CopyMyBooks
Privacy policy
Last updated October 23, 2026
- We only ever read a real QuickBooks company. We never change anything in it.
- A company's books are kept encrypted for at most 24 hours (usually 60 minutes after a copy), then deleted. Database backups, deleted automatically (nightly ones after 4 days), can hold a copy until they expire, and a copy's result keeps the report totals it was checked against.
- We don't sell data, show ads, or use your data to train AI.
- The company's owner can stop our access at any time in QuickBooks.
Who we are
This policy covers CopyMyBooks (copymybooks.com), called "CopyMyBooks", "we" or "us" here. For anything about it, use our contact form.
What CopyMyBooks does
CopyMyBooks helps software developers who build apps for QuickBooks Online, and accountants and bookkeepers who want to try changes to the books on a copy first. With the company owner's approval, it reads a real QuickBooks company and copies it into a test company (a QuickBooks "sandbox") that belongs to the developer, so they can test against realistic books. Two kinds of people use it:
- Developers, who have a CopyMyBooks account and connect their sandboxes.
- Company owners (or their bookkeepers), who approve access to their company through a link the developer sends. CopyMyBooks only ever reads it. They don't need an account.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Developer's name, email address, profile picture, and the sign-in provider's ID for your account (to recognise you next time) | The sign-in provider you choose (Google, GitHub or Intuit) | To sign you in and run your account |
| Access to your QuickBooks sandboxes (tokens) | Intuit, when you connect a sandbox | To clear your sandbox and write copies into it |
| Access to an approved company (tokens), which CopyMyBooks uses only to read it | Intuit, when the company owner approves | To read the company when the developer makes a copy |
| The company's accounting records: lists (customers, vendors, products, accounts), transactions, reports, tax settings, and attached files if the developer chooses them | QuickBooks, read only | To make the copy the developer asked for |
| The email address a developer enters when sending a connect link | The developer | To send the invitation, and a receipt once access is approved |
| The protections the company owner chooses | The company owner | To apply them to every copy (see below) |
| Job history: what was copied, when, counts, and records QuickBooks refused (it can name individual records). Unless amounts were disguised, a copy's check also keeps the real company's report totals (income, expenses, assets and so on) it compared. | CopyMyBooks | To show the developer their results |
| Server logs: IP address, pages requested, errors, and sometimes a QuickBooks company's ID. | Your browser and our server | To keep the service running and secure |
| Messages you send through our contact form: your email address, your name if you give it, the topic and what you write | You | To answer you |
How long we keep it
- A company's books, read for a copy: stored encrypted and deleted automatically 60 minutes after they are read or copied. The developer can extend that an hour at a time, but never past 24 hours from when the books were read. The developer can also delete them sooner.
- Access tokens: until the developer disconnects the company in CopyMyBooks or deletes their account. If the company owner removes CopyMyBooks in QuickBooks (Apps, then My apps), the tokens stop working at once and can no longer read anything; the stored copy of them is deleted when the developer disconnects.
- Accounts and job history: until you ask us to delete your account.
- Email addresses entered for a connect link: kept with that link's history until the developer's account is deleted.
- Backups of our database are deleted automatically: nightly backups after 4 days, and the few taken just before an update of CopyMyBooks once later updates replace them. A backup can contain books stored in the hours before it was taken.
- Server logs are rotated automatically, and old ones are deleted, so they're kept only for a limited time.
- Contact form messages: in our mailbox for as long as we need them to answer you and follow up, and deleted when you ask.
Protections the company owner chooses
When approving, the company owner can require that every copy:
- disguises the names and contact details of customers, vendors and employees;
- makes email addresses undeliverable, so a test can never email the company's real customers;
- leaves out notes, memos, line descriptions, custom fields and attached files.
Disguising works on fields named as such; other free text and files aren't searched. The developer can't turn off a protection the owner required: changing it takes a new approval by an admin of the QuickBooks company.
Where the copy goes
A copy is written only into a QuickBooks sandbox the developer connected. Sandboxes are test companies in the developer's Intuit developer account, and Intuit's terms govern them. Once a copy is in the developer's sandbox, the developer is responsible for it.
Who we share it with
We don't sell or rent personal or company data, and we don't use it for advertising or to train AI models. We share it only with the services that run CopyMyBooks:
- Intuit: to read the approved company and write to the developer's sandbox.
- Microsoft 365: to send our emails and receive messages from our contact form.
- Cloudflare: our website's network and security provider.
- HostPapa: our hosting provider. The server and database run on its machines in the United States.
- Google, GitHub and Intuit: sign-in, if you choose them.
We may also disclose data if the law requires it, to protect anyone's rights or safety, or as part of a sale or reorganization of the business (the buyer would be bound by this policy).
CopyMyBooks runs in the United States, so data is processed and stored there, wherever you are.
Cookies and storage
We use no advertising or tracking cookies and no analytics. Signing in keeps a session token in your browser's local storage. Signing in with Google, GitHub or Intuit, and connecting to QuickBooks, each set a short-lived cookie (minutes) that makes sure the step finishes in the same browser that started it.
Security
Everything travels over HTTPS. Access tokens and stored books are encrypted at rest (AES-256-GCM). CopyMyBooks asks QuickBooks only to read a real company and never writes to it; writing happens only in sandboxes.
Your choices and rights
- Company owners can stop access at any time: in QuickBooks, open Apps, then My apps, and disconnect CopyMyBooks. Books already stored are still deleted on the schedule above, or sooner if you ask us.
- Anyone can ask to see, correct or delete the personal data we hold about them through our contact form (choose "My data or privacy"). We answer within 30 days, and may need to confirm who you are first.
- California: you have the right to know what personal information we hold about you, to have it corrected or deleted, and not to be treated differently for asking. We don't sell or share personal information for advertising.
- European Union and United Kingdom: we use developers' data to provide the service they signed up for, and company books on the basis of our legitimate interest in making the copy the company's owner approved. You can also object to our use of your data, ask us to restrict it, or ask for a copy in a portable form, and you can complain to your local data protection authority.
- Wherever you live, local law may give you other rights over your data. Contact us to use them; we won't treat you differently for doing so.
Children
CopyMyBooks is a tool for businesses. It isn't meant for anyone under 18.
Changes
If we change this policy, we'll update the date above and, for important changes, email developers with an account before the change takes effect.