Official eBay sign-in
You sign in directly with eBay and grant access there. eOptima never sees your eBay password.
Security & privacy
Security & privacy: official eBay API, no password access, servers in Germany
Your eBay data belongs to you. eOptima connects through the official eBay sign-in, stores access keys only in encrypted form, changes nothing on eBay without your confirmation—and works entirely without tracking.
Last updated: Oct 17, 2026
Official eBay sign-inYour eBay password stays with eBay
AES-256 encryptionfor eBay access keys—never in the browser
No tracking cookiesno analytics tool, no cookie banner
Delete your account anytimeyourself, instantly, no support request
At a glance
Eight reasons your eBay account is in good hands with eOptima
At eOptima, security isn't an add-on but part of the foundation—from the first click on “Connect with eBay” to the deletion of your account.
Stored encrypted
We store your eBay access key only with AES-256 encryption. It never leaves our server.
Your data stays yours
Your listings and settings are strictly separated from other accounts. Other users can't see your data.
Two-factor authentication
With an authenticator app and 10 recovery codes. You see and end signed-in devices yourself.
No tracking cookies
No analytics tool, no advertising cookies, no sharing for advertising purposes. That's why we don't need a cookie banner, either.
Tamper-proof history
Every change is recorded with its before and after value. Entries can't be changed afterwards.
Delete your account anytime
You delete your account yourself, instantly and without a support request. Nothing is deleted on eBay itself.
Our own server
Hosted by IONOS SE in a data center in Germany. The database isn't publicly accessible, and Cloudflare protects against attacks.
Explained in four steps
Official eBay API with OAuth 2.0: how eOptima protects your eBay access
eOptima uses eBay's official sign-in process (OAuth 2.0). Your password stays with eBay, and the access key never leaves our server.
- Your device
You click “Connect with eBay”
In eOptima under “eBay connections”. Your browser is redirected to eBay's sign-in page.
- eBay
Sign-in directly with eBay
You sign in on eBay's site and confirm which permissions eOptima receives. eOptima never sees your password.
- eOptima server
Token is stored encrypted
The server exchanges the one-time code for an access key (token) and immediately stores it encrypted.
Stored encryptedToken · AES-256 · never leaves the server - eBay API
Only the server talks to eBay
eOptima only accesses eBay when you trigger a sync or a transfer.
What your browser gets
- A session cookie that keeps you signed in—only over HTTPS and only for eoptima.net.
- Your results: listings, recommendations, transfer status.
What your browser never gets
- eBay access keys—they stay exclusively on our server.
- The encryption key—and not even eOptima knows your eBay password.
Access & sign-in
Your eOptima account has multiple layers of protection.
Even if someone guesses your password, they won't get far: two-factor authentication, automatically expiring sessions, and protection against guessing attempts work together.
- Two-factor authentication with 6-digit codes from an authenticator app, e.g. Google or Microsoft Authenticator, 2FAS, or your password manager, plus 10 recovery codes.
- Sessions end automatically after a period of inactivity.
- Signed-in devices are listed in your account, and you can sign out other devices or all devices. Changing your password automatically signs out other devices.
- Protection against guessing attempts: repeated failed attempts are automatically slowed down, and you're notified by email.
- Bot check only when something looks unusual: Cloudflare Turnstile is only used for suspicious requests. Otherwise, eOptima doesn't load any third-party scripts.
- Secure links: confirmation and reset links are only valid for a short time and only work once.
eoptima.net/app/konto
Data & encryption
GDPR & servers in Germany: what eOptima stores
We only store what you need for your work with eOptima. Through the eBay API, we only load your own listings, and only when you trigger it.
| Data | Purpose | Protection |
|---|---|---|
| AccountEmail, account type, password | Sign-in, notifications | Password never stored in plain text |
| Two-factor | Second sign-in step | Stored encrypted, each recovery code valid only once |
| eBay connectionToken, eBay user ID | Access to your listings | AES-256-encrypted, never leaves the server |
| ListingsTitles, prices, quantities, item specifics, shipping, image links | Reviewing and optimizing | Every query filtered by eOptima account on the server |
| Sessions | Staying signed in | Not stored in plain text, can be ended by you at any time |
| History & security logChanges, sign-ins, IP address, browser | Traceability, protection against abuse | Tamper-proof, can't be changed afterwards |
Also
- Connections only over HTTPS, including between eOptima and eBay.
- Database not publicly accessible—only the eOptima application accesses it.
- Minimal logs: no passwords, codes, or tokens in logs, and email addresses only masked.
- No selling, no advertising: we only use your data to provide eOptima to you.
- Backups: before every update, we back up the entire database and verify that the backup can be restored. We only keep the 20 most recent backups. eBay tokens remain encrypted in them; the key isn't stored in the backup.
Your control
You decide what happens to your data.
Whether you disconnect an eBay account or delete your whole account: you don't need a support ticket for it.
Available
Delete your account yourself
Under “Settings” → “Profile”—confirmed with your password and email address. The following is deleted immediately and permanently:
- Account data and sessions
- eBay connections including encrypted keys
- Listings, queued changes, shipping rates, and recommendations
- History entries are replaced by an anonymized deletion record.
Nothing is deleted on eBay itself.
Available
Disconnect and revoke eBay access
Under “eBay connections”, you disconnect an eBay account. Beforehand, eOptima shows you exactly which data will be deleted.
- Multiple eBay accounts can be disconnected individually
- You can also revoke access directly on eBay: in “My eBay” under Account settings → Third-party app permissions
Planned
Data access & export
An export of your data as a file directly in your account is planned. Until then, an informal request is all it takes. We'll reply within one month (Art. 12(3) GDPR).
- Access to all data stored about you (Art. 15 GDPR)
- Export in a common format (Art. 20 GDPR)
Changes only after confirmation
Protection against accidental overwrites: on eBay, only what you approve changes
eOptima never writes to your listings in the background. Every change goes through three clearly separated steps.
- Edit
You change values, such as a price or shipping rate, in eOptima first. Nothing happens on eBay yet.
- Transfer
Only when you trigger “Transfer to eBay”. eOptima prevents duplicate or outdated transfers.
- Confirmed
eOptima only adopts the new value once eBay has confirmed it. If the outcome is unclear, eOptima first checks with eBay instead of blindly trying again.
Transparency
The history shows every change—without gaps.
You see everything that was changed in your account with time, before and after value, and the device the change came from. Sign-ins and failed sign-in attempts appear here too.
- Tamper-proof: entries can be neither changed nor deleted.
- Filterable by area (prices, listings, shipping, sync, eBay connections, account & security), result, and time period.
- Uniform display period for all accounts: as long as your account exists.
eoptima.net/app/verlauf
Cookies & tracking
No tracking. So no cookie banner, either.
We want to know how to make eOptima better—but not by following you around the web. Instead of analytics tools, we'd rather ask you directly for feedback.
No tracking, analytics, or advertising cookies.
eOptima only uses storage that's technically necessary for the service. That doesn't require consent—so a cookie banner would just be an obstacle with no benefit.
You'll find which technically necessary storage eOptima uses under Cookies & storage.
Service providers & subprocessors
Who we work with
To run eOptima, we use only a few carefully selected service providers. We conclude contracts with processors pursuant to Art. 28 GDPR.
| Service provider | Purpose | Location / place of processing | Role | Legal basis / third-country transfer |
|---|---|---|---|---|
| HostingIONOS SE | Operation of server and database | Montabaur, Germany; data center in Germany | Processor | Art. 6(1)(b), (f) GDPR · no third-country transfer |
| Email deliveryTrafficcamp GmbH (Lima-City) | Confirmation, reset, and security emails | Germany | Processor | Art. 6(1)(b), (f) GDPR · no third-country transfer |
| Cloudflare, Inc. | DNS, protection against attacks; Turnstile only for suspicious requests | San Francisco, USA; global network, processing in the nearest data center, including outside the EU | Processor | Art. 6(1)(f) GDPR · EU-US Data Privacy Framework (certified), supplemented by Standard Contractual Clauses |
| eBay | Data source: your listings, at your request via the eBay API | the eBay company responsible for your marketplace, including eBay GmbH (Germany), eBay Marketplaces GmbH (Switzerland), eBay Inc. (USA) | Independent controller | Art. 6(1)(b) GDPR · eBay's own privacy policy applies to eBay |
| Stripe | Credit purchases, Premium subscription, customer portal | Stripe Payments Europe, Limited, Dublin, Ireland | Independent controller | Art. 6(1)(b), (c) GDPR · Stripe, Inc. certified under the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
Found a vulnerability?
Let us know—we'll take care of it.
If you believe you've found a vulnerability in eOptima, please report it to us confidentially at security@eoptima.net. We'll confirm receipt within 3 business days and keep you updated on the fix.
- Please describe the vulnerability so we can reproduce it (affected URL, steps, impact).
- Please only access your own test accounts—don't retrieve, change, or delete other users' data.
- No denial-of-service or social engineering tests and no automated mass scans.
- Give us time to fix it before you publish details (90 days).
/.well-known/security.txt
Contact: mailto:security@eoptima.net Expires: 2027-10-16T00:00:00.000Z Preferred-Languages: de, en Policy: https://eoptima.net/sicherheit/#melden Canonical: https://eoptima.net/.well-known/security.txt
Does eOptima see my eBay password?
No. You sign in directly on eBay's site (OAuth). eOptima only receives an access key (token), which we store encrypted on the server. Your browser never gets to see it, and you can revoke access on eBay at any time.
Is eOptima GDPR-compliant?
eOptima is built on the principle of “data protection by design” (Art. 25 GDPR): we only process what the service needs, don't use tracking cookies, and you can delete your account yourself at any time. You'll find the details in the privacy policy.
Where is my data stored?
On our own server at eoptima.net, hosted by IONOS SE in a data center in Germany. The database isn't publicly accessible. Cloudflare sits in front as a protective layer.
Can eOptima change anything on eBay without my consent?
No. Every change first lands in the change queue and is only transferred when you trigger it. eOptima only adopts new values after eBay confirms them and protects every transfer against being carried out twice.
What happens when I delete my account?
You delete your account yourself under “Settings” → “Profile” and confirm with your password and email address. eBay connections including encrypted keys, listings, queued changes, shipping rates, and recommendations are deleted immediately. History entries are replaced by an anonymized deletion record. Nothing is deleted on eBay itself.
Why is there no cookie banner on eoptima.net?
Because we don't use any tracking, analytics, or advertising cookies. We only use a technically necessary session cookie for sign-in and store your color scheme locally in your browser. No consent is required for this (§ 25(2) no. 2 TDDDG).
Start securely
Connect your eBay account—without handing over your password.
Create an account, connect via the official eBay sign-in, and see your first optimizations. Free, and you can delete it at any time.
- Free sign-up
- No credit card
- Delete your account anytime