Legal

Acceptable Use and Content Moderation

What is not allowed, how to report something, and what happens when we act. Short, because most of it is obvious and the rest should be specific.

Last updated 17 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. The short version

Design streets. Argue about them. Do not use other people’s streets, names or data to hurt them, and do not pretend an unofficial plan is an approved one.

This policy covers plans, uploads, names, descriptions, reports, proposals, comments, consultation responses, API use and messages sent through StreetShape. It is part of the terms.

Disagreeing is not a breach

StreetShape exists for arguing about streets, public policy and what is wrong with a junction. Criticizing an authority, campaigning for a change most people locally dislike, and organizing other people to support a proposal are all the service working as intended. An unpopular opinion is not a breach of this policy and is not moderated as one.

2. Not against a person

No harassment, stalking or intimidation, and no exposing somebody’s personal information in order to target them.
No threats, no incitement to violence and no discriminatory abuse.
Nothing involving the sexual exploitation of children, ever, under any framing.

Photographs and street reports

Referring accurately to a real place is fine, and so is genuine public-interest discussion of it. What to avoid is the detail the report does not need: names, faces, number plates, the inside of somebody’s home. A house number is often the only way to say where a problem is — that is a reason to include it, not a license to make a point about whoever lives there.

3. No impersonation

Do not pose as a person or an organization you are not.
Do not claim an authority, a role or a mandate you do not have.
Do not present an unofficial proposal as an approved municipal design.

4. No misrepresenting what a design is

Do not claim that StreetShape has certified a design as safe, compliant, professionally sound or approved for construction. It has not, it cannot, and the terms say so at length.

A verification badge means we checked an identity or an institutional affiliation. It is not an endorsement of anything the verified account then says, and it should not be described as one.

5. Nothing unlawful

No unlawful content, and nothing that infringes somebody else’s intellectual-property, privacy or other rights.
Have the rights to what you upload, including images.

6. Do not attack the service

No unauthorized access, and no getting around account or plan restrictions.
No interfering with other people’s use of it, no malicious code, no degrading it for everybody else.

Good-faith security research is governed by the security policy and its safe-harbour terms, not by this section. Finding a vulnerability and reporting it properly is not a breach of this policy.

7. No manipulating a civic process

No knowingly false reports.
No fabricated participation, and no duplicate accounts used to inflate support.
No flooding a process with deceptive or disruptive submissions.

Identify a proposal accurately and follow the published rules of the consultation or board you are submitting to. An institution may moderate its own process under its own rules; we may separately apply this policy to the same content. Whether a submission is public depends on the setting the feature discloses — not every submission is.

The line between organizing and manipulating is intent and honesty, not numbers. Persuading two hundred neighbors to support a proposal is advocacy. Creating two hundred accounts is not.

8. Do not resell access

Using your own designs in paid client work is fine. Reselling account access is not, unless we have agreed it. Using a documented public API is fine within its published conditions and limits.

9. Map data

Do not scrape or redistribute mapping or imagery against its license, and do not strip attribution off an export. The attribution page explains what each source requires and where the lines are — in particular that a rendered picture, an extracted dataset and material used to train a model are governed differently.

10. Publishing and submitting

Publishing makes something public, and submitting sends it to whoever the feature says it sends it to. Both are explained at the point you do them, and the privacy policy sets out who can then see it. Withdrawing the original does not necessarily withdraw a submission somebody else is holding.

11. Reporting unlawful content or a breach

Use the report control where there is one, or write to hello@streetshape.org. For a notice that something is unlawful, please include:

The exact URL, or another location precise enough to find it.
A substantiated explanation of why it is unlawful, with the context that makes it so.
Your name and email address — except where an exception lets you leave them out.
A statement that you believe in good faith that what you have said is accurate and complete.

You can also report a breach of this policy without citing a law. Please do not send abusive or knowingly false notices. Never attach illegal imagery to a report — tell us securely where it is instead.

We acknowledge an electronic notice where you have given us contact details, assess it in a timely, diligent and objective way, and tell you the outcome and what you can do about it where we are required to. A report queue inside a municipality’s own process does not stop you writing to us directly.

12. What we do about a breach

We may ask for a correction, restrict visibility, remove content, restrict a feature, or suspend or close an account. Which of those depends on how serious it is, the context, whether it has happened before, the rights of the people affected, and whether something less restrictive would work.

Where serious harm, unlawful material or a security threat means acting at once, we act at once. Otherwise we normally explain the problem and give a reasonable chance to fix it.

The reasons you get

Where we are required to give a statement of reasons, it identifies the restriction, the facts it rests on, the contractual or legal basis, whether automated means were used, and how to have it reviewed. We will not disclose something where disclosing it would be unlawful or would wreck a protected investigation.

We may preserve evidence and notify an authority where the law requires it or another lawful basis justifies it. We do not treat every policy breach as a crime to be reported.

13. Asking us to look again

Reply to the decision notice, or write to hello@streetshape.org with the decision reference and why you think it is wrong. Where it is practicable, somebody other than the person who made the decision will review it. We correct mistakes without undue delay.

Removing child-exploitation material or other seriously unlawful content urgently does not take away any review or judicial remedy the law gives you. Whether a further statutory complaint mechanism applies depends on how the service is classified under the Digital Services Act and on which exemptions apply — a question in the open items at the top of this page, rather than one this page answers by asserting a legal form.

What a decision means for money you have paid is in the refund policy. Breaching this policy does not automatically entitle us to keep everything you prepaid.

14. Changes to this policy

We update this page as the product grows new ways to be misused. Material changes are explained in advance, as the terms describe.