StuffOps Etsy API Review Information

StuffOps is an independent seller operations web app that helps Etsy sellers view shop operations, listing data, order activity, fulfillment status, and reporting in one workspace after the seller authorizes access with Etsy OAuth.

Etsy notice: The term "Etsy" is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

Review URLs

• Application domain: https://app.stuffops.com
• OAuth callback: https://app.stuffops.com/api/etsy/oauth/callback
• Data access explanation: /etsy-data-access
• Privacy Policy: /privacy
• Terms of Service: /terms
• Data Deletion: /data-deletion
• Support: /support

OAuth and API behavior

• StuffOps uses Etsy Open API v3 endpoints over HTTPS.
• Users are sent to Etsy to approve access through OAuth 2.0 authorization code flow with PKCE.
• StuffOps validates the OAuth state value and uses a registered HTTPS redirect URI.
• StuffOps does not ask for, collect, store, or transmit Etsy member passwords.
• StuffOps does not scrape Etsy pages or use the Etsy API to crawl Etsy content.

Requested scopes

• shops_r: identify and label the authorized shop.
• listings_r: read seller listing and inventory data.
• transactions_r: read seller order and transaction data for operations and reporting.
• address_r: read shipping address data needed for fulfillment workflows.
• listings_w: create or edit listings only through seller-initiated or seller-approved listing workflows.
• transactions_w: submit seller-approved fulfillment or tracking updates for orders.

Data protection

• OAuth tokens are stored server-side and encrypted at rest in production.
• Token values and secrets are redacted from application logs.
• Etsy connection data is scoped to the authenticated StuffOps merchant and user.
• Users can disconnect Etsy in the app and can request deletion through the public data deletion page.