Last updated: May 8, 2026
This Privacy Policy explains how tasteful.md ("tasteful", "the Service", "we", "us", or "our") collects, uses, stores, and protects your information when you use our web application. By using the Service, you agree to the collection and use of information in accordance with this policy.
tasteful is a tool for creating, editing, and sharing markdown configuration files that power AI agents. This policy covers both your direct interactions with the Service and interactions made by AI agents on your behalf through the Model Context Protocol (MCP).
When you create an account and sign in using a supported authentication method (Google OAuth or email/password via a third-party authentication provider), we collect and store:
We store the content you create within the Service, including:
When AI agents connect to your projects via MCP tokens, they may read and modify your project files. Content written by AI agents is stored in the same manner as content you create directly. We do not separately track or label which content was created by you versus an AI agent.
When you access the Service, our infrastructure provider may automatically collect limited technical information, including:
We do not use analytics services, tracking pixels, or fingerprinting technologies. We do not build behavioral profiles of our users.
We want to be explicit about what we do not collect:
We use the information we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Authenticate you and maintain your session | Email, account identifier, authentication cookie |
| Associate projects and files with your account | Account ID, project and file data |
| Display your public profile and projects | Username, public project content |
| Validate MCP token access for AI agents | Token hash, project association |
| Cache public content for performance | Public project and profile data |
| Protect the Service from abuse | IP address (via infrastructure provider), request patterns |
| Respond to your support requests | Email, account information |
We do not use your information for advertising, marketing, user profiling, automated decision-making, or AI model training. We do not sell, rent, or trade your personal information to third parties.
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:
Projects you mark as public are viewable by anyone with the link. Your username is displayed on public project pages and your public profile. Public content may be:
Private projects are accessible only to you and to AI agents you have explicitly authorized by creating MCP tokens for that project. We do not access, review, or share the content of private projects except as required by law or to maintain the Service.
When you create an MCP token and provide it to an AI agent, that agent can read and modify files in the associated project. The data exchanged between the AI agent and the Service is transmitted over HTTPS. We do not control what AI agents do with the content they access. You should review the privacy policies of any AI agent or platform you connect to the Service.
We do not sell, rent, or share your personal information with third parties for their marketing purposes. We do not participate in data broker networks. We have not sold personal information in the preceding 12 months.
We use a small number of third-party services to operate tasteful. These providers process data only as necessary to perform their specific function:
We do not use analytics services, advertising networks, or any other third-party services beyond those required to operate the Service. If this changes, we will update this policy before introducing any new provider.
We use a minimal number of cookies, all of which are essential for the Service to function:
| Cookie | Purpose | Duration |
|---|---|---|
firebase_token | Maintains your authenticated session | Session (expires on browser close or token expiry) |
csrf_token | Protects form submissions from cross-site request forgery | Session |
We do not use non-essential cookies, tracking cookies, advertising cookies, or analytics cookies. We do not use pixel tags, web beacons, or similar tracking technologies. Because we do not use tracking cookies, there is no need for a cookie consent banner.
We honor Do Not Track (DNT) signals. However, because we do not track users across websites or use behavioral advertising, there is no tracking behavior for DNT to disable.
When you create an MCP token to connect an AI agent, the raw token value is displayed exactly once at the time of creation. We store only a SHA-256 cryptographic hash of the token. We cannot recover, display, or reverse the raw token value after creation. If you lose a token, you must create a new one.
An MCP token grants the connected AI agent access to:
Tokens are scoped to a single project. An agent with a token for one project cannot access other projects in your account.
We do not log raw MCP token values, the content of MCP requests or responses, or the identity of AI agents connecting to the Service. We may log metadata for operational purposes (such as request timestamps and error codes) but not the substance of the data exchanged.
Your data is stored in a managed database hosted by a third-party provider. The Service runs on a globally distributed network. Your data may be processed in data centers located outside your country of residence. By using the Service, you consent to the transfer of your data to these locations.
We protect your data through the following measures:
No method of electronic storage or transmission is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and MCP tokens.
We retain your data for as long as your account is active or as needed to provide the Service:
You can delete individual files, projects, and MCP tokens at any time through the Service. You can delete your entire account, which removes all associated data from our active database. After deletion:
You can export your content at any time using the Service's download features or by retrieving files through MCP. Your content is stored as plain markdown text and can be used with any compatible tool or platform.
Regardless of your location, you have the right to:
If you are located in the European Economic Area or the United Kingdom, you have additional rights under the GDPR, including:
To exercise any of these rights, contact us at hello@tasteful.md. We will respond to requests within 30 days.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:
To exercise these rights, contact us at hello@tasteful.md. We will respond within 45 days as required by law.
The Service is operated from globally distributed infrastructure. Your data may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction.
Where required by law, we rely on appropriate safeguards for international data transfers, including the service providers' adherence to standard contractual clauses, data processing agreements, or equivalent mechanisms recognized by applicable data protection authorities.
The Service is not directed to children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children under these ages. If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at hello@tasteful.md.
If tasteful is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will make reasonable efforts to notify you before your information becomes subject to a different privacy policy, and you will have the opportunity to delete your account and data before any such transfer.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will:
Your continued use of the Service after any changes indicates your acceptance of the updated policy. If you do not agree, you should stop using the Service and delete your account.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at hello@tasteful.md.
For data protection inquiries from EEA/UK residents, you may also contact your local data protection authority.