²⁸Limits, Ethics, Privacy

People still live in this building, so the site's first rule protects the living. Anywhere the site would name a living person, a publication gate stands in the way before the page can be built. The gate has four settings, and a machine checks each one. Under consent-required, the site knows a living person belongs to the story but has no permission to name them; it withholds the name and prints a plain description instead until a permission is logged. Under consent-recorded, a release or a documented agreement is on file, and the name may appear. Under anonymised, the person is deliberately left unnamed and a plain description takes the name's place. Under public-role, the person acted in a documented public capacity and is named as the public record already names them. If none of the four is set, the gate fails closed: the build stops rather than print a living name on a guess.

Most of the work is done by one distinction. People who acted in a public, documented role appear under their own names, as the public record already carries them: the people who ran the venue years, and the founders and programmers written up in the press and the listings. Private people are treated the opposite way. A descendant who answered a letter and let the project photograph a family painting is not a public figure. They are described by what they did, not named, and no birth date, address or way to contact them is printed anywhere. Consent can move a name from one setting to another. Where a private contributor has since agreed to be credited, the site names them; where no agreement is on record, it does not. The same discipline binds the people who made the site, and no living member of the household is named beyond the author's own byline. The review workflow refuses any change that would break the gate, and the deep dive on the review gate explains how.

Some of what the research turned up could damage a reputation or a memory, and with material like that it is tempting to round it up or down. The site does neither. One rule, applied every time: report what the source establishes, say plainly what it does not, and never let two separate findings lean on each other.

The clearest case concerns one of the two boys who laid the first stone¹. In January 1942 an occupation-era pro-German cultural weekly printed an interview with the painter Gerrit van Duffelen, conducted and signed by its interviewer². Alongside a traditionalist view of art, the article attributes to him positions congenial to the occupation's cultural programme³.

The interview belongs to the record, and the site sets it down at its exact size. It reports what the piece shows and stops there: an interview, and the opinions it attributes to him. The same record shows no evidence of party membership and no documented occupation-era activity beyond his continuing to teach in Amsterdam⁴, as nearly all working Dutch artists did in those years⁵. The page states the first and does not manufacture the second. The deep dive on the 1942 interview gives the interview, its interviewer and its full text. The second case gets the same treatment. The directors of a furniture firm that briefly used the corner were detained in 1945 on a suspicion of collaboration resting on the firm⁶. No charge, tribunal or finding of any kind has surfaced since in the digitised record⁷. So the site writes it up as an accusation with no recorded resolution, which is neither guilt nor clearance, and the open-question box on the detention sets it out.

A separate finding shows why the last part of the rule matters. A street-wide survey of the wartime clearance of Jewish household property covers this street, and no evidence has been found linking any firm that occupied no. 169 to it⁸. That is a bounded negative: a search ran and returned nothing. The site prints it as exactly that, never as an acquittal, and keeps it well away from the 1945 detention. The two answer different questions, and neither may soften the other.

Leaving something off the page is still a decision. The site records these decisions instead of making them silently, so the choices themselves can be audited. Four kinds of thing are kept out of publication on purpose.

First, private contact details of living people are never published in any form. Second, unreleased family material stays out. Where a descendant of one of the founding families has shared material with the research that the family has not released for publication, among it a rare likeness held in a private collection, that material is kept off the public pages until the donor confirms permission; the site records that it exists but does not reproduce it. A blanket clearance for the project's own material does not reach a third party's, and that material stays unpublished until the third party gives permission. Third, the precise residence of any living descendant is kept out, even where it is known. Fourth, the large body of working material in the research files that supports no published claim is preserved but not surfaced. One more exclusion is about accuracy, not privacy. An image sometimes taken for this building is, according to the owner-resident who lives behind the wall, not no. 169. It is kept off every page as a picture of the house, and the dispute appears only where it belongs, in the method note on false positives.

None of this makes the site complete, and it is not meant to be. It marks its edges rather than hiding them. The last page turns from what the site withholds to what it offers: how to cite it, reuse it and correct it.