Cookie policy

Everything StreetShape stores in your browser, why it is there, and why you were never asked to accept anything.

Last updated 29 August 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the company details, the governing law and the retention periods a human has to decide, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

31 outstanding items— show

legal entity name
country of incorporation
company registration number
VAT number
registered office address
EU representative, if the entity sits outside the EU
data protection officer, if one is required
supervisory authority
supervisory authority website
governing law and jurisdiction
ADR body to signpost, if the jurisdiction requires one
minimum age — GDPR Art. 8 allows 13 to 16 by member state
refund position, beyond the statutory withdrawal right
liability cap
voluntary refund window — the draft recommends 30 days
window for refunding a renewal somebody meant to cancel — the draft recommends 14 days
acknowledgement time for a vulnerability report — the draft recommends 2 working days
coordinated disclosure window — the draft recommends 90 days
notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days
canonical domain — the code uses streetshape.app, the site publishes streetshape.io
Whether classroom use is supported — the education material invites it, which makes under-16 users foreseeable and decides the minimum age above.
The statutory retention period for accounting records in the country of incorporation.
Retention windows for municipality demo requests, the email log, and stored Paddle webhook payloads.
Whether Paddle's checkout captures the Art. 16(m) consent and acknowledgement the Terms rely on for digital content supplied immediately.
The region each processor runs in, and the transfer mechanism relied on for each.
Review of all nine documents by a lawyer in the jurisdiction of incorporation.
Whether a data processing agreement is actually executed with each provider on the sub-processor list, and whether a StreetShape DPA template exists for a municipality or university to sign.
Which imagery and elevation providers sit behind MapTiler's satellite and terrain styles, read from the styles themselves rather than written from memory.
Whether MapTiler's agreement permits printing and republishing satellite imagery, which is a different grant from viewing it on screen.
Whether the Digital Services Act treats StreetShape as a hosting service or an online platform — public proposal boards and consultations point at the second, which carries notice-and-action, statement-of-reasons and appeal duties.
Whether access to production data is logged, and whether a backup restore has ever actually been run.

1. The short version

We use a small number of cookies to keep you signed in, and store a few of your choices on your own device. We do not use advertising cookies, tracking cookies, or third-party analytics that follow you around the internet.

Why there is no cookie banner

Consent is required for storage that is not strictly necessary for the service you asked for. We do not use any. A banner would be asking your permission for something that is not happening — and it would make the dialog easier to ignore on the day it actually meant something.

If that ever changes, we will ask before anything loads, not after, and this page will say so before it happens.

3. Strictly necessary

These make signing in work. They cannot be turned off, and they do not require consent. They are set by Clerk, our authentication provider, on our domain.

Strictly necessary cookies
Name	Set by	What it does	Lasts
`__session`	Clerk	The signed-in session. Without it every page load signs you out	Session, refreshed while you use the site
`__client_uat`	Clerk	Tells the server whether a signed-in session exists, so a page can render as signed in without a round trip	Session

Clerk may set additional cookies of its own, in development or as its implementation changes. Its documentation is authoritative on the exact set; if what your browser shows does not match this table, tell us and the table is what gets fixed.

4. Preferences on your device

These remember a choice you made. They are not cookies and are never sent to us — they live in your browser’s local storage, and clearing them just resets the choice.

Preferences stored in your browser
Name	Set by	What it does	Lasts
`streetshape:draft:v1`	StreetShape	A plan drawn before signing up. It is the only copy — it stays on this device until you make an account and it is saved	Until claimed or cleared
`streetshape:view-type`	StreetShape	Which basemap a new plan opens with	Until cleared
`streetshape:buildings`	StreetShape	Whether buildings are drawn on the map	Until cleared
`streetshape:plans-sort`	StreetShape	How your plans are sorted in the dashboard	Until cleared
`streetshape:plans-view`	StreetShape	Grid or list, in the dashboard	Until cleared

One of these deserves a warning. streetshape:draft:v1 holds a plan drawn before signing up, and it is the only copy. Clearing your browser data, or opening StreetShape on another device, loses it. Make an account and it is saved properly.

5. Third parties

Payment

When you buy something, Paddle’s checkout sets its own cookies to take the payment and prevent fraud. Paddle is an independent controller for that, and its cookie policy applies.

Maps

Basemap tiles are served by MapTiler. Tile requests are ordinary web requests — your IP address reaches MapTiler because that is how a browser fetches an image — but no tracking cookie is set through us.

Currency

Prices are quoted in a sensible currency by reading an approximate country from the request at the edge. There is no currency cookie, because nothing is stored — the answer is worked out per request and thrown away.

6. What we do not set

No advertising cookies.
No third-party analytics.
No session replay or heatmaps.
No social-media pixels.
No cross-site tracking of any kind.

This is a statement about what is installed, not an intention. There is no analytics package in the application at all.

7. Controlling what is stored

Every major browser can block or clear cookies and site data in its settings. Clearing the preferences above is safe — you will lose an unsaved draft and your choices reset. Blocking the strictly necessary ones will sign you out, and keep signing you out.

We do not implement Global Privacy Control or Do Not Track signals, because there is nothing here for them to switch off.

8. Changes

Any change is posted here with a new date. If we ever add something that needs your consent, we will ask for it before it loads. Questions go to hello@streetshape.io, the wider picture is in the privacy policy, and the providers whose code runs on these pages are listed at /subprocessors.