How we plug into Etsy

Decoro Home Art uses a private app on the Etsy Open API v3. It is attached to one shop, DecoroHomeArt, and the owner is its only user. It is not published and not offered to other Etsy sellers.

Does

• Reads the shop profile and sections, to know which shop it works on.
• Reads our listings, prices and stock, so our own records match Etsy.
• Writes our listings: titles, descriptions, photos, tags, prices, quantities.
• Reads our orders, so pieces get made and shipped in time.

Does not

• Open any other shop or collect data about other shops, buyers or listings.
• Scrape. API calls only, inside Etsy's rate limits.
• Message buyers. Etsy handles all order messages.
• Sell anything or move buyers off Etsy checkout.
• Sell, share or hand over Etsy data, feed ad or marketing platforms, run analytics, or train AI.

Scopes

Scope	Why we ask
shops_r	Shop name, sections, settings.
listings_r	Our listings, prices, stock.
listings_w	Create and edit our listings, photos, tags, prices, quantities.
transactions_r	Our orders, for making and shipping.

Flow

1. 1 The owner opens the protected connect page here and ticks "I accept the app terms and privacy policy". Time and terms version are logged.
2. 2 The browser jumps to Etsy for approval. This site never sees the Etsy password.
3. 3 Etsy returns to https://decorohomeart.com/control/callback with a one-time code. Standard OAuth 2.0 with PKCE.
4. 4 The code becomes an access token and a refresh token. Both are encrypted with AES-256-GCM before they are stored. The key is a separate secret.
5. 5 A different Etsy account than the owner's? Tokens are discarded, nothing is kept.

Kill switch

Revoke the app in the Etsy account settings and access ends immediately. The owner page also has a disconnect button that wipes our stored tokens.

Support

hello@decorohomeart.com. Monitored. Reply within two working days.