preferences, issuer application standings, and aggregate figures derived from your transactions (such as total spending progress toward a bonus and aggregate credit usage) — are sent to Anthropic to generate the answer.
• Recommendation explanations and card matching: your preferences and, if you type a card name in manually, that text.

We do not send your name, email, account identifiers, bank credentials, individual transactions, or merchant history to Anthropic. Under our agreement with Anthropic, this data is used to generate responses to you, not to train Anthropic's models. The first time you open the Advisor, we ask for your permission before any of this context is shared; if you decline, the Advisor is unavailable but every other feature works normally.

4. How We Share Information

We share personal information only with service providers that process it on our behalf, under agreements that protect it to the same or an equal standard as this policy:

Provider	Role	What they process
Plaid Inc.	Bank connectivity	Your bank credentials (directly; never visible to us) and retrieved account/transaction data
Convex, Inc.	Database and backend hosting (US)	All Service data
PostHog, Inc.	Product and website analytics (US cloud)	Usage events, device data, internal account ID (app); page and click events (website)
Anthropic, PBC	AI responses (Section 3)	Advisor questions and card/profile context
Resend, Inc.	Transactional email	Waitlist and support email addresses
Expo (650 Industries)	Push notification delivery	Push tokens
Apple / Google	Sign-in	Authentication tokens
Cloudflare, Inc.	Website hosting and cookieless Web Analytics	Site requests, page and referrer URLs, browser and device details, and aggregate location data

We may also disclose information if required by law, to protect the rights, safety, or property of Rainsend Labs or others, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply until you are notified otherwise).

We do not sell or rent personal information to anyone, and we do not share it with data brokers, ad networks, or marketers.

5. Plaid

Plaid's collection and processing of your information is described in the Plaid End User Privacy Policy. When you link an account, Plaid presents its own consent flow describing the data being shared. You can view and manage every app connected through Plaid, or revoke access entirely, at my.plaid.com. When you disconnect a bank in BonusMaxx or delete your account, we instruct Plaid to sever the connection on their end as well.

6. Data Retention

• Transaction data: retained while the bank connection is active. When you disconnect a bank, its transactions and access credential are deleted promptly; your cards remain as manually-tracked cards and any bonus progress is frozen as a total.
• Advisor conversations: answer text is retained up to 7 days; conversation metadata up to 30 days.
• Account data: retained until you delete your account (Section 7).
• Analytics events: retained per PostHog's standard retention.
• Waitlist emails: until you unsubscribe or ask us to delete them.

7. Deleting Your Account and Your Choices

Account deletion is built into the app: Settings → Manage account → Delete account. When you delete your account, we immediately stop collecting new data and disconnect your linked financial accounts, including revoking Plaid's connection. Your account then enters a 30-day recovery window (sign back in to restore it), after which all your data — transactions, linked-account records, cards, conversations, push tokens, and your account itself — is permanently deleted from our systems, and we delete the associated analytics profile. You can also request deletion, or a copy or correction of your information, by emailing noah@rainsendlabs.com; we respond to verified requests within 30 days.

Other choices: disconnect any bank at any time in the app (Section 6); turn off push notifications in iOS Settings; update your profile and preferences in the app; unsubscribe from waitlist emails via the link in any email.

8. Security

Data is encrypted in transit (TLS) and at rest with our providers. Plaid access credentials are additionally encrypted at the application layer with AES-256-GCM, and we never possess your bank login credentials. No system is perfectly secure, but we design the Service to minimize what we collect in the first place — we don't store account numbers, balances, or credentials, and our analytics are stripped of financial content.

9. Your California Rights and Do Not Track

This policy is designed to satisfy the California Online Privacy Protection Act: Section 1 lists the categories of personal information we collect, Section 4 lists the categories of third parties we share it with, Section 7 describes how you can review and request changes to your information, Section 12 describes how we notify you of material changes, and the effective date appears at the top.

Rainsend Labs is a small company below every threshold that triggers the California Consumer Privacy Act (CCPA/CPRA), so its provisions do not currently apply to us — but we honor its spirit: we don't sell or share personal information for cross-context behavioral advertising, and we honor access, correction, and deletion requests from any user (Section 7).

Do Not Track: our website and app do not track users across third-party websites or services over time, and no third parties collect personal information about your activity across other sites through our Service. Because we don't track, we do not respond to browser "Do Not Track" or Global Privacy Control signals.

10. Children

The Service is for adults. You must be 18 or older to use BonusMaxx. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it. Contact us at noah@rainsendlabs.com if you believe a minor has provided us information.

11. United States Only

The Service is offered and directed only to residents of the United States, and our providers process data in the United States. If you access the Service from elsewhere, you understand your information will be processed in the US.

12. Changes to This Policy

We may update this policy as the Service evolves. For material changes, we will notify you in the app or by email at least 14 days before the changes take effect, and we will update the effective date above. Earlier versions are available on request.

13. Contact

Rainsend Labs LLC 2108 N St., Ste. N Sacramento, CA 95816 noah@rainsendlabs.com