Privacy Policy

Last updated: 3 August 2026

This policy explains how MFD LABS LTD handles information through this website and Cozy for QuickBooks Online. Cozy is a private, single-user, read-only command-line tool used to access the company's own QuickBooks Online accounting data.

1. Who we are

MFD LABS LTD is a company registered in England and Wales under company number 11660751. We are the controller for personal data that we process through this website and the Cozy QuickBooks integration.

2. Information we access

When a QuickBooks Online company is connected, Cozy may access:

• Company information and the QuickBooks company identifier.
• The chart of accounts and account balances.
• Financial reports, including the trial balance, general ledger, profit and loss, balance sheet, cash flow, aged receivables and aged payables.
• OAuth access and refresh tokens required to maintain the connection.
• Limited diagnostic information, such as the requested report name, date range, API response status and error details.

Cozy does not ask for or store the user's QuickBooks password. The user signs in directly with Intuit and explicitly authorises the connection.

When you visit this static website, our hosting provider may process standard request information such as your IP address, browser type, requested page and timestamp. We do not run advertising, analytics or behavioural tracking on this website.

3. How we use the information

We use QuickBooks data only to:

• Display accounting records and reports requested by the authorised user.
• Prepare and review MFD LABS LTD's bookkeeping, annual accounts and tax compliance work.
• Maintain, diagnose and secure the QuickBooks connection.

We process this information because the authorised user requested the service, because it is necessary for our legitimate interest in maintaining the company's accounts, and where necessary to comply with legal obligations.

4. Local processing and storage

Cozy runs locally on the authorised user's Mac. OAuth tokens are stored in the user's macOS Keychain. Financial report responses are processed in memory and displayed in the terminal. They persist only when the user explicitly saves or imports the output.

The production OAuth callback page is hosted by Cloudflare Pages. It may receive standard request metadata and a short-lived Intuit authorisation code. The page does not exchange, analyse or store that code in an application database. The user copies the callback URL to the local Cozy process, which validates and exchanges the code directly with Intuit.

5. Sharing

We do not sell QuickBooks data, use it for advertising, share it with another customer or make it available through a public API. Information is shared only as necessary with:

• Intuit, to authenticate the user and provide QuickBooks Online API responses.
• Cloudflare, to host this website and the static OAuth callback page.
• Professional advisers, regulators or public authorities where required for the company's accounting, tax or legal obligations.

Intuit and Cloudflare process information under their own terms and privacy policies. Their infrastructure may process information outside the United Kingdom using the safeguards they describe in those policies.

6. Retention and deletion

• OAuth tokens remain in macOS Keychain until the connection is revoked, the token expires or the user deletes QUICKBOOKS_TOKEN_JSON from the Cozy vault.
• QuickBooks responses are not retained by Cozy unless the user deliberately saves or imports them. User-created files are kept until the user deletes them.
• Local diagnostic logs are retained under the user's control and can be deleted locally.
• Cloudflare may retain hosting logs according to its own retention policy.
• Records required for accounting, tax or legal purposes are retained for the period required by applicable law.

To request deletion of information controlled by MFD LABS LTD, email me@aluxian.com. We will delete it unless retention is required by law.

7. Security

We minimise the data accessed, use Intuit's OAuth 2.0 flow, make read-only QuickBooks API requests, store OAuth tokens in macOS Keychain and use HTTPS for internet traffic. No method of storage or transmission is completely secure, but we use measures proportionate to the private and local nature of the integration.

8. Your rights

Under UK data protection law, you may have rights to access, correct, erase, restrict or object to processing of your personal data, and to receive a portable copy where applicable. You may also withdraw consent where consent is the basis for processing.

Contact us first so we can resolve the request. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

9. Cookies

This website does not set advertising or analytics cookies. Our hosting provider may use strictly necessary technical measures to deliver and protect the site.

10. Changes

We may update this policy when the integration or legal requirements change. The date at the top identifies the current version.

11. Contact

Questions and privacy requests can be sent to me@aluxian.com.