Privacy Policy

Last updated: July 19, 2026

Cocci Bookkeeping ("Cocci," "we," "our") is a sole-proprietor bookkeeping cleanup practice operated by Asya Cocci. This policy describes how the Cocci Bookkeeping application (the "App") handles data when connected to a client's QuickBooks Online ("QBO") company.

The App runs locally, on the operator's own computer

The App is not a hosted service. It is installed and run entirely on the operator's own machine. There is no multi-tenant cloud backend, no shared database, and no server operated by Cocci Bookkeeping that stores client data. When the App connects to a client's QBO company, all data it reads — General Ledger entries, Trial Balance figures, account names, transaction detail — is processed and stored locally on that machine, in a local SQLite database file. That file, and the audit log within it, never leave the operator's computer as part of the App's normal operation.

What data the App accesses

Once a client (or the CPA firm on the client's behalf) grants access via QuickBooks Online's own OAuth authorization screen, the App reads:

• General Ledger report data (account, date, name, memo, amount, transaction type)
• Trial Balance report data (account balances, used to verify totals tie before and after any change)
• Chart of Accounts (account names, types, IDs)
• Individual transaction records (Bills, Purchases, Invoices, and similar) when a specific correction is being reviewed or applied

The App does not access QBO modules unrelated to its bookkeeping-cleanup purpose (e.g. payroll, time tracking) and requests only the accounting-scope OAuth permission needed to read the ledger and, with per-change operator approval, make the specific correcting entries the operator has reviewed.

What data the App writes back to QuickBooks Online

The App never writes to a client's books automatically. Every correction — voiding a duplicate transaction, for example — requires the operator's explicit, individual approval before it is sent to QuickBooks Online. There is no bulk-apply and no unattended write path. Every completed write is logged locally with a full snapshot of the transaction's state immediately before the change, so it can be reversed.

Where the OAuth connection code briefly passes through

QuickBooks Online's OAuth flow requires a hosted (non-localhost) redirect address for production application keys. Cocci Bookkeeping hosts a single static page at https://coccibookkeeping.com/oauth-callback.html for this purpose. That page performs no server-side processing: it is a static file whose only function is to forward the short-lived authorization code QuickBooks Online returns back to the App running on the operator's own machine, via the browser, over the same connection the operator is already using. The page stores nothing, logs nothing, and has no access to the application's client secret — the secret is held only on the operator's local machine, and the actual exchange of the authorization code for an access token happens there, not on this hosted page. The authorization code itself is single-use and expires quickly; possessing it without the separately-held secret does not grant access to any QuickBooks Online data.

What Cocci Bookkeeping does not do

• We do not operate a server that stores client financial data.
• We do not sell, share, or transmit client data to any third party.
• We do not use client data for any purpose beyond the specific bookkeeping-cleanup engagement it was authorized for.
• We do not retain access to a client's QuickBooks Online company beyond the engagement period; access can be revoked at any time from within QuickBooks Online's own connected-apps settings.

Data retention

Engagement records (findings, approvals, audit log, and locally-cached report data) are retained locally on the operator's machine for the duration of the engagement and afterward as part of the operator's professional recordkeeping practices. A client or firm may request deletion of locally retained data related to their engagement by contacting asya@coccibookkeeping.com.

Contact

Questions about this policy: asya@coccibookkeeping.com.