Legal
Privacy Policy
What changed on November 4, 2026
- The app's button for connecting is now called Connect to QuickBooks, as Intuit asks, and the app is called only BulkAuto.
- The saved connection on your computer now keeps the QuickBooks company ID encrypted too (from version 1.38.0). See section 6.
- Our sign-in service now keeps only a one-way fingerprint of each QuickBooks company ID it counts for trials and subscriptions, never the ID itself. See section 2.
- Disconnect beside a company kept in the app's company menu also ends its connection at Intuit (from version 1.38.0). See section 5.
What changed on November 1, 2026
- The policy is now provided by BulkAuto Ltd., a Colorado limited liability company, instead of Logan Noble.
- Subscribing and billing: you give payment details to Stripe on its own pages, never to us or the app; what Stripe tells us about your subscription. See section 2 and section 4.
- Read counts: the app tells the sign-in service how many times it read QuickBooks this month (a number, never what it read), so a subscription's reads can be added up across its computers. See section 2 and section 4.
What changed on October 28, 2026
- Files you attach to transactions: they're kept in the data folder only until you choose the next set, and are sent only to QuickBooks. See section 5.
- Update checks: the app asks GitHub, where new versions are published, whether there's a newer version. No QuickBooks data is sent, and you can turn it off. See section 4.
- The support file, which you create and send only if you choose: what it holds. See section 2.
- The data folder's name changed to BulkAuto.
- The app no longer takes your own Intuit app keys: every connection goes through our sign-in service. Keys an earlier version saved are removed from its settings the first time the new version opens.
- Trials and subscriptions: what the sign-in service keeps to count them (a random ID for your copy of the app, your license and the company ID numbers you connect). See section 2.
- A saved copy of the QuickBooks records you load, kept only on your computer so loading them again reads less from QuickBooks. See section 2 and section 5.
Earlier change (October 27, 2026): connecting through our sign-in service, Disconnect ending the connection at Intuit, and the Mac version.
In short
- BulkAuto runs on your computer. We don't operate servers that receive your QuickBooks data. When you connect to QuickBooks, a small sign-in service we operate briefly handles your connection tokens (see section 4); it never receives your QuickBooks data. Update checks send only the app's version.
- Your QuickBooks data goes only between your computer and Intuit, over encrypted connections.
- The app has no analytics, advertising or tracking, and we never sell or share your information.
- Everything the app stores stays in your user folder on your computer, and you can delete it at any time.
1.Who this covers
This policy explains how BulkAuto (the "app") handles information, and is provided by BulkAuto Ltd., a Colorado limited liability company and the developer of the app ("we," "us," or "our"). It applies to the desktop app and to this web page. It does not cover Intuit's services. Intuit's handling of your data is described in the Intuit Global Privacy Statement.
2.Information the app handles
The app handles only what it needs to do the work you ask for:
| Information | Examples | Source |
|---|---|---|
| Connection details | OAuth access and refresh tokens, QuickBooks company ID (realm ID) | Intuit, after you sign in and approve access (passed to the app through our sign-in service) |
| QuickBooks records | Time entries; invoices, bills, journal entries, expenses, purchase orders, estimates, deposits and payments; customers, vendors, employees, products and services, and accounts | Your QuickBooks company, when you load, scan, change or upload records |
| Files you choose | Spreadsheets (CSV) or backup files you upload, and lists you paste in (for example, copied from Excel) | Your computer |
| Files you attach | Receipts, signed estimates, PDFs and other files you attach to transactions | Your computer |
| Backups and logs | Copies of records before they are changed or deleted; results of each run, used for undo and the change log | Created by the app on your computer |
| Saved work | Upload column mappings and names you matched by hand; the last health scan; change logs you export | Created by the app on your computer |
| Subscription records | Kept by our sign-in service: a random ID for your copy of the app, your license (plan, seats, paid-until date; the license key only as a one-way fingerprint), a one-way fingerprint of each QuickBooks company ID connected (not the ID itself, and no names) and when each was last used, to count trials, seats and companies; and, from version 1.35.0, how many times each computer read QuickBooks this month (production and sandbox, as two numbers) | Sent by the app with each sign-in and renewal (from version 1.33.0) |
| Billing details | Kept by Stripe: your name, email, billing address and payment method. We receive only your email, Stripe's customer and subscription ID numbers, the plan, number of seats, status and paid-until date | Stripe, when you subscribe or change or cancel a subscription (from version 1.34.0) |
| Saved company copy | A copy of the QuickBooks records you've loaded (lists and transactions), so loading them again reads only what changed; on by default, and can be turned off in Settings | Your QuickBooks company, when you load records |
| Request log | Time, type and result of each QuickBooks request and Intuit's reference ID (intuit_tid), with no record contents; kept 3 months | Created by the app on your computer |
| Support file | Made only when you click Save a support file: the app version, settings without any secret, company names, which runs were made, the request log, and recent errors by kind, Intuit's error code and reference ID (never the error text, which can name records) | Created by the app on your computer; sent only if you attach it to an email yourself |
We do not collect your Intuit password. You sign in on Intuit's own pages, and the app receives only the tokens Intuit issues.
3.How it is used
The app uses this information only to connect to your QuickBooks company and do what you direct: loading, filtering, scanning and reviewing records, changing or deleting the records you confirm, creating the records you upload, undoing earlier runs, and saving backups, result logs and the reports you export. It is not used for advertising, profiling or any other purpose.
4.Where it goes
The app sends requests directly from your computer to Intuit over HTTPS, including Intuit's sign-in pages
(appcenter.intuit.com), its token service (oauth.platform.intuit.com) and the QuickBooks
Online API (quickbooks.api.intuit.com, or the sandbox equivalent). Inside your computer, the app's
window talks to its own built-in service, which only accepts connections from that same computer.
Connect to QuickBooks. When you connect, your browser goes through our sign-in service
(bulkauto-broker.timetool.workers.dev, or qbo-time-tool-broker.timetool.workers.dev in
versions before 1.26.1) to Intuit's sign-in pages. After you approve access,
Intuit sends a one-time sign-in code to the service. The service exchanges it for your connection tokens using our
Intuit app's credentials, holds them for at most 5 minutes until the app collects them, and then deletes them.
When the access token is renewed (about every hour) and when you disconnect, the app sends the refresh token to the
service, which passes it to Intuit and returns the result without storing it. The service never receives your
QuickBooks data, and it doesn't log tokens, codes or the contents of requests. It runs on Cloudflare (Cloudflare,
Inc.), which processes these connections for us. Every connection goes through the sign-in service; the app no longer
offers a way to connect with your own Intuit app keys.
Files you attach to transactions go from your computer to QuickBooks, linked to the transactions you choose, and nowhere else.
Update checks. Versions of the app that check for updates ask GitHub (github.com and its
download servers), where we publish new versions, whether a newer one exists: when the app opens and about once a
day. The request carries the app's version and the details any web request carries, such as your IP address,
which GitHub handles under the GitHub
General Privacy Statement. No QuickBooks data, company names or sign-in details are sent. A new version is
downloaded only after you agree, and you can turn update checks off in Settings.
Trials and subscriptions. With each sign-in and renewal the app also sends the sign-in service a random ID for your copy of the app and your license key if you entered one; the service records the QuickBooks company ID numbers you connect and when, and nothing about what's in them. From version 1.35.0 it also sends how many times the app has read QuickBooks this month (two numbers: real and sandbox companies), so the app can show your plan's reads used across all its computers, and so we can keep the whole app within Intuit's limits. It never sends what was read, company names or any record. See section 5 for how long.
Subscribing and billing. Subscribe and Manage billing open Stripe's checkout and billing pages
(checkout.stripe.com and billing.stripe.com) in your browser. You enter your payment
details there, with Stripe, not with us or the app. Subscriptions are sold through Stripe's Managed Payments service,
so Stripe and its affiliate that sells the subscription handle your payment and billing details under the
Stripe Privacy Policy. Stripe then tells
our sign-in service the billing details listed in section 2, so the app can show your plan, and the service passes
the app's random ID to Stripe so the subscription reaches the computer that bought it. No QuickBooks data is sent to
Stripe.
Apart from the connection tokens our sign-in service passes through, these subscription and billing records and the update checks, as described above, no information is sent to us or to any other third party. If you email us, we receive whatever you choose to include in your message, such as a support file, and use it only to reply.
5.Storage and retention
The app stores your settings, connection details, backups and logs in your user profile, at
%APPDATA%\BulkAuto on Windows or ~/Library/Application Support/BulkAuto on a Mac.
(Versions before 1.26.2 used a folder named after the app's former name; newer versions rename it to BulkAuto the
first time they open.) You can open this folder from the app (File → Open data folder). The data
stays there until you delete it:
- Disconnect in the app, for the current company or beside a company kept in the company menu, removes that company's saved connection and ends the connection at Intuit.
- Our sign-in service keeps a sign-in for at most 10 minutes and the tokens from it for at most 5 minutes, and keeps nothing once the app has collected them. Renewals and disconnects pass through without being stored.
- Subscription records (section 2) are kept while you have a trial or subscription, and for up to 12 months after it ends, so a returning customer's trial isn't repeated. Email us to have yours deleted sooner.
- Files you attach are copied into the data folder while you set them up, and stay there until you choose the next set of files, which replaces them.
- The saved company copy stays in the data folder's
copiesfolder and is updated with what changed each time you load. Read everything again (in the app's company menu or Settings), turning the copy off, or Disconnect deletes it. - Deleting the folder removes all settings, tokens, backups and logs.
- Uninstalling the app leaves this folder in place, so backups are not lost by accident. Delete it yourself if you no longer need it.
Data in your QuickBooks company is kept by Intuit under your agreement with Intuit.
6.Security
All communication with Intuit uses encrypted HTTPS connections. Access tokens expire after about an hour and are refreshed automatically. Our Intuit app's client secret is held in Cloudflare's encrypted secret store, and your computer never receives it. The sign-in link in your browser carries only a one-way fingerprint of a secret the app keeps, so no one else can collect your sign-in. The saved QuickBooks connection, including the QuickBooks company ID, is encrypted using your operating system's protection (Windows' data protection, or the Keychain on a Mac), so only your user account on that computer can read it, and access tokens are kept in memory only, never written to disk. Backups and logs are protected by your user account's file permissions. Protect them by using an account password, keeping your computer updated and using full-disk encryption (such as BitLocker on Windows or FileVault on a Mac). Only install the app on computers you trust. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
7.Sharing and sale
We do not sell, rent, share or disclose your information to anyone, and we do not use it for targeted advertising. We do not hold your QuickBooks data. Our sign-in service handles your connection tokens only briefly, as described in section 4, and does not keep them, so we cannot disclose them. We use Cloudflare, Inc. to host the sign-in service; it processes the connections for us under its own security and privacy terms. Subscription payments are handled by Stripe, Inc. and its affiliates, as described in section 4.
8.Cookies and tracking
The app does not use analytics, tracking pixels, advertising identifiers or crash reporting. Its built-in browser keeps ordinary local storage and cache files in the data folder so the app can run. Intuit's sign-in pages may set their own cookies, which Intuit's privacy statement covers. This web page adds no cookies or analytics of its own. It loads fonts from Google Fonts, which receives your browser's standard request information, and the service hosting the page may set cookies under its own policy.
9.Your choices and rights
- Revoke access. You can disconnect the app in QuickBooks Online from the apps you've connected to your company, and Disconnect it in the app. After that, the app can no longer reach your company.
- Delete local data. Delete the data folder (section 5) at any time.
- Privacy laws. Depending on where you live (for example, under the Colorado Privacy Act, the California Consumer Privacy Act or the GDPR), you may have rights to access, correct, delete or move personal data, and to opt out of its sale or use for targeted advertising. We do not sell personal data or use it for targeted advertising. Because we do not hold the data the app processes (our sign-in service only passes connection tokens through), requests about QuickBooks data should go to whoever controls that QuickBooks company, or to Intuit. For anything we do hold, such as an email you sent us, contact us and we will respond within the time the law requires.
10.Employee and customer data
QuickBooks records, such as time entries, can include personal information about employees, contractors and customers, such as names, hours worked and work descriptions. If you use the app with that data, you are responsible for having a lawful basis to process it and for any notices your employees or customers are owed. The app processes it only on your computer and only as described in this policy.
11.Children
The app is a business tool and is not directed to children under 16. We do not knowingly collect information from children.
12.Changes
We may update this policy, for example if the app gains new features. The effective date at the top shows when it last changed. If a change materially affects how the app handles your information, we will note it on this page before the change applies to new versions of the app.
13.Contact
Questions or requests about this policy: