Privacy and cookies

TasteGraph runs its own analytics. No Google Analytics, no advertising pixel, no cross-site tracker, and nothing collected here is sold or handed to a data broker. This page is the exact list of what gets stored and how long it lasts.

The cookies we set

Three, all first-party and all signed by this server so their contents cannot be edited in your browser.

_tg_vid is the analytics cookie. It holds one random identifier and nothing else: no name, no email, no history. Its whole job is to tell a returning visitor apart from a new one. HttpOnly, SameSite=Lax, and it expires 395 days (about 13 months) after it is written. A plain page fetch does not set it. Your browser gets it once it does something a one-hit scraper does not do, which in practice means opening the live page connection or entering the taste flow.

_taste_graph_key is the session cookie. Signed, HttpOnly, and gone when you close your browser. It carries the state of the page you are on and, once you log in, the reference to your login session.

_taste_graph_web_user_remember_me is written only if you tick "Remember me" when logging in. Signed, HttpOnly, good for 60 days, and deleted when you log out.

What we record

All of it is stored against that random identifier, not against your name and not against your IP address.

• The pages you open, by path. Query strings are dropped before anything is written, so search terms never reach the log. The token inside a login link or an email confirmation link is replaced with :token first, so a live credential is never written down.
• A short fixed list of named actions, not a general firehose: starting the taste flow, submitting a rating, kicking off an analysis, viewing your reveal, saving a recommendation, sharing, signing up, and claiming a guest account. Each records the action name and the page it happened on. A rating also records whether it was a movie, show, game, or book, and whether it came from the starter list, a search, or a suggestion.
• A rough country code, such as US or GB, read from the language your browser sends. It picks which streaming services we show you. It is never taken from your IP address.
• Where you arrived from: the referring site reduced to host and path, plus utm_source, utm_medium and utm_campaign if the link carried them. Those three keys are the only things read out of a URL. A link followed from inside TasteGraph counts as no referrer at all.
• A broad device category: mobile, desktop, tablet, or unknown. We derive it when your browser first connects. Only the broad category is stored in visitor analytics.
• One row per calendar day you were here, which is how we tell whether people come back.

Requests from known bots, and from admin accounts, are not recorded at all.

What we do not record

No third-party analytics or advertising scripts run on this site. No cross-site or cross-device tracking. No session recording, no heatmaps, no mouse or keystroke capture, no browser fingerprinting. Your IP address is not stored with any of the analytics above. The production proxy keeps IP addresses and user agents briefly in a rolling 10 MB access log for operations, overwriting old entries as it fills. The app also holds IP addresses in memory to rate limit abuse. None of this is sold or shared for advertising.

How long it is kept

A job runs daily and deletes raw events older than 180 days. It also deletes visitor records after 400 days with no activity, but only the ones that were never linked to an account and have no events left. The one row per active day sticks around for visitors who are still here, since it holds nothing beyond the date.

If you have an account

Signing up, or becoming a guest, stamps your account onto the visitor record, which links everything above to you.

The account itself holds your email, username, region, your ratings, the recommendations generated for you along with their written explanations, and your taste profile. We also log what became of each recommendation you were shown: seen, saved, dismissed, rated, or clicked through. That is what stops the same picks coming back around.

Clicking through to a retailer goes via our own redirect, which logs the click, the item, and the retailer so a commission can be matched to it. See the affiliate disclosure .

You can download all of it as JSON from Settings . It is available on every account, paid or not.

Deleting your account

Settings has a Delete account control. You type your username to confirm, and if the account has a password you enter that too. There is no grace period and no undo.

It removes the account row and everything hanging off it: your email and username, your ratings, your taste profiles, your recommendations and their outcomes, your saved items, your connected import sources and their stored tokens, your login tokens, your daily activity rows, any issue reports you filed, your subscription record, and the log of AI work run for you. Your public profile and its unfurl image stop resolving immediately, and queued background jobs for the account are dropped.

The analytics above go with it. The visitor record, its events, and its per-day rows are deleted outright rather than just unlinked, and your browser's _tg_vid cookie is cleared on the way out, so nothing left behind can be tied back to you later. Records of outbound clicks to retailers are deleted too.

One thing is written when you delete: a single anonymous row saying that a deletion happened. It holds the date, how many days the account existed, how many ratings it had, whether it had a taste profile, which plan it was on, and whether the email was confirmed. There is no account id, no email, no username, no scrambled version of any of those, and no free text, so it cannot be matched to you or to any other record. We keep it to know how many people leave and roughly what they had, and that is all it can tell us.

Two things stop a deletion. An active paid subscription has to be cancelled first, through the billing portal, so nothing keeps charging a card after the account is gone. And an account that has taken administrative actions carries a record of those we keep, so it has to be handled by hand.

Other companies involved

A few requests leave this site by design. Fonts load from Google Fonts and cover art from the image services of our metadata sources, so those servers see your IP address the way any web request exposes it. Crashes are reported to Sentry, our error monitoring provider, and a crash report includes the page URL plus, when you are logged in, your account id. Your email address is not sent: the id is enough for us to find the account here, and an address in a form or a URL is redacted before the report leaves. Account email goes out through Mailgun. If you subscribe, payment runs through Stripe and card details never touch our servers.

Turning it off

Delete cookies for this site in your browser settings and the _tg_vid identifier goes with them. Next visit you are a new visitor. Blocking cookies for this site stops it being written again, at the cost of not being able to stay logged in. There is no in-product opt-out switch today.

Last updated: 2026-09-11