Pop the Price Compliance Notes

Current Prototype State

The public beta is currently mock-safe. It does not call Etsy directly from the browser, does not hold Etsy credentials, and does not enable shopping links for mock products.

Non-Negotiable Rules

• No scraping, browser automation, or unofficial extraction of Etsy marketplace pages.
• No checkout replacement, shopping cart, automatic redirect, or simulated affiliate click.
• No seller passwords, API secrets, OAuth tokens, or affiliate credentials in the web app.
• Product data is shown only when it comes from an approved API/feed path and passes freshness, price, image, and availability checks.
• Any View Product action requires a real user tap and opens the retailer site in a new browser tab.
• Unavailable, unpriced, stale, invalid, or mock-only products do not receive shopping links.

OAuth Readiness

Any scoped Etsy member access will use OAuth 2.0 Authorization Code with PKCE. Access tokens and refresh tokens will be stored only server-side, encrypted where appropriate, and never exposed to the static web app.

Data Freshness

Etsy listing content must be refreshed within Etsy's allowed display window. Stale, unavailable, unpriced, invalid, or otherwise non-compliant products will be suppressed.