Trust center
Security & Data Isolation
Etsy Open API v3 authorization
The proposed connection uses Etsy Open API v3 and the OAuth authorization-code flow. Etsy requires PKCE.
Etsy recommends state; LocalShopOps additionally requires its own short-lived, single-use,
request-bound state value. LocalShopOps does not collect Etsy passwords. Shared secrets, PKCE verifiers, and
tokens must not enter browser scripts, plaintext desktop configuration, or ordinary logs.
Proposed central service
Production is designed to use a dynamic HTTPS callback on the centrally operated U.S. service, exactly registered with Etsy. Protected server-side components will validate state and PKCE context, exchange the authorization code, and keep tokens in protected encrypted storage. The production endpoint, storage configuration, backup and logging boundaries remain subject to review and verification. A localhost development test does not establish this production deployment, and shop-computer tokens are not a migration or onboarding method.
Local synthetic testing and a separately completed, controlled OAuth handshake are distinct evidence. That handshake ended with immediate token clearance and no resource or write calls; it does not prove persistent custody, real resource reads, production revocation, or production cleanup.
Seller and shop boundaries
- Production connections are designed to be bound to the LocalShopOps organization and shop identified by each authorization.
- OAuth tokens, shop data, orders, listings, jobs, exports, permissions, and audit records are designed to remain organization- and shop-scoped.
- Authorization checks are required before shop data is displayed or an operation is performed.
- LocalShopOps does not provide cross-seller search, cross-shop listing copying, or multi-shop listing edits.
Minimum access
LocalShopOps will request only permissions required by an approved and enabled function. The proposed first
release includes authorized-shop receipt and transaction review, subject to a separate read Gate. Listing writes
and image upload remain subject to separate write Gates. No fixed production scope set is published here. Access
to buyer_email and listing deletion are outside the current product boundary.
Data use restrictions
Etsy data processed by LocalShopOps is used only to provide the service requested by the authorizing seller. It is not:
- sold or exchanged;
- shared with another seller;
- used for third-party advertising;
- used for cross-seller benchmarking, marketplace analytics, or competitive analysis;
- used to train artificial intelligence or machine-learning models; or
- obtained by scraping Etsy webpages.
Seller-controlled Production files
An authorized LocalShopOps account user may generate and download a shop-specific Production file containing approved order-item, SKU, Variation, quantity, production fields and, when expressly authorized, the minimum personalization needed for the assigned production task. Production files exclude recipient, address, destination, delivery, and buyer-email fields. LocalShopOps does not automatically transmit Etsy Member data or downloaded files to suppliers, carriers, fulfillment providers, other sellers, or unrelated third parties.
Commercial data freshness and caching controls
The Commercial Access release is designed to meet Etsy's current data-freshness and caching requirements. Exact timing behavior must be verified against the current official terms and the production-intent implementation before broader seller access.
- Displayed Etsy content must be refreshed or revalidated within the intervals required by Etsy's then-current terms.
- Data that cannot be refreshed within the applicable interval must not be presented as current Etsy data.
- Cached Etsy content must be retained only as long as reasonably necessary for the seller-requested service.
Operational safeguards
The following are proposed release controls and remain subject to the applicable verification Gates:
- Role and shop-based access controls.
- Explicit user confirmation for Etsy write operations.
- Audit records for sensitive and external operations.
- Duplicate-submission controls and validation of write requests.
- Rate-limit handling and controlled retry behavior.
- Incident review and notification procedures.
Commercial launch control
Before broader seller access is opened, LocalShopOps is designed to require an affirmative click-through acceptance of the applicable Terms of Service and Privacy Policy separately before an Etsy shop connection is enabled. Acceptance records will identify the user and organization, each document's version and exact hash, UTC acceptance time, and affirmative method. Applicant-approved Version 1.0, including the approved central-architecture redlines, is not yet effective for Etsy-connected use. Publishing this information site does not create an acceptance event. Synthetic acknowledgement records do not establish real policy effectiveness.
Incident response and notification
The support inbox is intended to be checked at least daily by a primary owner with backup-administrator coverage. Every suspected security or privacy event enters the internal response process immediately; general events are escalated to the designated responsible person within 24 hours under LocalShopOps policy.
If a Developer Account, Etsy API keystring, shared secret, or other Etsy API credential is compromised or suspected to be compromised, Grace & Crafted Inc. will immediately notify Etsy through its security channel at security@etsy.com.
If Etsy Member data accessed through the Etsy API is compromised or suspected to be compromised, Grace & Crafted Inc. will notify Etsy at dpo@etsy.com and the affected Etsy seller promptly, and no later than 24 hours after discovery.
Revocation and deletion
Sellers may revoke Etsy authorization from Etsy's Connected Apps page. A confirmed disconnect is intended to block new Etsy calls for that connection, disable related work, and begin removal of credentials and working data.
A verified account-closure or deletion request is intended to start an organization- and shop-scoped deletion workflow. Recipient/address and order-level personalization are intended to be deleted or de-identified no later than 30 days after terminal order state, subject to documented holds. Temporary Production-file copies are intended to enter deletion after successful download or expire within 24 hours if undownloaded. These are LocalShopOps policies, not Etsy deadlines. Automatic cleanup and production/file-backed behavior are not represented as verified. See the disconnect instructions and data deletion process.
Reporting a security concern
Security concerns should be reported to gracecrafted2025@outlook.com or through the Support page.