Privacy Policy

Effective: 2026-04-15

This policy describes how the private QuickBooks Online application "Charles Personal Books" (the "Application") handles data. The Application is operated solely by Charles Chen ("Operator") for personal bookkeeping purposes.

1. No Third-Party Users

The Application has no third-party end users. Only the Operator and the Operator's authorized representatives (e.g. the Operator's CPA) connect to the Application. No account creation, signup, or user enrollment occurs.

2. Data Accessed

When authorized via Intuit's OAuth flow, the Application may read and write bookkeeping records belonging to the Operator's own QuickBooks Online companies, including but not limited to:

Chart of accounts, journal entries, and transaction registers
Customer, vendor, employee, and contact records
Invoices, bills, payments, deposits, and receipts
Financial reports (Balance Sheet, P&L, General Ledger, Trial Balance, etc.)

3. Data Storage

All data retrieved from the QuickBooks Online API is stored exclusively on hardware owned and controlled by the Operator, with filesystem-level access restricted to the Operator. No data is uploaded to any cloud service other than Intuit's own servers from which it originates.

4. Data Sharing

Data accessed via the Application is not shared with, sold to, or transmitted to any third party. Data is not used for advertising, analytics, machine-learning training, profiling, or any purpose other than the Operator's own bookkeeping and tax-preparation workflow.

5. Third-Party Services

The Application uses only Intuit's published QuickBooks Online API. It does not integrate with any other third-party service that receives Operator data.

6. Security

OAuth tokens are stored in filesystem-permission-restricted files (mode 0600) on Operator-controlled systems. Access tokens are refreshed in accordance with Intuit's OAuth 2.0 specification. The Operator revokes access immediately upon loss of any authorized device.

7. Retention

Bookkeeping data is retained indefinitely for tax-record purposes, consistent with IRS guidelines for business-record retention (generally 7 years, longer in cases of substantial omission). Data is deleted upon permanent closure of the underlying business entity.

8. Your Rights

Because no third-party users exist, there are no data-subject requests to process. The Operator retains full control of all data accessed by the Application.

9. Changes

This policy may be updated. The effective date at the top of this page reflects the most recent update.

10. Contact

Questions should be directed to the Operator at qb.charleschen.ai/contact.