Privacy

Data-minimising address autocomplete

StreetKit is designed so New Zealand address autocomplete can run without collecting the rest of a customer's form.

StreetKit privacy summary

The StreetKit browser widget is an address autocomplete tool. It uses typed address text to rank StreetKit address suggestions, then returns a selected address object in the browser after the user chooses a suggestion.

The widget does not need the customer's identity, account, checkout, payment, or full form payload to provide address suggestions.

What the widget needs

  • The typed address query, used to rank matching suggestions.
  • StreetKit address data from the configured indexBaseUrl.
  • The selected address ID and selected address coordinates only as needed for selected-address output, configured field mapping, Radius, or Drive Zones.
  • A public siteId only when a registered integration has configured one.

In hosted mode, the raw typed query is not submitted as a form payload. Normal service logs may still include request metadata created while suggestions are loaded.

What the widget does not need

  • Names.
  • Emails.
  • Phone numbers.
  • Cart contents.
  • Payment data.
  • Customer IDs.
  • Account IDs.
  • Order IDs.
  • Full form payloads.

Field mapping writes selected address values only to fields the site explicitly configures. StreetKit does not scan unrelated form fields, create missing checkout fields, or replace the site's own form submission logic.

WooCommerce autocomplete integrations should keep the same boundary: StreetKit suggestions are an enhancement, manual address entry must remain available, and StreetKit should not receive names, emails, phone numbers, cart data, payment data, order IDs, customer IDs, account IDs, or whole checkout payloads.

Public and registered mode

Public mode uses the public StreetKit address data endpoint: https://index.streetkit.smp.kiwi/public/v1/meta.json. It is intended for demos, evaluation, hobby projects, community use, and low-volume access.

Registered browser mode uses a customer-specific metadata path such as https://index.streetkit.smp.kiwi/c/{siteId}/v1/meta.json. The widget can then label StreetKit address data requests with ?site={siteId}.

A siteId is public. It is visible in browser JavaScript, metadata, request URLs, logs, and developer tools. It is not authentication, not a password, not an API key, not a bearer token, and not proof that a request came from a particular site.

Logs and analytics

StreetKit creates normal web requests to the product site and address data host. Operational systems may record request metadata for delivery, debugging, security, abuse prevention, and reliability.

Request metadata may include IP address, user agent, request path, origin or referer, status, cache information, timing, and a public siteId when one is present. Detail-file requests may show that a browser selected or inspected a particular address detail object.

Site analytics configuration is not yet configured. No analytics provider script is configured in the current site source checked for this page. If analytics are added later, this page should be updated before they are enabled.

Contact, support, sponsorship, and siteId request data

StreetKit has contact and siteId request forms, plus support and sponsorship pages. These are separate from address autocomplete and are used only to review or respond to the request submitted.

A contact message may ask for a name, email, topic, optional website or project, and the message itself. A siteId request may ask for a website or domain, contact email, organisation or project name, use case, expected traffic, integration mode, and notes. This data is for manual review and operation, not for address autocomplete ranking.

If sponsorship or private-support handling is requested, manual records may include support contact details, public acknowledgement fields, logo/link permissions, consent status, payment or billing references, and private support notes. Public sponsor listings should show only reviewed opt-in public fields.

Data retention

Retention for service logs, siteId request records, support records, sponsorship records, and any future analytics is to be defined.

StreetKit should not publish a retention period until the actual operational policy is reviewed and documented.

Third-party services

  • StreetKit uses operational service providers for hosting, delivery, security, rate limiting, and logs.
  • Analytics configuration is not yet configured.
  • Contact and siteId request forms use basic bot protection and request storage for manual review. Email remains available at hello@smp.kiwi.
  • LINZ is the source of the first StreetKit physical-address dataset. StreetKit does not query LINZ while users type addresses into a form.
  • Drive Zones may use OpenStreetMap-derived data when that feature has been configured.

Address data limitations

StreetKit v1 is for New Zealand physical-address autocomplete from official/open source data where legally possible. It is not an official government, postal, courier, identity, or address verification service.

  • No NZ Post delivery certification.
  • No DPID support.
  • No PO Box support unless implemented later.
  • No Private Bag support unless implemented later.
  • No postal delivery guarantee, courier deliverability check, or postal-vs-physical address matching.
  • Postcodes and coordinates are source data when present, not delivery certification.

Contact and rights

Privacy contact to be configured.

The current site does not have a reviewed public privacy contact link. Do not put private customer data, full addresses tied to people, order records, payment details, or secrets into public GitHub issues.

Last updated

2026-05-26