Security & trust
Built carefully, with Etsy's rules in mind.
Your shops are your business. We designed the connection model around isolation and no surprises.
Only your own shops
We work only with the data of shops you authorize. No scraping, no private endpoints, no browser automation.
Owners authorize their own shop
Each shop is authorized separately by its own owner, so one shop's access never reaches another.
No Etsy passwords
You sign in on Etsy. We only receive the access Etsy grants for that shop.
Encrypted credentials
Shop access tokens are stored encrypted on our servers and are never sent to the browser.
Which Etsy permissions we ask for
When you connect a shop, Etsy's screen asks for these permissions. Each is used only for the job below:
- Read your Etsy account and your shop's basic details.
- Read your active, draft and inactive listings.
- Create, edit, publish and schedule listings when you ask it to.
- Read your orders and, for profit & loss, your Etsy payment account records (fees).
- Add tracking numbers to your orders.
Where your data is kept, and for how long
- When you disconnect a shop, its encrypted access tokens are deleted right away and its data within 30 days.
- Etsy also keeps the permission you gave in its own account settings; to remove it completely, remove it there too.
- When you close your account under Settings > Delete account, your account and your workspace's data are deleted immediately and permanently.
How your account is protected
- Email confirmation is required; you can also sign in with Google.
- You can turn on two-step verification with an authenticator app.
- The sign-up, sign-in and password reset forms are protected against bots by Cloudflare Turnstile.
- Your password is stored only as an irreversible hash; we cannot see it.
For the details, see the Privacy Notice.