One shop, one person, one connection

In plain words

It does: look at our shop and listings, change our listings when the owner asks, and read our own orders so we can pack and ship them.

It does not: reach into anyone else's shop, scrape Etsy, write to buyers, sell or hand over Etsy data, feed ad or marketing platforms, track visitors or train AI models on anything it reads.

The four permissions

shops_r

Tells the app which shop it is attached to.

listings_r

Lets it read titles, descriptions, prices and stock of our listings.

listings_w

Lets the owner update those listings from one screen instead of one at a time.

transactions_r

Lets it read our orders, so fulfilment is not done from memory.

What happens when the owner connects

1. The owner signs in on the private studio page with the site password.
2. A box must be ticked to accept the app terms and privacy policy. We save the moment and the terms version.
3. The browser is handed to Etsy using OAuth 2.0 with PKCE. Etsy shows the permissions above and asks for approval. Our site never sees the Etsy password.
4. Etsy returns the browser with a short-lived code, which the app swaps for tokens.
5. The tokens are encrypted with AES-256-GCM before they reach the database. The status page confirms the link but never shows a token.

Only the shop owner's Etsy account is accepted. If a different account approves the request, its tokens are discarded on the spot.

Switching it off

Press Disconnect on the studio page and the stored tokens are deleted immediately. You can also open the connected-apps page in your Etsy account settings and remove Cali Glass Art. Access ends the same second.

The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.