CopyMyBooks
Privacy policy
Last updated October 18, 2026
- We only ever read a real QuickBooks company. We never change anything in it.
- A company's books are kept encrypted for at most 24 hours (usually 60 minutes after a copy), then deleted. Database backups, kept for a few days, can hold a copy until they expire, and a copy's result keeps the report totals it was checked against.
- We don't sell data, show ads, or use your data to train AI.
- The company's owner can stop our access at any time in QuickBooks.
Who we are
This policy covers CopyMyBooks (copymybooks.com), called "CopyMyBooks", "we" or "us" here. For anything about it, email [email protected].
What CopyMyBooks does
CopyMyBooks helps software developers who build apps for QuickBooks Online. With the company owner's approval, it reads a real QuickBooks company and copies it into a test company (a QuickBooks "sandbox") that belongs to the developer, so they can test against realistic books. Two kinds of people use it:
- Developers, who have a CopyMyBooks account and connect their sandboxes.
- Company owners (or their bookkeepers), who approve access to their company through a link the developer sends. CopyMyBooks only ever reads it. They don't need an account.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Developer's name, email address, profile picture, and the sign-in provider's ID for your account (to recognise you next time) | The sign-in provider you choose (Google, GitHub or Intuit) | To sign you in and run your account |
| Access to your QuickBooks sandboxes (tokens) | Intuit, when you connect a sandbox | To clear your sandbox and write copies into it |
| Access to an approved company (tokens), which CopyMyBooks uses only to read it | Intuit, when the company owner approves | To read the company when the developer makes a copy |
| The company's accounting records: lists (customers, vendors, products, accounts), transactions, reports, tax settings, and attached files if the developer chooses them | QuickBooks, read only | To make the copy the developer asked for |
| The email address a developer enters when sending a connect link | The developer | To send the invitation, and a receipt once access is approved |
| The protections the company owner chooses | The company owner | To apply them to every copy (see below) |
| Job history: what was copied, when, counts, and records QuickBooks refused (it can name individual records). Unless amounts were disguised, a copy's check also keeps the real company's report totals (income, expenses, assets and so on) it compared. | CopyMyBooks | To show the developer their results |
| Server logs: IP address, pages requested, errors, and sometimes a QuickBooks company's ID. | Your browser and our server | To keep the service running and secure |
How long we keep it
- A company's books, read for a copy: stored encrypted and deleted automatically 60 minutes after they are read or copied. The developer can extend that an hour at a time, but never past 24 hours from when the books were read. The developer can also delete them sooner.
- Access tokens: until the developer disconnects the company in CopyMyBooks or deletes their account. If the company owner removes CopyMyBooks in QuickBooks (Apps, then My apps), the tokens stop working at once and can no longer read anything; the stored copy of them is deleted when the developer disconnects.
- Accounts and job history: until you ask us to delete your account.
- Email addresses entered for a connect link: kept with that link's history until the developer's account is deleted.
- Backups of our database are kept for a short time, days rather than months, and can contain books stored in the hours before a backup was taken.
- Server logs are rotated automatically, and old ones are deleted, so they're kept only for a limited time.
Protections the company owner chooses
When approving, the company owner can require that every copy:
- disguises the names and contact details of customers, vendors and employees;
- makes email addresses undeliverable, so a test can never email the company's real customers;
- leaves out notes, memos, line descriptions, custom fields and attached files.
Disguising works on fields named as such; other free text and files aren't searched. The developer can't turn off a protection the owner required: changing it takes a new approval by an admin of the QuickBooks company.
Where the copy goes
A copy is written only into a QuickBooks sandbox the developer connected. Sandboxes are test companies in the developer's Intuit developer account, and Intuit's terms govern them. Once a copy is in the developer's sandbox, the developer is responsible for it.
Who we share it with
We don't sell or rent personal or company data, and we don't use it for advertising or to train AI models. We share it only with the services that run CopyMyBooks:
- Intuit: to read the approved company and write to the developer's sandbox.
- Microsoft 365: to send our emails.
- Cloudflare: our website's network and security provider.
- Our hosting provider: the server and database run there.
- Google, GitHub and Intuit: sign-in, if you choose them.
We may also disclose data if the law requires it.
Cookies and storage
We use no advertising or tracking cookies and no analytics. Signing in keeps a session token in your browser's local storage. Signing in with Google, GitHub or Intuit, and connecting to QuickBooks, each set a short-lived cookie (minutes) that makes sure the step finishes in the same browser that started it.
Security
Everything travels over HTTPS. Access tokens and stored books are encrypted at rest (AES-256-GCM). CopyMyBooks asks QuickBooks only to read a real company and never writes to it; writing happens only in sandboxes.
Your choices and rights
- Company owners can stop access at any time: in QuickBooks, open Apps, then My apps, and disconnect CopyMyBooks. Books already stored are still deleted on the schedule above, or sooner if you ask us.
- Anyone can ask to see, correct or delete the personal data we hold about them by emailing [email protected]. We answer promptly.
- Depending on where you live, local law may give you more rights over your data. Email us to use them.
Children
CopyMyBooks is a tool for businesses. It isn't meant for anyone under 18.
Changes
If we change this policy, we'll update the date above and, for important changes, email developers with an account.