This Privacy Policy explains what information Stocker Place processes when you use stocker.place and its related application, share, and CDN domains.
1. Controller and Information We Collect
The controller/operator details for Stocker Place are shown in the footer when configured. We collect account and authentication information (including email, display name, Clerk identifiers and session state), folders and settings, uploaded files, share links and access rules, download/activity information, billing and entitlement state, support or feedback messages, and technical/security logs such as request timestamps, user-agent and network metadata needed to operate and protect the service.
2. Purposes and Legal Bases
We process account, file, share, and billing data to provide the service and perform the contract with you; security, abuse prevention, reliability, and limited product measurement are based on legitimate interests; records required for accounting or legal requests are processed to comply with legal obligations; optional marketing or non-essential analytics would be processed only after any consent required in your jurisdiction.
3. Cookies and Local Storage
Stocker Place uses cookies and browser storage that are necessary for sign-in and session continuity. This includes the sp_session cookie used to reflect authentication state across Stocker Place domains, plus auth cookies or tokens set by the authentication provider in use.
4. Infrastructure and Service Providers
Stocker Place runs on Cloudflare Workers, R2, D1, KV, and Assets. Authentication uses Clerk. PostHog receives limited product-measurement events through the Stocker landing worker; these events use a short session-scoped identifier and do not include email or IP address. Paddle processes paid subscription transactions as Merchant of Record and provides checkout, recurring billing, customer portal, and buyer support. Providers may process data in other countries under their published terms and transfer safeguards.
5. Sharing and Public Links
If you create a public or password-protected share link, information needed to deliver that link may be accessible to recipients of the link. Download activity for those links is logged for the account owner.
6. Etsy Integration Data and Privacy
When you connect your Etsy shop via OAuth 2.0 (PKCE):
- Data Collected: Shop identification (Shop ID, Shop Name), listing metadata (Listing IDs, titles, descriptions, digital/physical states), digital file slot assignments, and OAuth tokens.
- OAuth Tokens: Access and refresh tokens are encrypted at rest using industry-standard AES-256-GCM before storage in our database. We never store OAuth client secrets in plaintext.
- Zero Buyer PII: Stocker Place does NOT request, access, process, or store Etsy buyer personal information (such as buyer names, addresses, payment details, or Etsy order histories). Delivery links and access are managed entirely through listing-level digital file delivery cards.
- Scopes Requested: We request only the minimal permissions required:
listings_r(to read listings for mapping) andlistings_w(to attach PDF delivery cards). - Token Revocation & Deletion: You may disconnect your Etsy shop at any time in the Integrations dashboard. Upon disconnection, stored OAuth tokens and listing mappings are purged from our active database.
7. Retention and Your Rights
Account, file, and share records are retained while needed to provide the service and then handled according to deletion, backup, security, dispute, and accounting requirements. Download and technical logs are retained for a proportionate operational period. You may request access, correction, deletion, restriction, portability, or object to processing where applicable; withdraw consent where processing relies on consent; and complain to your supervisory authority. Contact support@stocker.place to exercise a right.
8. Security
We use access controls, signed file URLs, isolated worker roles, and encrypted transport to protect service traffic. No system can be guaranteed perfectly secure, and you should avoid uploading data you are not permitted to store or distribute.
9. Contact
Privacy requests and questions can be sent to support@stocker.place.