Data, Permissions & Security

Last updated: June 18, 2026 — technical reference for developers, security reviewers, and data-protection officers. The plain-language version is in our Privacy Policy.

1. Where data flows

Flow	Path	Stored by us?
AI text/image generation	Your device → AI provider (your own key)	No — never touches our servers
Outbound Shopify / Printify / Gelato API calls	Your device → platform	No
Your designs, listing drafts, shop catalog	Local SQLite on your machine	No
Database backups	Local only (your machine)	No
Etsy API calls	Your device → our proxy → Etsy	Transit only — not stored (proxy adds Etsy's shared secret, which can't ship in the app)
Shopify sign-in (OAuth code exchange)	Your device → our intermediary → Shopify	Transit only — token relayed back and stored encrypted on your device
Order webhooks (Shopify / Printify / Gelato)	Platform → our relay → your offline app	Yes, briefly — queued ≤ 7 days, then auto-deleted
Shopify mandatory GDPR webhooks	Shopify → our compliance endpoint	Yes — audit log retained 7 years (regulatory requirement)
Design staging for print providers	Your device → your own Backblaze B2 bucket	No (your bucket; 36-hour auto-delete)

The relay/proxy exists only to (a) keep marketplace secrets out of the installable app and (b) deliver incoming order events to a desktop app that may be offline. It is not a copy of your shop. See the Sub-processors page for the providers involved.

2. Retention

Data	Retention
Order/fulfilment webhook relay (Shopify/Printify/Gelato)	7 days, auto-deleted
Shopify GDPR compliance webhook audit log	7 years (append-only)
Design staging files (your B2)	36 hours, auto-deleted
Local database backups	30 days (on your machine)
License records	Licence term + 12 months
Local order/customer data	On your machine until you redact/wipe (configurable retention available)

3. OAuth permissions (scopes)

MockupFlow requests the minimum OAuth scopes needed, and deliberately does not request payment, billing, customer-list, or marketing scopes. The full per-scope breakdown and justification for Etsy and Shopify is documented in the Privacy Policy §7 (Etsy) and §8 (Shopify).

4. Encryption & security

Credentials at rest: all API keys and OAuth tokens are encrypted on your device with Fernet (AES-128-CBC) and never transmitted to us.
In transit: all connections use TLS/HTTPS. Webhooks are HMAC-verified before processing.
Relay access control: queued webhook events are scoped per licence; only your app can fetch your events.
Order PII at rest (local): order/customer fields in the local database currently rely on your operating-system disk encryption (FileVault / BitLocker recommended); application-level field encryption is on our roadmap.

DRAFT — this technical reference is provided for transparency and review; confirm specifics with us before relying on it for a formal security assessment.