What we asked Etsy for

The consent screen shows you two lines. Here is what is behind them.

Etsy offers applications twenty different permissions. donhang asks for two, and it is built so that neither one can be dropped and neither one can be widened.

Permission	What it lets us do	Why the app cannot work without it
`shops_r`	Read `GET /users/me`, which returns two numbers: your user id and your shop id.	It is the only way to learn which shop belongs to the person who just pressed Connect. Without it we would have to ask you to type a shop name and trust the answer.
`transactions_r`	Read `GET /shops/{id}/receipts` — your orders.	The orders are the list. There is no other source for "what is paid for and not yet shipped".

What we did not ask for

Etsy would have given us these for the asking. We did not ask, so they are not on your consent screen and no future version of this app can quietly start using them without you being asked again:

address_r — billing and shipping addresses.
email_r — your profile and email address. We ask you to type an email address instead, which is one fewer permission and also lets the list go somewhere other than your Etsy login.
billing_r and profile_r — statements and profile data.
listings_w, listings_d, shops_w, transactions_w and every other write permission. donhang cannot change anything in your shop. Not a listing, not a price, not an order's status. It has no permission that ends in _w.

What arrives, and what survives

An Etsy order record has forty fields. Eighteen of them are personal information about your buyer: their name, their street, their city and postcode, their email address, the message they sent you, the gift note they wrote.

None of those are read. The code that receives an order copies out an allow-list — listing, title, quantity, SKU, variation, and the ship date Etsy promised — and the rest is discarded with the response. It is an allow-list rather than a delete-list on purpose: a field Etsy adds next year cannot arrive by default.

There is no orders table and no buyers table in the database. The full list of what is held.

Taking it back

Two places, and both work on their own:

Here: Disconnect the shop, or close the account. Either deletes the tokens immediately.
At Etsy: your account settings list every application you have granted access to. Revoking donhang there stops it whether or not you tell us — the next pass gets a refusal, throws its tokens away, and says so on your page.