Privacy Notice

This notice explains how StreetReport handles personal data. It applies to the StreetReport mobile app, the streetreport.co.uk website, and the council / field-crew pages at streetreport.co.uk/t/….

We try to collect as little personal data as possible. The core design of StreetReport is that councils can act on reports without knowing who sent them. Reporters are identified to councils by a pseudonym (e.g. Bright Falcon), not by their phone number or name.

Who we are

StreetReport is operated as a personal project by the owner of the streetreport.co.uk domain. For data-protection purposes the operator is the data controller. You can contact us via our contact form.

What we collect and why

Your phone number

When you first sign in, we send you a one-time verification code by SMS and store the hash of your phone number so we can recognise you on re-install or a new device.

Legal basis: performance of a contract (you asked us to help you report issues to councils).

Reports you submit

For each report you submit we store:

• the photo you took
• GPS coordinates (either from the photo's EXIF or your device's current location)
• any notes you add
• the AI-generated category and description we use to route the report
• a pseudonym derived from your phone number

Legal basis: performance of a contract.

Device push token

If you allow notifications, we store the push token your device gives us so we can tell you when a council updates the status of your report. The token is an opaque identifier, not a phone number.

Legal basis: your consent (you can turn this off in your phone's settings at any time).

Diagnostic telemetry

We log basic request metadata (URL, response status, timing) to keep the service running. This is first-party operational logging, not advertising tracking. Our public marketing pages also use Google Analytics, which is described under Cookies below.

Legal basis: our legitimate interest in keeping the service reliable.

Who we share it with

• The council your report is routed to. They see the photo, location, notes, category, and your pseudonym. They never see your phone number or name.
• The field crew the council dispatches. They see what the council sees.
• Our processors: Microsoft (Azure hosting, UK South region), Anthropic (image classification), Resend (transactional email to councils), Vonage (SMS verification codes), Firebase Cloud Messaging and Apple Push Notification service (to deliver push notifications to your device).

We don't sell your data and we don't share it with advertisers.

Where it's stored

Your data is stored in Microsoft Azure data centres in the UK South region. Some processors (for example Anthropic and Apple) may process small amounts of data in the United States under standard contractual clauses.

How long we keep it

• Reports and their photos: up to 24 months after resolution, so you and the council can refer back.
• Phone-number hash and push token: until you ask us to delete your account.
• Diagnostic logs: 30 days.

Your rights

Under the UK GDPR you have the right to:

• access a copy of your personal data
• have inaccurate data corrected
• have your data deleted
• object to processing or ask us to restrict it
• ask for your data to be exported to another service
• complain to the Information Commissioner's Office

To exercise any of these rights, use our contact form and tell us the phone number associated with your account so we can verify. We aim to respond within 30 days.

Children

StreetReport is not aimed at children under 13. If you're under 13, please don't use it; if we learn we've got data about a child under 13, we'll delete it.

Cookies

Our public pages use Google Analytics, a service provided by Google, to understand how visitors find and use the site. This includes the marketing pages and the public, shareable report pages (the streetreport.co.uk/t/… links). It sets cookies and collects usage data such as the pages you view, approximate location, device type, and how you arrived. We do not load it on the council management or field-crew views that carry a private access token, or on the admin console, so a management or crew link a council receives is never sent to Google. We don't use advertising trackers, and we don't sell your data.

Changes

If we materially change this notice we'll update the date at the top and, if you're a registered user, notify you in-app the next time you open the app.