Privacy Policy

1. Operator and contact

Operator: Yalinkilic LLC
Location: United States
Privacy contact: berkayyalinkilic@outlook.com

2. Information processed

Public website

The hosting provider may process IP address, request time, browser information and limited security logs needed to deliver and protect the website.

Application account

When account access is enabled: account name, email address, one-way password hash, session and Terms-acceptance record.

Etsy OAuth and Open API

When a seller connects: Etsy user and shop identifiers, shop name, listing identifiers and status, supported listing fields, product images, basic inventory, relevant shipping and processing configuration, and OAuth access and refresh tokens.

Flowikka does not receive the seller’s Etsy password through OAuth and does not ask sellers for an Etsy developer key or shared secret.

3. Purposes

• authenticate the application account;
• connect the shop authorized by the seller;
• display the seller’s own listings;
• prepare local listing work and perform a seller-confirmed draft operation;
• secure, troubleshoot and support the service;
• respond to support, access and deletion requests.

Etsy member data is not sold, used for unrelated advertising, scraped from Etsy pages or disclosed to data brokers.

4. OAuth permissions

The intended V1 scopes are listings_r, listings_w and shops_r. A material purpose or scope change requires updated disclosure, any required Etsy approval and new user authorization.

5. Service providers

Etsy processes the OAuth authorization and API requests. Railway is intended to provide application hosting. Email infrastructure processes support communications. Providers process information under their applicable terms.

6. Storage, freshness and retention

• OAuth tokens: until disconnect, revocation, expiry or account deletion;
• displayed listing content: refreshed or discarded within six hours if cached;
• other displayed Etsy content: refreshed or discarded within 24 hours if cached;
• local drafts and images: until deleted by the user or workspace deletion;
• support communications: normally up to 12 months after the last message unless longer retention is needed for security, legal or dispute handling.

7. Security and seller controls

The production design requires encrypted transport, server-side secret management, encrypted OAuth-token storage, access controls, owner-scoped queries and restricted logs. Sellers can decline authorization, disconnect, revoke through Etsy, delete local work and request access, correction or deletion.

8. Changes and contact

Material changes to the application’s purpose or data use will be disclosed before they take effect. Contact berkayyalinkilic@outlook.com.