Last updated: 5 July 2026
MugPassport is an independent, non-commercial fan project created to help collectors track their personal Starbucks mug collections. It is not affiliated with, endorsed by, sponsored by, or in any way connected to Starbucks Corporation or any of its subsidiaries or affiliates.
Starbucks®, the Starbucks logo, and all related marks are registered trademarks of Starbucks Corporation. All intellectual property rights in those marks remain exclusively with Starbucks Corporation. Their use on this website is purely nominative: solely to identify and describe the third-party products that users of this site choose to record in their personal collections. It does not imply any affiliation, licence, or endorsement.
MugPassport does not sell, manufacture, or distribute any Starbucks products. No commercial advantage is derived from any reference to the Starbucks brand.
MugPassport is an independent, non-commercial hobby project, not a registered company. If you have any questions about your data or this policy, you're welcome to reach out directly:
contact@mugpassport.comWhen you create an account and use MugPassport, we collect and store the following data. The first six rows apply to account holders. The last two apply to everyone who visits the site, whether or not they have an account.
| Data | Purpose | Legal Basis (UK GDPR Art. 6) |
|---|---|---|
| Display name | Identify you on the collectors page and public profiles | Art. 6(1)(b): performance of a contract |
| Email address | Account authentication, password reset, email confirmation | Art. 6(1)(b): performance of a contract |
| Password (bcrypt hash only, never stored in plain text) | Secure account access | Art. 6(1)(b): performance of a contract |
| Profile picture (optional) | Displayed on your public profile | Art. 6(1)(b): performance of a contract |
| Collection data (mugs owned / wishlisted) | Core functionality: tracking your mug collection | Art. 6(1)(b): performance of a contract |
| Authentication tokens (httpOnly cookies) | Maintain your login session securely | Art. 6(1)(b): performance of a contract |
| Account activity: when your account last opened the site, and the dates of your visits | Seeing whether the site is worth keeping running, and spotting accounts in trouble. Visible only to the site administrator, never on your profile or anywhere else another visitor can see | Art. 6(1)(f): legitimate interests |
| Usage analytics: pages viewed, the site you arrived from, browser and device type, approximate country and region, and actions such as adding a mug or uploading a photo | Understanding how the site is used, so we can improve it | Art. 6(1)(f): legitimate interests |
| Heatmap data: pooled counts of where pages are clicked and how far they are scrolled, aggregated across all visitors and never tied to an individual visit | Finding out where the site is confusing or broken | Art. 6(1)(f): legitimate interests |
We do not collect payment information, precise geolocation, or any special-category data as defined in Art. 9 UK GDPR.
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
MugPassport is hosted on servers provided by OVHcloud. Server infrastructure is located within the European Economic Area (France). Under UK GDPR, transfers to EEA countries are permitted without restriction, as the UK has recognised EEA states as providing adequate data protection. No sub-processors have access to your personal data other than the hosting infrastructure required to run the service.
Our analytics software (Umami, see section 6) runs on that same OVHcloud infrastructure, under a domain we control. Analytics data is never sent to Google, Meta, or any other third-party analytics provider, and no advertising network receives anything about your visit.
We may disclose data if required to do so by applicable law or by a competent authority.
MugPassport also provides optional tools that let you share your own public profile outside the site: social share buttons (Facebook, X, WhatsApp), your device's native share function, and a downloadable image card. These simply open the destination platform in a new tab or invoke your device's own share sheet; MugPassport does not transmit any of your data to those platforms itself. If you choose to use them, your onward use of that platform is governed by its own privacy policy, not this one.
MugPassport uses only strictly necessary cookies. Under the UK Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies do not require your prior consent.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
mugpassport_jwt | Strictly necessary | Short-lived session authentication (httpOnly, Secure, SameSite=Strict; not accessible to JavaScript) | 15 minutes |
mugpassport_refresh | Strictly necessary | Refresh token to renew the session without re-logging in (httpOnly, Secure) | 7 days (or until logout) |
We use no tracking cookies, no analytics cookies, and no advertising cookies. No advertising or social-media tracking scripts (such as Google Analytics or the Meta Pixel) are loaded by this website.
We do measure how the site is used, with Umami, which we host ourselves rather than handing your visit to an analytics company. Because it is often assumed that any analytics means cookie consent, it is worth being exact about what it does:
We also build heatmaps: pooled counts of where pages get clicked and how far they get scrolled, used for one purpose, which is finding the places where the site is confusing or broken. They are totals across all visitors, not a record of any single visit.
If you would rather not be measured at all, we honour your browser's Do Not Track setting: switch it on and nothing is collected, and the analytics script is not even downloaded.
You have the following rights in relation to your personal data:
To exercise any of these rights, email contact@mugpassport.com with the subject line "UK GDPR Data Request". We will respond within one calendar month, as required by law.
If you believe your data has been handled in a way that does not comply with UK GDPR, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)MugPassport lets you upload photos of mugs you own and an optional profile picture. By uploading a photo, you confirm and agree that:
You retain ownership of your photos. By uploading, you grant MugPassport a non-exclusive, royalty-free licence to store, display, and reproduce the photo within the service, including on your public profile, the collectors page, mug detail pages, and in shareable images you choose to generate (such as the passport share card), for as long as your account or the photo remains active.
Uploaded photos, mugs, and profile pictures are published immediately and are not reviewed by an administrator before going live. MugPassport reserves the right to hide or remove any content, at any time and without notice, that appears to violate these terms or applicable law. To the extent permitted by law, you agree to indemnify and hold MugPassport harmless from any claim, loss, or damage arising from content you upload in breach of these terms.
If you believe a photo uploaded by another user infringes your copyright or other rights, email contact@mugpassport.com with details of the content and your claim, and we will investigate and remove it if warranted.
We may update this page from time to time. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of MugPassport after changes are published constitutes acceptance of the updated policy.