hanabanana

Privacy Policy

Effective October 4, 2026 · Last updated October 4, 2026

This policy explains how Aurum Days LLC (“we”, “us”) collects, uses, shares, keeps and protects information in thehanabanana (the “App”), available at www.thehanabanana.com.

The App is an internal bookkeeping tool. Only Aurum Days LLC's owner uses it, to keep the company's own books. It is not offered to the public and does not accept new users.

1. Information we collect

  • Financial account information, through Plaid. When the owner connects one of the company's business bank or credit card accounts, we receive:
    • for each account: its name, type, last four digits and current balance
    • for each transaction: the date, amount, description, merchant name, the bank's category, how it was paid, and the names of other parties to it
  • What we never receive. Bank usernames and passwords go directly to Plaid and the bank. From Plaid we don't request full account or routing numbers, identity details, or investment data. We can't initiate payments or move money.
  • Information the owner enters: categories, notes, categorization rules, manual entries (such as business costs paid personally, mileage trips and adjustments between categories), a description of the business, reminders, and settings.
  • Transactions the owner imports from a file: history exported from the owner's previous bookkeeping app (Wave) or downloaded from a bank or card website as a CSV file. The file is read in the owner's browser and is never uploaded or stored; only the transactions in it (date, amount, description, payee, memo, and the category it had there) and the file's name are saved.
  • Statement checks: the dates and opening and closing balances of bank and card statements the owner types in to check the books against them, and statement copies the owner attaches (stored encrypted, not read by AI).
  • Documents the owner uploads: photos or PDFs of receipts, and tax forms the owner received (such as W-2s and 1099s). Tax forms can show Social Security numbers, so every uploaded file is stored encrypted. Only dollar amounts, dates and payer or merchant names are read out of them; Social Security and taxpayer ID numbers are never copied out or written onto the forms the App prepares. The owner can also keep other tax records here (copies of filed returns, IRS or state letters, payment confirmations, 1099s sent to contractors); those are stored encrypted and are not read by AI.
  • Tax payments and filings the owner tracks: amounts, dates and confirmation numbers of estimated tax payments and state filings (sales tax returns, LLC tax), and the company's seller's permit number.
  • Tax profile the owner enters: name, business address, employer identification number (if any), filing status, and facts like home-office square footage and vehicle mileage, used to fill in the owner's tax forms.
  • Sign-in information: a signed session cookie, an encrypted two-factor secret, and hashed recovery codes. When a sign-in is approved from the owner's phone, we briefly record the requesting device's IP address and browser type so the owner can recognize it. These records are deleted after one day.
  • A record of sign-ins: for each device that signs in, the time, its IP address and browser type, and how the second step was done, so the owner can see where the App is signed in and sign a device out. We also keep a daily count of wrong sign-in tries (the count only: no addresses, and nothing that was typed). If the owner adds a passkey, we keep its public key and the name the owner gives it; the private part of a passkey never leaves the owner's device.
  • Technical logs: our hosting provider records standard request logs (IP address, browser type, page requested, time) for security and troubleshooting.
  • Cookies: only the cookies needed to sign in. We use no analytics, advertising or tracking cookies.
  • Information about other people: transaction descriptions can include the names of customers, vendors or others who paid or were paid by the company. We use these only to keep the company's books.

2. How we use information

  • To categorize the company's transactions and produce its profit and loss and tax reports for its accountant.
  • To match receipts to transactions and to fill in official IRS forms (downloaded from irs.gov) for the owner to review and file.
  • To keep the App secure and working.
  • To meet legal, tax and record-keeping obligations.

We do not sell or rent information. We don't use it for advertising or share it for marketing, and we don't use it to make automated decisions about any individual.

3. How we use Plaid

We use Plaid Inc. (“Plaid”) to gather data from financial institutions. By connecting an account through the App, you grant Aurum Days LLC and Plaid the right, power and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored and processed by Plaid in accordance with the Plaid End User Privacy Policy.

You can see and revoke the connections Plaid holds for you at my.plaid.com.

4. Who we share information with

We share information only with the service providers that run the App, and only as needed to run it:

  • Plaid Inc.: connects to financial institutions and provides account and transaction data (see section 3).
  • Railway Corporation: hosts the App and its database in the United States.
  • Anthropic, PBC: suggests a category for each new transaction, and reads receipts and tax forms the owner uploads.
    • We send the transaction's date, amount, description, merchant, bank category (or, for an imported transaction, the category it had in the owner's previous app), and the account's name and type.
    • For an uploaded receipt or tax form, we send the file so its amounts, dates and payer can be read. We ask only for those, never for Social Security or taxpayer ID numbers.
    • We never send account numbers, balances or sign-in information.
    • Under Anthropic's commercial terms, this data is not used to train its models.
  • The company's accountant: receives reports, filled forms and tax documents the owner exports for tax preparation.
  • Nothing is sent to the IRS by the App. It only downloads blank public forms from irs.gov; the owner (or the accountant or tax software) files the return.

We may also disclose information when required by law or legal process, or to protect our rights. If the company or its business were sold, information would transfer subject to this policy.

5. How long we keep information

  • Transaction records (including imported ones), receipts, uploaded tax forms, other tax records, statement checks and tracked tax payments are kept as business and tax records for 7 years (from the transaction, receipt, statement or payment date, or the end of the tax year). After that, the App deletes them automatically. The owner can delete any uploaded file, statement check or import sooner.
  • Completed reminders are deleted after two years.
  • The record of a sign-in is deleted 90 days after that sign-in ends (after 30 days, or when the owner signs the device out), and the daily counts of wrong tries after 90 days. A passkey is kept until the owner removes it.
  • Disconnecting an account stops Plaid from sending new data and revokes the App's access at Plaid.
  • The owner can also delete a connection and everything imported from it at any time.
  • Hosting logs are kept according to our hosting provider's retention schedule.
  • Encrypted backups of the database are kept for up to about three months, so information deleted from the App disappears from backups as they expire.

6. How we protect information

  • All connections are encrypted with TLS 1.2 or higher.
  • The database is encrypted at rest, and bank connection tokens are separately encrypted with AES-256-GCM.
  • Signing in requires a password and a second step: a one-time code from an authenticator app, a passkey on the owner's device, or approval from the owner's already signed-in phone. Only one person has access.
  • Before a tax document is opened, the full tax package is downloaded, or a bank connection is deleted, the App asks for the second step again unless it was done in the last 15 minutes.
  • The database isn't reachable from the public internet.
  • Software dependencies are scanned for known vulnerabilities every week.

No system is perfectly secure. If a breach affects your information, we'll notify you as required by law.

7. Your choices and rights

If your name or other details appear in the company's transactions, you can ask us what we hold about you, or ask us to correct or delete it. Email kim.seomarketing@gmail.com. We'll respond within 45 days.

We may need to keep some records to meet tax and legal obligations. Depending on where you live, privacy laws may give you additional rights. We honor them as those laws require, and we won't treat you differently for using them.

8. Children

The App is not directed to children, and we don't knowingly collect information from anyone under 13.

9. Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top. We'll highlight any significant changes on this page.

10. Contact

Aurum Days LLC
kim.seomarketing@gmail.com