Obviously if you are using a Mint-like application where it's clear you are sharing your transaction history then it should be expected, but on RH there is no o

Obviously if you are using a Mint-like application where it's clear you are sharing your transaction history then it should be expected, but on RH there is no obvious utility to sharing transaction data when linking a bank account only serves to transfer money in and out of a brokerage account. As far as I can tell, a single Plaid token enables a developer to "turn on" any endpoint they offer without consent from the user, so even if RH does not pull transaction history now (I would like confirmation from them directly) they've obviously written their PP in a way that lets them flip a switch anytime they want without anyone knowing. Plaid is an interesting company from a developer POV, but it's clear to me they've taken the early FB approach to their API and have extremely little control or visibility into what developers are doing with the data. They also do not show a confirmation screen with the data elements they're asking for from the customer before confirmation. I hope they get their act together before we see them in the news because someone bought Plaid transaction data from millions of customers to target ads for the 2020 election. Purchase history on millions of voters would be incredibly powerful (even more so than likes IMO) as far as targeting goes.