What is held

Last changed 30 July 2026.

This app reads your orders. It does not keep them. That distinction is the whole of this page, and it is enforced by the shape of the database rather than by good intentions: there is no orders table, no buyers table, and no column anywhere for a name or an address.

The complete list of what is stored

• An email address you typed. Not taken from Etsy — we never asked for that permission.
• Your Etsy tokens for each connected shop, so the two-hourly pass can read your orders without you being present.
• The shop's id, name, and link.
• The picking list as shown: listing id, title, variation, SKU, a quantity, how many orders it covers, how late it is, and the earliest ship date among them.
• Four counters: open orders, open items, overdue jobs, and whether the list was truncated.
• A signature of what we last emailed you, so the same list is not sent twice.

What is never stored

• No buyer. No name, no email, no user id, no address, no city, no postcode, no country. Eighteen personal fields arrive with every order and not one of them is read.
• No messages. Not the note your buyer sent you, not the gift message, not your reply.
• No money. No order totals, no prices, no shipping cost, no tax, no payment method, no refunds.
• No order identifiers on the picking list. A job row says "four oatmeal mugs across three orders". It cannot be traced back to which three.
• No history of trade. The list is replaced wholesale every pass. There is no record of what you sold last month and no way to build one from this.
• No analytics, no third-party scripts, no advertising, no tracking cookies. The site serves no JavaScript at all.

The tokens

Held as secrets on Cloudflare's platform, used only by the scheduled pass and only against api.etsy.com. They are deleted the moment you disconnect a shop or close the account — and also the moment Etsy refuses them, because a token that no longer works is nothing but a liability to keep.

Etsy issues a new refresh token on every exchange and the old one stops working, so at any moment there is exactly one live grant per shop.

Cookies

One long-lived cookie holding a signed session id, plus two short-lived ones during the connect handshake that expire in ten minutes and are deleted the moment it finishes. All are HttpOnly, SameSite=Lax, Secure.

Who else sees any of it

The provider that carries an email to you. Cloudflare, which runs the site and the database. Nobody else. Nothing is sold or shared, and there are no advertisers to share it with. Your buyers' details are not on that list because we never had them.

Erasing it

Account → Close and erase. One transaction: tokens, lists, counters, address. Immediate, no confirmation email, no waiting period, no retained copy. Revoking donhang inside your Etsy account settings is the other half and worth doing as well. Or write to support@donhang.uk and it will be done for you.