Legal

Cookies and Browser Storage

Everything StreetShape puts on your device, what each thing is for, and which of it you can refuse without losing the service.

Last updated 17 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. The short version

Nothing optional is written before you accept it.
Refusing analytics does not restrict the service.
Refusing does not stop every third-party connection — authentication, hosting, maps and checkout still happen, because the service does not work without them.
There is no advertising, no tracking pixel, no third-party analytics script in your browser and no cross-site profiling.

3. Strictly necessary

Storage that is strictly necessary for the service
Name	Set by	What it is for	How long
`__session`	Clerk	The signed-in session. Without it every page load signs you out	[the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory]
`__client_uat`	Clerk	Tells the server whether a signed-in session exists, so a page can render as signed in without a round trip	[the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume]

These are set by Clerk, which runs sign-in. Without them a signed in session does not survive a page load. They are not optional and there is nothing to accept or refuse.

The lifetimes are marked outstanding rather than stated. They are a provider default that a production configuration can change, and a cookie policy quoting a default it has not checked is describing somebody else’s deployment.

4. Only with your permission

Storage written only after you accept
Name	Set by	What it is for	How long
`streetshape_consent`	StreetShape	Whether you accepted or declined the banner. Without it we would ask you again on every page	180 days
`streetshape_attribution`	StreetShape	The page you arrived on, the site that linked you and any campaign tags in the address — so a signup weeks later is still credited to what brought you. Written only if you accepted, never sent anywhere else, and read once if you make an account	90 days, or until you sign up, or until you withdraw consent

The first row is the record of your choice. It is what stops us asking again on every page, and it is written whichever way you answered — including when you decline, because a decline that is not remembered is not honored.

The second is attribution: the page you arrived on, the site that linked you and any campaign tags in the address. If you make an account later, it is read once and attached to the signup, and then removed.

What the same consent also enables

Accepting does not only write a cookie. It also turns on the named product events our servers send to PostHog, with your account id attached when you are signed in. The banner’s own wording centers on attribution and under-describes that, which is one of the things listed as outstanding at the top of this page. There is no PostHog script in your browser: no session replay, no heatmaps, and nothing that records what you type.

We also keep aggregate counts of how many people reached each step. The totals are designed not to identify anybody. The requests they are counted from still reach our servers, and whether collecting them needs asking first is an open question rather than a settled exemption.

5. Preferences kept on your device

Preference keys in localStorage
Name	Set by	What it is for	How long
`streetshape:draft:v1`	StreetShape	A plan drawn before signing up. It is the only copy — it stays on this device until you make an account and it is saved, and clearing your site data loses it	Until claimed or cleared
`streetshape:view-type`	StreetShape	Which basemap a new plan opens with	Until cleared
`streetshape:buildings`	StreetShape	Whether buildings are drawn on the map	Until cleared
`streetshape:plans-sort`	StreetShape	How your plans are sorted in the dashboard	Until cleared
`streetshape:plans-view`	StreetShape	Grid or list, in the dashboard	Until cleared

The first row is not a preference

streetshape:draft:v1 holds a plan somebody drew before signing up, and it is the only copy. It is not backed up anywhere, it does not exist on your other devices, and clearing your site data deletes it for good. Holding it is the service that was asked for, which is also why it is not treated as optional.

Whether the other four need consent: [whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent]

This page used to treat them as exempt without saying why. Remembering which basemap you chose is a plausible reading of “necessary for a service you expressly requested” and it is not an obvious one, so it is marked as a decision rather than presented as a conclusion.

6. Third parties

Clerk sets the two session cookies above.
MapTiler receives map requests from your browser.
Paddle may use cookies and similar technologies inside checkout, for payment and fraud prevention, under its own cookie notice.

A provider’s own notice does not stand in for consent we have to obtain ourselves for anything non-essential loaded through our pages.

The complete production inventory: [a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets]

7. What we do not set

No advertising cookies. No tracking pixels. No third-party analytics script running in your browser. No cross-site profiling. No data sold to anybody.

That list is about what is absent, and it is worth being precise about what it does not claim: it does not claim that nothing reaches any provider when you decline. Signing in, loading a page, looking at a map and paying all involve the companies on the subprocessor page, whatever you answered.

8. Changing your mind

To review or withdraw an optional consent: [a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing]

Withdrawal stops future consent-based collection and removes the attribution cookie. It does not make what was already collected lawfully unlawful. Write to hello@streetshape.org about attribution already attached to your account.

You can also block or clear cookies and site data in your browser. Blocking the session cookies will stop you signing in, and clearing site data will delete an unsaved draft. That is a browser feature rather than a control we provide, and the law asks for the second thing.

Global Privacy Control

Where no site choice has been stored, a Global Privacy Control signal is treated as a refusal. Where you have made a choice on this site, that choice takes precedence over the signal. Do Not Track is not interpreted separately. Whether giving a stored choice precedence is lawful in every market served is one of the open questions at the top of this page; you can always refuse through the site’s own controls.

9. Changes to this policy

When something is added or removed, this page changes with it and the date at the top moves. A new optional technology is asked about before it is used, not announced afterwards.

Daniel Halabi · hello@streetshape.org