Legal
Privacy policy
Cracksoft operates a private integration that connects its operator's own QuickBooks Online company to a locally running MCP server. This policy explains the limited processing associated with that integration and this website.
Who is responsible
Cracksoft is responsible for the processing described here. Privacy questions can be sent to mark@cracksoft.dev.
Information processed
During OAuth authorization, the callback endpoint processes a short-lived authorization code, a state value and a QuickBooks company identifier supplied by Intuit. The endpoint immediately redirects that information to a callback server on the operator's own computer.
The local MCP server may retrieve accounting records, customers, suppliers, invoices, bills, payments, reports and related company information as directed by the operator.
How information is used
Information is used only to authenticate the private integration and perform actions requested by the operator against Cracksoft's own QuickBooks company.
Storage and retention
This website does not intentionally persist OAuth authorization codes, QuickBooks tokens or QuickBooks accounting data in an application database. Long-lived OAuth credentials are stored locally on the operator's computer until replaced, revoked or deleted.
Long-lived OAuth credentials stored by the local MCP server are encrypted at rest with a key held in a separate local file. Cloudflare may retain limited network and security logs according to its service configuration and policies.
Service providers
- Intuit provides QuickBooks Online and OAuth authorization.
- Cloudflare provides DNS, TLS, website hosting and callback request processing.
- The operator's chosen MCP client or AI provider may process QuickBooks results when the operator submits a request through that service.
Legal basis and disclosure
Processing is undertaken for Cracksoft's legitimate business interests in administering its own accounting records and, where applicable, with the authorization of the QuickBooks account holder. Information is not sold. It may be disclosed when required by law or when necessary to protect the security of the service.
Security
The public callback uses HTTPS. OAuth state validation is performed locally. The callback is stateless, and local token files use restricted permissions. No online service can be guaranteed completely secure.
Your rights
Depending on applicable law, individuals may have rights to access, correct, erase, restrict or object to processing of their personal information. Contact mark@cracksoft.dev to make a request.
Changes
This policy may be updated when the integration or applicable requirements change. The effective date above will be revised when material changes are made.