Privacy without surveillance analytics.

1. Scope

This notice describes the information Street processes to provide, secure, support, measure, and improve Releases 1 and 2. Release 2 measurement described below begins only when those features launch. Street does not sell personal information or provide customer-facing visitor analytics.

2. Account and workspace data

Street processes your name, verified email, authentication account, sessions, workspace name and timezone, link and link-list configuration, internal names, destinations, schedules, limits, lifecycle state, and management audit events.

Authentication and security records support verification, password recovery, session revocation, abuse investigation, and account deletion. Passwords are handled through Better Auth and are not available to Street operators as plaintext.

Link-list configuration may include titles, descriptions, item labels, placement labels and notes, quantity, and owner-defined tags. Access keys are revealed when created or rotated and then stored only as a list-bound, application-peppered verifier. Do not place visitor personal information in owner-entered labels, notes, or tags.

3. Public use, sessions, and security data

An accepted or rejected redirect event may include the link and workspace identifiers, decision, reason category, request method, UTC timestamp, and a bounded client category. The durable enforcement count records how many redirects Street issued.

A visit to a public link list creates an opaque session scoped to that list. A session is a visit, not a person. Street may record when the session started, its last activity, when and why it ended, the list and placement involved, item clicks and position at click time, and access-gate outcomes. Gate outcomes are analyzed as aggregate counts per list and period, never as per-actor histories.

• Product access events do not store raw IP addresses.
• Product data does not include visitor names, accounts, contact details, device identifiers, or location at any precision.
• Sessions never span lists, and Street does not link visits to two different lists as one visitor.
• Destination query values and fragments are not logged.
• Abuse controls may retain a daily rotated HMAC of a truncated IP for up to seven days.
• Full user-agent material is retained for no more than seven days.

4. Operational and product data

Street uses an operational database to serve requests and enforce security. Release 2 adds a separate product database containing typed copies of access, session, click, gate, placement, configuration, metadata-fetch, paste, and hosted-QR events. It is used by Street’s operator to understand product use and reliability and is not exposed as customer reporting in Release 2.

The product database is written only by a scheduled shipper and is never read or written by a visitor-facing request. It does not receive the operational actor HMAC, raw address, visitor identity or location, access-key or grant plaintext, destination hostname, or cross-list visitor linkage.

5. Service providers and analytics

Street uses Vercel for application hosting and platform security, Neon for the operational and product PostgreSQL databases, Resend for transactional and incident email, Google for sign-in and destination reputation checks, and Cloudflare for progressive anti-automation challenges. Providers process only the information needed for their service and security role.

Street sends Vercel Web Analytics one server-side custom event about each product-data shipper run. It contains only categorical outcome, shipped-volume band, and lag state. Street does not install Vercel’s automatic page-view collector and does not send session IDs, visitor addresses, URLs, account data, or other visitor-level fields in that custom event.

6. Retention

• Operational access and Release 2 product-event sources become eligible for deletion after 30 days only after their exact shipment is acknowledged. Unacknowledged events may be retained longer to prevent silent loss.
• Product-database events, aggregates, and business metadata are kept while they serve operation of the application and business, without a scheduled expiry, subject to deletion where law requires it.
• Rate-limit HMAC windows and full user agents: up to seven days.
• Management audit events: 400 days unless a legal hold applies.
• Deleted destination and private link name: removed after the 30-day restore window.
• Account profile data: removed after the 30-day deletion cancellation window unless legal or security retention applies.
• Public identifier tombstones and minimal de-identified ownership or policy evidence: retained to prevent address reuse and stale-link takeover.

7. Your choices

You can edit workspace, link, link-list, and placement information; rotate access keys; revoke account sessions; disable or delete links and lists; and request account deletion through Street. Some tombstone, security, audit, de-identified product, or legal-hold evidence may continue to be retained because it protects public-address integrity or supports the service, subject to legal requirements.

For an access, correction, or deletion question, use the support page. Street may ask you to verify your identity before acting on a request.

8. Contact

Privacy questions can be sent to jerrydblount@gmail.com. Do not include passwords, authentication tokens, or private destination query values in email.