Legal
Privacy Policy
Last updated 14 October 2026
1. Who we are
Listyro (“the Service”) is provided by …, …, who is responsible for the personal data described here. THIS APPLICATION IS SOLELY PROVIDED BY TALHA YILMAZ AND AHMET DÜZGÜN, OPERATING AS LISTYRO. For anything in this policy, including privacy requests, write to ….
This policy says what we collect, why, where it goes, how long we keep it, and how to have it deleted. The short version: we collect what the Service needs to work, we read only your own shops’ data from Etsy and keep it only as long as stated here, we store nothing about your buyers, and we never sell or share anything.
2. What we collect
Your account. Your email address, and your password stored only as a one-way argon2id hash: we never see or keep the password itself. We record when the account was created, which invite was used (the code is stored hashed), the time zone you choose, and which version of the Terms of Service and this policy you agreed to and when.
Your Etsy connections. You can connect more than one of your own shops; each is connected separately, by signing in to Etsy as that shop’s owner. For each shop, Etsy gives us access and refresh tokens that let the Service act on that shop with the permissions you granted. We store them encrypted; they are never shown in the app, never sent to your browser, and never written to logs. We also keep each shop’s Etsy user ID, shop ID, shop name, the name you give it in the app, and the permissions granted.
Your uploads. The design images you upload are resized and stored in that resized form only (the file as you sent it is not kept), with their file and folder names, the SKU read from them, and their dimensions. If you make mockups, the blank garment photos you save in templates are kept too, with the template’s name and the photos’ order, the garment’s outline, a map of where the garments are in the photo, the print area of each garment (as suggested and as you set it), whether and when you confirmed it, whether the photo shows the front or the back, the settings you chose, and when you confirmed you may use each photo. Where something is in front of the garment (hair, skin, accessories or a thing held in front of it), a mask of it is kept with the photo, so designs can be placed behind it, together with anything you paint with the “Keep in front” brush. Photos are analysed on our own server by bundled open-source image-analysis models; no photo is sent to any outside service for this. The mockups made from your designs are kept like your other images; a ZIP of them you ask to download is kept for a short time, as below. Mockups are made on our own server; nothing about them is sent to our AI provider.
The listings you prepare. The titles, tags and descriptions suggested for your designs and every edit you make, whether you approved them, the options you chose (profile, shops, SKU, personalization, section, schedule), and the Etsy ID and status of the drafts we create for you.
What you tell us about your costs. The product costs and fee settings you enter for your profit reporting, and the figures from the monthly statements and Etsy Ads reports you choose to upload (the files themselves are read and not kept).
If you ask for an invite. What you type into the request form on our site: your email address, your shop’s name or link, how many shops you run, and your note. We use it only to decide on your request and to send you an invite. When a request arrives, a short notification (the email address, the shop and the number of shops; not your note) is sent to the private messaging channel where we receive our own operational alerts, so that we answer it. The form also counts requests per connection for an hour to stop abuse; your IP address is used for that count and is not stored with your request.
Usage and security records. A daily count of the Etsy API requests made for your account (Etsy caps these, so we must track them); records of the tasks we ran for you and whether they succeeded; a log of administrative and destructive actions on your account (what was done and when, with counts and internal ids, never content); counts of the AI calls made for you and their cost to us; your sign-in session; counters of failed sign-in attempts and request rates, keyed by email and IP address; and server logs, which contain IP addresses, the pages and actions requested, and response codes. Before a log line is written we remove passwords, tokens, session identifiers, OAuth codes and email addresses from it.
3. The Etsy data we read, why, and for how long
We get Etsy data only from your own shops, only through Etsy’s official Open API, and only with the permissions you grant when you connect a shop. We never scrape Etsy’s website, and we never read another seller’s shop. This is every kind of Etsy data we read:
| What we read from your shop | Why | Kept for |
|---|---|---|
| Your shop's listings as Etsy returns them: titles, states, SKUs, sections, prices, tags, descriptions, and links to their images | WhyTo show your shop's listings, to let you pick a reference listing for a profile, and to name the listings in your reports | Kept for6 hours at most, then deleted and read again when you next need them. Nothing older than that is ever shown |
| A reference listing's images, as shown on its profile | WhySo you can see the profile's images and mark which are size charts | Kept for6 hours at most; then the links are deleted and the images are no longer shown until the profile is refreshed. The image files themselves are never stored: they are fetched, checked in memory to tell size charts from artwork, and discarded |
| A reference listing's settings: category, attributes, price, variations, shipping profile, return policy, processing profile, production partners, who made it, when it was made, description, and which of its images are size charts | WhyTo build your new drafts so they match the listing you chose. These are used, not displayed | Kept for24 hours at most, then cleared and read again when the profile is next used |
| Your shop's own lists: its sections, shipping profiles, return policies, processing profiles and production partners (names and ids) | WhyTo put a draft in one of your sections, and to use a profile in another of your shops with that shop's own settings | Kept for24 hours at most for the lists. The ids a profile uses in a shop are kept until you stop using the profile there or disconnect that shop |
| A copy of a listing as it was, taken just before the Service changes it | WhySo a change the Service made to your listing can be checked and undone | Kept for90 days, then deleted automatically |
| Views and favourites of the listings you published with the Service (two totals per listing, read once a day) | WhyTo show how each listing is doing over time | Kept forDaily figures, for 24 months |
| Your shop's sales, line by line: the order number, which listing sold, the quantity, the price, the shipping paid and the date | WhyFor your profit, cost and ads reporting: which of your listings sell and what they earn | Kept forDaily totals per listing and the order lines, for 24 months. Everything else in Etsy’s answer, including anything about the buyer, is discarded as soon as those fields are read, and is written nowhere |
| Your shop's payment account ledger: for each entry its type (for example a transaction fee, a listing fee or an Etsy Ads charge), its amount and its date | WhySo your profit is worked out from what Etsy actually charged, not from an estimate | Kept forOne total per type per day, for 24 months. The entries themselves, their descriptions and their references are not stored |
| How many listings your shop has in each state (five counts) | WhyFor the summary line at the top of the app | Kept for24 hours at most |
We write to your shop only to do what you asked: create drafts, upload their images, set their variations, attributes, personalization and SKUs, publish a draft when you press Publish now or at a time you scheduled for a listing you approved, replace a listing’s images when you ask for that, and create a section, shipping profile or return policy only when you confirm it.
Reading sales is a permission added on 26 September 2026. A shop connected before then is asked to reconnect once to grant it; until it does, everything else keeps working and sales figures are simply not shown.
4. What is never stored
- Nothing about your buyers. No buyer names, postal addresses, email addresses, usernames or messages are stored, in any table or file. Etsy’s sales answers contain some buyer fields; the Service reads only the fields listed above from each line and drops the rest in memory. We do not use Etsy’s receipts endpoint, which returns buyer names and addresses, at all.
- Nothing about other sellers. No other shop’s listings, tags, images, prices or sales, in any form.
- No statement or report files. A monthly statement or Etsy Ads report you upload is read in memory and discarded; only totals, order numbers and amounts are kept.
- No tracking. There are no third-party trackers, pixels, analytics or advertising scripts in the Service or on this site.
5. How we use it
- To provide the Service: to analyse your designs, prepare listings, create and publish drafts in your shops when you ask, and report your own shops’ figures to you. This is necessary to perform our agreement with you.
- To keep it secure: rate limits, sign-in lockouts and logs protect your account and the Service. This is our legitimate interest in running a secure service.
- To support you: when you write to us about a problem.
- To meet our obligations: under the law and under Etsy’s API terms, which govern how we may handle Etsy’s data.
Each seller’s data is used only for that seller. We do not combine one seller’s Etsy data or sales with another’s, in any report, comparison or model. We do not use your data, or any Etsy data, for advertising or profiling, and we do not use it to train or fine-tune any AI model.
6. AI processing by Anthropic
Your design images and listing text are sent to Anthropic for analysis. To describe a design and suggest its listing text, the Service sends the following to the API of Anthropic, PBC, the company behind the Claude models:
- each design image you ask us to write a listing for, in resized form;
- its SKU, the kind of product it is (for example, apparel), and the title prefix of the profile you chose;
- if you chose one of your own listings as an example to follow, that listing’s title and tags;
- occasionally, an image from one of your own Etsy reference listings, when our local check cannot tell whether that image is a size chart or artwork.
Never anything about buyers, sales or orders. Anthropic processes what it receives to return the analysis and nothing else. Under Anthropic’s commercial terms, content sent through its API is not used to train its models. Anthropic may retain API inputs and outputs for a limited period for safety and abuse monitoring, as described in its privacy policy.
We ourselves never use your designs or any Etsy data to train any model. If you do not want a design sent to Anthropic, do not ask for a listing to be written for it; uploading alone does not send it.
8. Where it is stored and how it is protected
- Encrypted tokens. Etsy access and refresh tokens are encrypted at rest and decrypted only at the moment a request is sent to Etsy for you. They never appear in the app, in your browser, in an error message or in a log.
- HTTPS everywhere. Connections to the Service are encrypted in transit; the server is reachable only through Cloudflare’s encrypted tunnel.
- Access control. Every account’s data is kept separate, and the Service checks on every request that you can reach only your own. Administrators of the Service see account-level facts and counts (your email address, your shops’ names, how many listings and requests) and not your designs, listings, or sales figures.
- Passwords are stored only as argon2id hashes, and repeated failed sign-ins are locked out.
No method of storage is perfectly secure. If a security incident affects your data, we will tell you without delay and within 24 hours of discovering it, and we will notify Etsy as its API terms require.
9. How long we keep everything
Expired data is deleted automatically; the Service looks for it every 15 minutes. The periods for Etsy data are in the table above; these are the rest.
| Data | Kept for |
|---|---|
| The image files you upload (the resized version) | Kept for3 days after a draft of the listing made from them exists in every shop it is meant for, with nothing scheduled for it; otherwise 30 days after you last worked on them. They are then deleted automatically, except one small thumbnail of the cover, which stays with the listing's record. Deleted at once when you delete the batch |
| The blank garment photos you save as mockup templates, with each one's outline, the map of where its garments are, the print area of each garment and its confirmation, front or back, the template it is in and the mask of what is in front of the garment | Kept forUntil you delete the template or your account. The designs you upload to make mockups, and the mockups made from them, are image files like the rest and are kept as above |
| A ZIP of mockups you ask to download (only you can download it) | Kept for24 hours after it is ready, then deleted automatically |
| Analytics history: daily sales totals and order lines, daily fee and ad totals, the figures from statements and Etsy Ads reports you uploaded, daily views and favourites, and the versions of a listing's text that have ended | Kept for24 months, then deleted automatically; deleted at once when you disconnect the shop |
| The listings you prepare, your profiles' own settings, your costs, task records, usage counts, and the names and order of your uploads | Kept forWhile your account exists, or until you delete them |
| Etsy access tokens | Kept forUntil you disconnect the shop or delete your account; deleted at once at that moment |
| An invite request from the form on our site | Kept for90 days from the request if it is still waiting, or 90 days after we approve or decline it; then deleted automatically |
| Your sign-in session | Kept for30 days after you last used it; ended at once when you sign out or change your password |
| Failed sign-in and request-rate counters | Kept for15 minutes at most |
| Our records of AI calls made for your account (model, token counts, cost; no content) | Kept for25 months |
| The log of administrative and destructive actions (what and when, with counts and internal ids; no content, no email addresses) | Kept forFor the life of the Service; after an account is deleted its entries no longer point to anyone |
| Server logs | Kept forRotated automatically by size, and kept only as long as needed for security and troubleshooting |
| Backups of our database (the image files you upload are not backed up) | Kept for14 days; data you delete may remain in a backup until that backup expires |
10. Disconnecting a shop
You can disconnect any of your shops at any time on the Shops page. When you do, at once:
- that shop’s Etsy tokens are deleted, so no further request can be made for it;
- everything queued or scheduled for it is cancelled (jobs waiting to run, scheduled go-lives, planned drafts), and the page tells you what was cancelled;
- every piece of Etsy data we hold from it is deleted: the copy of its listings, the settings read from its reference listings, the saved copies of its listings, its sales, fee and statement figures, its views and favourites, the records of its drafts, and the settings that connect your profiles to it.
A profile you also use in another shop stays, without the details read from the disconnected shop, until you choose a reference listing in a remaining shop; a profile used only in the disconnected shop is deleted. Your other shops are not affected, and your uploads and the listings you prepared stay, so you can reconnect later and carry on. Listings and drafts already in your Etsy shop are not affected: they live in your shop, and you manage them on Etsy.
You can also withdraw the Service’s access in your Etsy account settings. That stops us using the connection, but to have us delete the Etsy data we hold, also press Disconnect here or write to us.
11. Deleting your account
You can delete your account yourself in Settings, under Delete account. When you confirm with your password:
- At once: every shop is disconnected as described above (tokens and Etsy data deleted, queued and scheduled work cancelled), every sign-in session ends, and the account can no longer be used.
- Then, by an automatic job, within 30 days at the latest (normally within minutes): your uploaded image files, your batches, the listings you prepared, your profiles, your costs and reports, your task and usage records, and the account itself are deleted.
What is kept, and why. The log of administrative and destructive actions keeps its entries about the account (for example “a shop was disconnected”, with counts), because it is our record that deletions happened; they contain no content and no email address, and no longer point to an account. Our records of AI calls keep their numbers (model, tokens, cost), unlinked from the account, because they are our own accounts. Copies in database backups expire within 14 days. Nothing on Etsy is touched: your drafts and listings are yours and stay in your shop.
If you cannot sign in, write to … from the email address of the account and we will delete it for you within the same 30 days.
12. Your rights and your data
Getting your data out. The tables on the Analytics page can be downloaded as CSV files, and the listings you prepare are in your own Etsy shop as drafts. There is no one-click export of a whole account; if you want a copy of the data we hold about you, write to … and we will send it.
Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. To use any of these rights, write to …; we reply within 30 days. You also have the right to complain to the data protection authority in your country.
The Service is not intended for anyone under 18.
14. Changes to this policy
When we change this policy or the Terms of Service in a way that matters, the app asks you to read and agree to the new version before you go on. The date at the top shows when it was last updated.
Questions and privacy requests: …. Provided by …, ….