Privacy Policy

1. Who we are

Taste (“Taste,” “we,” “us”) is operated by TakeOnePiece LLC, a Delaware limited liability company based at 1 Broadway, Cambridge, MA 02142, USA. TakeOnePiece LLC is the controller of the personal data described in this policy, for the taste.dev website and public pages, the Taste iOS app, the Taste API and the Taste MCP server (together, the “Service”).

Contact us about privacy at [email protected]. Our representative in the European Union and the United Kingdom under Article 27 of the GDPR and UK GDPR is: [EU/UK REPRESENTATIVE]. We haven’t appointed a data protection officer. We don’t carry out large-scale processing of special categories of data, so we aren’t required to have one. Privacy questions are handled by the team at the address above.

This policy is part of our Terms of Service. Our Cookie Policy explains the (very short) list of cookies and on-device storage we use.

2. The short version

• Taste is public by default. Your profile, username, posts, comments, products and README cards can be seen by anyone on taste.dev and by search engines. Direct messages are private to the conversation, but they aren’t end-to-end encrypted.
• We don’t sell your personal information, and we don’t share it for cross-context behavioral advertising. There are no ads, ad trackers or analytics SDKs in the app or on the website.
• We use AI providers (Google Gemini, and Anthropic Claude when enabled) to power recommendations and AI features. They process data for us under contract and may not use it to train their models. If you connect your own AI agent, it reads your Taste data under your chosen provider’s terms.
• You’re in control. You can edit or delete your content, hide profile sections, block people, revoke agent access and delete your account in the app. Email us for a copy of your data.

3. What we collect

Information you give us

• Account information: your email address and sign-in identifiers from Sign in with Apple or Google (a provider user ID, plus the name, email and profile photo URL the provider shares; with Apple you may share a private relay email). If you connect GitHub (or, where offered, LinkedIn), we receive your account ID, handle, profile URL and email from that provider. We never see your passwords.
• Profile information: display name, username, photos, headline, bio and story, role, seniority, years of experience, education, work situation, languages, goals, skills, tech stack, tools you build with, interests, what you can give and what you’re looking for, links (including support links such as Ko-fi or Patreon), projects and products, README widgets, theme choices and which sections you hide.
• Content: posts, comments, replies, reactions, saves, follows, products, ideas, listings and applications, “pay it forward” thanks and kudos, and direct messages, including message reactions and replies.
• Photos: images you choose to upload from your camera or photo library. The app only accesses the photos you pick.
• Safety information: reports you file (reason and the reported item), blocks, appeals and anything you tell our support team.
• AI inputs: text you type into AI tools, questions you ask the in-app agent, and notes the agent remembers about you (“agent memory”).
• Agent connections: names you give access tokens, the scopes you grant, and the apps you approve through our OAuth connection flow.

Information collected automatically

• Device and log data: IP address, device and browser type, app version, operating system, language, time zone, request URLs, timestamps and error data. It is recorded in our hosting and security logs (Google Cloud and Cloudflare).
• Usage data: which posts and cards were shown to you and which you viewed, reacted to or saved, who you follow, notifications sent and opened, your last-active time and streaks. We use it to rank your feed and to keep counts such as views and reach.
• Push token: if you allow notifications, an Apple Push Notification service device token. The Firebase SDK we use for sign-in and messaging also creates an app installation identifier on your device.
• Approximate location, only if you allow it: Taste can use your device’s rough (neighborhood-level) location to suggest builders and cafés near you. The feature is currently switched off, and the app doesn’t ask for or collect location while it’s off. If we switch it back on, we will ask for iOS permission first, and you can say no or turn it off at any time. We never show your location to other members; only an approximate distance may be shown.

We don’t use advertising identifiers (IDFA). We don’t track you across other companies’ apps or websites. We don’t use third-party analytics or crash-reporting SDKs.

Information from other sources

• GitHub: when you import from or connect GitHub, we fetch your public GitHub profile, repositories, pinned repositories, profile README decorations, followers and star counts. We refresh stars and followers periodically until you disconnect.
• Link previews and site icons: when you add a link, our servers fetch that page to get its title, preview image and icon. To find icons we may ask Google’s public favicon service, which receives the link’s domain (not who you are).
• Other members: content that mentions you, reports about you, and messages sent to you.

Information we derive

We create numeric representations (“embeddings”) of profile and listing text so we can find relevant people, posts and listings. We also compute feed-ranking signals, profile completeness, quality and moderation signals, and statistics such as stars, streaks and reach. We don’t ask for special categories of data (such as health, religion, sexual orientation or political opinions). Please don’t put them in your profile or public posts. If you do, you are choosing to make them public.

4. How we use it, and our legal bases

We use personal data only for the purposes below. If you are in the European Economic Area (EEA), the UK or Switzerland, the GDPR and UK GDPR require a legal basis for each purpose:

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details and object at any time (section 11). Where we rely on consent, you can withdraw it at any time. Withdrawal doesn’t affect processing that already happened.

5. What’s public

Taste is a public network. Your display name, username, photo, profile sections you haven’t hidden, posts, comments, reactions on public posts, products, follows counts and README cards are visible to anyone at taste.dev/@username and through the API. Search engines and other people may index, copy or share them. Other members can see who follows whom and who reacted to what. Posts and replies made by your AI agent are labelled “via agent.”

Direct messages are visible only to the people in the conversation, and to Taste where needed to deliver, secure and moderate the Service (for example when a message is reported). Messages aren’t end-to-end encrypted. Blocking someone hides your profile and posts from them inside Taste, but it doesn’t hide public pages from the open web.

6. AI processing

We use AI in these ways:

• Recommendations (Google Gemini). To rank and recommend, we send profile and listing text (such as headline, bio, interests, tech stack, what you can give and what you’re looking for, and listing titles and descriptions) to Google’s Gemini API to create embeddings. We store the resulting numbers, not new copies of your text, in our database.
• AI tools and agent features (Google Gemini or Anthropic Claude). When you use an AI tool, ask the in-app agent, or request a reply draft, icebreakers, a meeting brief or a pitch, we send the inputs needed for that request to our AI provider. Depending on the feature, that can include what you typed, relevant profile details of you and the other member, notes in your agent memory, and, for reply drafts, recent messages in that conversation. These features only run when you use them.
• Safety screening. We may use AI classifiers, in addition to our own word filters, to screen profile text for spam, scams and adult solicitation.

Our AI providers act as our processors. They process this data only to return results to us, under terms that don’t allow them to use it to train their models. They may keep it briefly for abuse monitoring as their terms describe. AI output can be wrong. Review it before you rely on it or send it.

Agents you connect. If you connect your own AI agent through the Taste MCP server, the agent reads data your token allows (for example your feed, posts, profiles and your notifications, but not your direct messages), and it can act as you if you grant “write.” That data goes to the AI provider or app you chose, under its own terms and privacy policy, not ours. You can see and revoke every connection in Settings → AI agents.

7. How we share it

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We share personal data only as follows:

• With the public and other members, as described in section 5.
• With service providers (processors) who run parts of the Service for us under contract, only for that purpose (the table below).
• With services you connect, such as the AI agent or app you authorize, GitHub, and the sign-in provider you use, at your direction.
• For legal reasons: to comply with law, legal process or lawful government requests, to enforce our Terms, and to protect the rights, property or safety of Taste, our members or the public (including reporting child sexual exploitation to NCMEC).
• In a business transfer, such as a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent, or in de-identified or aggregate form that can’t reasonably identify you.

We also send requests to GitHub (to fetch the public data you import) and to the websites you link to (to build previews). Those are independent third parties. They receive our servers’ requests, not your account details.

8. How long we keep it

We keep personal data only as long as we need it for the purposes above:

Copies of public content may remain in search engines, caches, or places others copied them to. We don’t control those.

9. Security

We use administrative, technical and physical safeguards appropriate to the risk. Traffic is encrypted in transit (TLS). Data is encrypted at rest by our cloud provider. Sign-in tokens are kept in the iOS Keychain on your device. Access tokens are stored only as hashes. Sensitive credentials are encrypted with a managed key service. Our systems run with least-privilege access, rate limits and a web application firewall. No system is perfectly secure, and direct messages aren’t end-to-end encrypted. If a breach affects your personal data, we will notify you and the authorities where the law requires. Report security issues to [email protected].

10. International transfers

TakeOnePiece LLC is based in the United States, and we store and process data in the United States. Our providers may also process it in other countries. If you are in the EEA, the UK or Switzerland, we transfer your data to the U.S. under safeguards the law recognizes. These include the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss amendments) in our providers’ data processing terms (including Google Cloud and Cloudflare), and the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified. Our transfers to you when you use the Service are necessary to provide it under our contract with you. You can ask us for a copy of the relevant safeguards at [email protected].

11. Your rights and choices

In the app

• Edit your profile, hide profile sections, and edit or delete your posts and comments at any time.
• Block people and manage blocks in Settings → Blocked accounts.
• Turn notifications and location access on or off in iOS Settings.
• Disconnect GitHub, and revoke any AI agent or token in Settings → AI agents.
• Delete your account in Profile → Settings → Delete account.

Your privacy rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get information about how we use it;
• correct inaccurate data;
• delete your data;
• portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
• object to processing based on legitimate interests, including profiling for feed ranking and use of your public content to promote Taste;
• restrict processing in certain cases;
• withdraw consent at any time, where we rely on it; and
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement happened. In the UK, that is the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to address your concern first.

How to make a request

Email [email protected] from the email address on your account, or include your username, and tell us what you’d like. We don’t offer a self-serve data export yet. We fulfil access and portability requests by email. We respond within 30 days (or sooner if the law requires). Where the law allows, we may extend that by up to two further months for complex requests, and we will tell you if we do. We may need to verify your identity before acting, and we may decline requests that are manifestly unfounded, excessive or that would affect others’ rights. You can use an authorized agent where the law allows. We will ask for proof of their authority.

Automated decision-making

We use automated systems to rank feeds and recommendations, filter objectionable words, temporarily hide content that receives several reports, and throttle or revoke agent tokens that exceed limits or appear abusive. None of these produce legal effects or similarly significant effects on you within the meaning of Article 22 GDPR. You can ask for a human to review any moderation or enforcement decision at [email protected].

12. U.S. state privacy rights, including California

This section supplements the rest of the policy for residents of California (CCPA as amended by the CPRA) and other U.S. states with comprehensive privacy laws.

Categories we collected in the last 12 months

Sources: you, your device, other members, the sign-in providers and services you connect (Apple, Google, GitHub), and websites you link to. Purposes: those in section 4. Retention: section 8.

No sale or sharing

We do not sell or share (as those terms are defined in the CCPA) personal information, and we haven’t done so in the last 12 months. That includes the personal information of consumers under 16, which we don’t knowingly collect. We don’t engage in targeted advertising, and we don’t profile in furtherance of decisions that produce legal or similarly significant effects. We use sensitive personal information only to provide the Service and for purposes the CCPA permits. We don’t use it to infer characteristics about you, so the right to limit its use doesn’t apply.

Do Not Sell or Share / Global Privacy Control. Because we don’t sell or share, there is nothing to opt out of. We still honor Global Privacy Control (GPC) and similar browser opt-out signals as a valid request to opt out of sale and sharing, for your browser and, if you’re signed in, your account.

Your rights

You have the right to know what personal information we collect, use and disclose, to access it, to correct it, to delete it, to get a portable copy, and to opt out of sale, sharing and targeted advertising (which we don’t do). Make a request as described in section 11. You can also use an authorized agent. We verify requests by matching them to your account. We won’t discriminate against you for exercising your rights. That means no denial of service and no different prices or quality.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing [email protected] within a reasonable time. We will respond within the time the law of your state requires. If you’re unhappy with the outcome, you can contact your state attorney general.

Shine the Light. We don’t disclose personal information to third parties for their own direct-marketing purposes.

13. Children

Taste is for adults 18 and over. We don’t knowingly collect personal data from anyone under 18, or under 13 within the meaning of COPPA. If we learn that we have, we will delete the account and its data. If you believe a minor is using Taste, tell us at [email protected].

14. Changes to this policy

We may update this policy as Taste changes. We will post the new version here and update the “Last updated” date. If a change is material, we will tell you in advance in the app or by email, and ask for your consent where the law requires it.

15. Contact

TakeOnePiece LLC
1 Broadway, Cambridge, MA 02142, USA
Email: [email protected]
EU/UK representative: [EU/UK REPRESENTATIVE]