Acceptable use policy

What you may and may not do here. Part of our terms, and the rules we moderate against.

Last updated 30 August 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the company details, the governing law and the retention periods a human has to decide, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

31 outstanding items— show

legal entity name
country of incorporation
company registration number
VAT number
registered office address
EU representative, if the entity sits outside the EU
data protection officer, if one is required
supervisory authority
supervisory authority website
governing law and jurisdiction
ADR body to signpost, if the jurisdiction requires one
minimum age — GDPR Art. 8 allows 13 to 16 by member state
refund position, beyond the statutory withdrawal right
liability cap
voluntary refund window — the draft recommends 30 days
window for refunding a renewal somebody meant to cancel — the draft recommends 14 days
acknowledgement time for a vulnerability report — the draft recommends 2 working days
coordinated disclosure window — the draft recommends 90 days
notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days
canonical domain — the code uses streetshape.app, the site publishes streetshape.io
Whether classroom use is supported — the education material invites it, which makes under-16 users foreseeable and decides the minimum age above.
The statutory retention period for accounting records in the country of incorporation.
Retention windows for municipality demo requests, the email log, and stored Paddle webhook payloads.
Whether Paddle's checkout captures the Art. 16(m) consent and acknowledgement the Terms rely on for digital content supplied immediately.
The region each processor runs in, and the transfer mechanism relied on for each.
Review of all nine documents by a lawyer in the jurisdiction of incorporation.
Whether a data processing agreement is actually executed with each provider on the sub-processor list, and whether a StreetShape DPA template exists for a municipality or university to sign.
Which imagery and elevation providers sit behind MapTiler's satellite and terrain styles, read from the styles themselves rather than written from memory.
Whether MapTiler's agreement permits printing and republishing satellite imagery, which is a different grant from viewing it on screen.
Whether the Digital Services Act treats StreetShape as a hosting service or an online platform — public proposal boards and consultations point at the second, which carries notice-and-action, statement-of-reasons and appeal duties.
Whether access to production data is logged, and whether a backup restore has ever actually been run.

1. The short version

Design streets. Argue about streets. Do not use a street-design tool to go after a person, to pretend to be an authority you are not, or to break the law.

This policy is part of our terms and conditions. It applies to everything you do here: the plans you draw, what you call them, what you publish, what you submit to a municipality or a consultation, and how you talk to other people on a board.

2. Do not use StreetShape against a person

No harassment, threats, stalking or intimidation. No content targeting a private individual — a plan is about a street, not about who lives on it.

Do not put somebody’s name, address, photograph, vehicle registration or other identifying detail into a plan, a plan name, a description, a comment or a proposal.

This holds even when the underlying point is legitimate. A dangerous junction is a legitimate subject. The person who lives on the corner is not.

3. Do not impersonate

Do not pretend to be somebody else, an organisation you do not represent, or a public body. Specifically: do not present a design as the official proposal of a council, authority or agency when it is not. Do not use a municipality’s name, crest or branding to imply endorsement.

Why this one is first among equals

It is the rule most likely to cause real harm. A plan that looks official and circulates locally can misinform a whole neighbourhood, and it damages that authority’s ability to consult about anything afterwards.

If you are making a proposal to an authority, say so. “What I think the council should do” is fine. “The council’s plan” is not.

A municipality claims its own board through a verification step for the same reason: the badge on a board has to mean the authority is actually behind it, or it means nothing.

4. Do not mislead about what a design is

Do not claim, imply, or let somebody assume that a StreetShape design:

has been engineered, checked or approved;
complies with any standard, code or regulation;
has been assessed for safety, capacity, feasibility or cost;
is a construction, tender or survey document.

None of it is true of anything made here — see what StreetShape is, and is not.

5. Do not break the law

No content that is unlawful where you are or where we are. No incitement to violence. No hate speech targeting people for who they are. Nothing that infringes somebody else’s copyright, trademark or other rights.

Content that sexualises children results in immediate termination and a report to the authorities, with no warning and no appeal.

6. Do not attack the service

No attempts to break, overload or gain unauthorised access to StreetShape or its providers. No circumventing plan limits, authentication or payment. No automated scraping of the site, its API or its map tiles.

No probing, scanning or penetration testing without written permission — but good-faith security research under the rules on our security page is welcome, and reporting something you found there will never be treated as a breach of this policy.

If you want programmatic access, ask. We would rather give you a sensible route than find you in the rate-limit logs.

7. Do not resell it

Do not resell, sublicense or provide StreetShape as a service to other people. Using it to do paid work for a client is fine and encouraged; selling access to your account is not.

8. Map data

The map underneath is licensed from third parties — see map data and attribution. Do not scrape, bulk-download, cache or redistribute basemap tiles or imagery, and do not strip the attribution from anything you export.

9. When you publish or submit

Publishing a plan at its own address, posting it to a municipality’s board, or submitting it to a consultation is a public act. Everything above applies with more force, and so does this:

Say what your design is — an idea, a proposal, a campaign position.
Do not submit the same design repeatedly to inflate its apparent support.
Do not organise a coordinated campaign to flood a consultation. Consultations here are not votes and are not ranked by support, so it does not work — but it wastes the time of the people trying to read the results.
Do not submit a design about a street in order to make a point about the people who live on it.

Municipal consultations

Where you submit to a municipality’s board or consultation, that municipality may have rules of its own and they apply as well as these. A municipality can remove a submission from its own board. We can remove content from StreetShape.

10. Reporting something

Public proposals and comments carry a report control. Use it — it goes to a moderation queue that the municipality running that board can see. For anything else, or for private content, write to hello@streetshape.io with a link and a short description.

We look at every report. We will tell you what we decided and why, and how to have it looked at again.

11. What we do about a breach

Depending on how serious it is:

we ask you to change or remove something;
we remove it ourselves and tell you why;
we suspend the account;
we close the account;
for anything unlawful, we report it.

Except where the breach is serious or unlawful, we warn first.

You can appeal any of it by replying to the notice we send you, and a person will look at it again. What happens to a paid account we closed is covered by the refund policy.

12. Changes

Posted here with a new date. Material changes are notified as described in the terms.

This policy forms part of the terms. What the map licences require of you is on the attribution page, and how to report a vulnerability rather than a person is on security.