Last updated: 5 July 2026
MugPassport is an independent, non-commercial fan project created to help collectors track their personal Starbucks mug collections. It is not affiliated with, endorsed by, sponsored by, or in any way connected to Starbucks Corporation or any of its subsidiaries or affiliates.
Starbucks®, the Starbucks logo, and all related marks are registered trademarks of Starbucks Corporation. All intellectual property rights in those marks remain exclusively with Starbucks Corporation. Their use on this website is purely nominative: solely to identify and describe the third-party products that users of this site choose to record in their personal collections. It does not imply any affiliation, licence, or endorsement.
MugPassport does not sell, manufacture, or distribute any Starbucks products. No commercial advantage is derived from any reference to the Starbucks brand.
MugPassport is an independent, non-commercial hobby project, not a registered company. If you have any questions about your data or this policy, you're welcome to reach out directly:
contact@mugpassport.comWhen you create an account and use MugPassport, we collect and store the following data:
| Data | Purpose | Legal Basis (UK GDPR Art. 6) |
|---|---|---|
| Display name | Identify you on the collectors page and public profiles | Art. 6(1)(b): performance of a contract |
| Email address | Account authentication, password reset, email confirmation | Art. 6(1)(b): performance of a contract |
| Password (bcrypt hash only, never stored in plain text) | Secure account access | Art. 6(1)(b): performance of a contract |
| Profile picture (optional) | Displayed on your public profile | Art. 6(1)(b): performance of a contract |
| Collection data (mugs owned / wishlisted) | Core functionality: tracking your mug collection | Art. 6(1)(b): performance of a contract |
| Authentication tokens (httpOnly cookies) | Maintain your login session securely | Art. 6(1)(b): performance of a contract |
We do not collect payment information, precise geolocation, or any special-category data as defined in Art. 9 UK GDPR.
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
MugPassport is hosted on servers provided by OVHcloud. Server infrastructure is located within the European Economic Area (France). Under UK GDPR, transfers to EEA countries are permitted without restriction, as the UK has recognised EEA states as providing adequate data protection. No sub-processors have access to your personal data other than the hosting infrastructure required to run the service.
We may disclose data if required to do so by applicable law or by a competent authority.
MugPassport also provides optional tools that let you share your own public profile outside the site: social share buttons (Facebook, X, WhatsApp), your device's native share function, and a downloadable image card. These simply open the destination platform in a new tab or invoke your device's own share sheet; MugPassport does not transmit any of your data to those platforms itself. If you choose to use them, your onward use of that platform is governed by its own privacy policy, not this one.
MugPassport uses only strictly necessary cookies. Under the UK Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies do not require your prior consent.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
mugpassport_jwt | Strictly necessary | Short-lived session authentication (httpOnly, Secure, SameSite=Strict; not accessible to JavaScript) | 15 minutes |
mugpassport_refresh | Strictly necessary | Refresh token to renew the session without re-logging in (httpOnly, Secure) | 7 days (or until logout) |
We use no tracking cookies, no analytics cookies, and no advertising cookies. No third-party scripts (such as Google Analytics or Meta Pixel) are loaded by this website.
You have the following rights in relation to your personal data:
To exercise any of these rights, email contact@mugpassport.com with the subject line "UK GDPR Data Request". We will respond within one calendar month, as required by law.
If you believe your data has been handled in a way that does not comply with UK GDPR, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)MugPassport lets you upload photos of mugs you own and an optional profile picture. By uploading a photo, you confirm and agree that:
You retain ownership of your photos. By uploading, you grant MugPassport a non-exclusive, royalty-free licence to store, display, and reproduce the photo within the service, including on your public profile, the collectors page, mug detail pages, and in shareable images you choose to generate (such as the passport share card), for as long as your account or the photo remains active.
Uploaded photos, mugs, and profile pictures are published immediately and are not reviewed by an administrator before going live. MugPassport reserves the right to hide or remove any content, at any time and without notice, that appears to violate these terms or applicable law. To the extent permitted by law, you agree to indemnify and hold MugPassport harmless from any claim, loss, or damage arising from content you upload in breach of these terms.
If you believe a photo uploaded by another user infringes your copyright or other rights, email contact@mugpassport.com with details of the content and your claim, and we will investigate and remove it if warranted.
We may update this page from time to time. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of MugPassport after changes are published constitutes acceptance of the updated policy.