What we access

What Mugavi can see in your books, and what it does with it.

Before you connect Xero or QuickBooks, you should know exactly what you are agreeing to. This page lists the permissions Mugavi asks for, what it reads, the one thing it can write back, what it keeps, and how to take it all away again. It was checked against the code on October 11, 2026.

The permissions we ask for

Xero

These are the exact permissions (Xero calls them scopes) on the Xero sign-in screen.

Permission	What it is for
openid profile email	Who connected: the name and email of the Xero user who clicked Connect.
accounting.invoices.read	Invoices and credit notes. Read only: Mugavi cannot create or change an invoice in Xero.
accounting.contacts	Your contacts. Xero grants read and write with this permission; Mugavi only reads contacts and never changes them.
accounting.payments	Payments. Read and write. Used to record a payment against an invoice when your customer pays that invoice in full through Mugavi (see below).
offline_access	Lets the connection keep working without you signing in to Xero every time.

Mugavi does not ask Xero for bank transactions, payroll, reports or files.

QuickBooks Online (beta)

Permission	What it is for
com.intuit.quickbooks.accounting	Your accounting data. Intuit offers one permission for this, and it allows more than Mugavi uses. The list below is everything the code actually reads.

What Mugavi reads

From Xero

Contacts: name, email address and a phone number.
Invoices: number, customer, total, amount paid, currency, issue date, due date and status. Line items are not kept.
Credit a customer has not used yet: credit notes, overpayments and prepayments with credit remaining. Mugavi uses this to stop chasing a customer whose credit covers what they owe.

From QuickBooks

Customers: name, email address and phone number.
Invoices with a balance: number, customer, total, balance, dates, currency, whether QuickBooks has emailed it, and the private note. Mugavi keeps the number, amounts, dates, currency and status.
Credit memos that still have a balance, and payments that have an amount not yet applied to an invoice.
Your company settings, to find your home currency.

Mugavi reads from your books when you press Sync now on the Integrations page. There is no background sync running on a timer today.

What Mugavi writes back

One thing only. If your customer pays an invoice in full through the Stripe card checkout on Mugavi's payment page, Mugavi records that payment against the same invoice in Xero or QuickBooks, so your books match. That checkout is not switched on today, so in practice nothing is written back yet.

Mugavi never creates, edits or deletes invoices, customers or contacts in your accounting software.
Late fees you apply in Mugavi stay in Mugavi. They are not written to your invoices.
A promise to pay or a dispute your customer records on the payment page stays in Mugavi.

What we keep, and for how long

What is kept: the customer and invoice details listed above, the credit totals per customer, the reminders that were drafted and sent, customer replies, and an activity log of key actions.
For how long: for as long as your account exists. Nothing is deleted on a timer.
Disconnecting stops the sync and deletes the connection tokens. Customers and invoices already imported stay until you remove them.
Remove imported data: after you disconnect, the Integrations page shows what that sync left behind and removes it when you confirm. Anything you typed in yourself stays. The owner or an admin can do this.
Deleting your account (owner, from Settings) asks Xero or Intuit to revoke our access, then removes your customers, invoices, payments, reminder history and connections. We keep one line saying the account was deleted: its name, its id and the date.
Export: before you go, Settings gives you a ZIP of CSV files with your customers, invoices, reminders and what each customer owes.

How the connection is protected

The access and refresh tokens Xero or Intuit give us are encrypted with AES-256-GCM before they are saved, with a fresh random value for each one. The key lives in our hosting environment, not in the database or the code. A connection saved before encryption was switched on is rewritten encrypted the next time its token is refreshed.
Connecting starts with a single-use, time-limited check tied to your signed-in session, so nobody can attach their books to your organization, or yours to theirs.
Tokens are never shown in the app, never put in an export, and never sent to the AI that drafts reminders.

More on hosting, sign-in and what we will not do with your data is on the security page.

How to take access away

In Mugavi, open Integrations and press Disconnect. Mugavi asks Xero or Intuit to revoke its access and deletes the tokens it holds. If the provider cannot be reached, our copy is still deleted and the app tells you so.
You can also do it from the provider's side at any time, without signing in to Mugavi: in Xero, remove Mugavi from Connected apps in your organisation settings; in QuickBooks, remove it from the connected apps list in your Intuit account. The next time Mugavi tries to use the connection it marks it as needing to reconnect, and holds reminders for that book rather than chasing from old data.

Nothing reaches your customers until you approve it

Reading your books does not send anything. Every new account starts with approval on: each reminder waits in the approval queue until you approve it, and a reminder you send by hand has 30 seconds to Undo. You can switch approval off for a book if you want reminders to go on their schedule; that is your choice, never the default. Statements and late fees always wait for you.

Something here unclear, or missing? Email security@getcollectly.app. See also what works today and the privacy policy.

Loading…

Permission

What it is for

openid profile email

Who connected: the name and email of the Xero user who clicked Connect.

accounting.invoices.read

Invoices and credit notes. Read only: Mugavi cannot create or change an invoice in Xero.

accounting.contacts

Your contacts. Xero grants read and write with this permission; Mugavi only reads contacts and never changes them.

accounting.payments

Payments. Read and write. Used to record a payment against an invoice when your customer pays that invoice in full through Mugavi (see below).

offline_access

Lets the connection keep working without you signing in to Xero every time.

Permission

What it is for

com.intuit.quickbooks.accounting

Your accounting data. Intuit offers one permission for this, and it allows more than Mugavi uses. The list below is everything the code actually reads.

Nothing reaches your customers until you approve it