Privacy

What we collect, and why

• Your selfie. Used for two things: an AI checks that it's a real person photographed directly, and another paints your portrait. As soon as your card is made, the selfie is deleted. If you start and never finish, it's deleted within 24 hours. We never show it to anyone, and we never create or keep a faceprint, face template or any other biometric identifier from it.
• Scanner photos. When you scan the code on a friend's phone, the Mug camera sends one small still of what it saw to an AI, which checks there's a real phone in front of you (phone codes only work in person). It can include your friend's hand or face and whatever is behind them. It's checked and thrown away: never stored, never shown, never used to recognise anyone. Printed cards don't need this.
• Your birthday. We check you're 18 or older, then keep only the day and month (for birthday reminders), not the year.
• Your email, if you give it. To get your card back to you on a new phone and to tell you when a box ships. Only if you tick the box do we also send occasional news. Every email will have a way to stop them.
• Your card. The painted portrait and what you type (name, handle, tagline, stats, “Notorious for”, any social handles). Kept until you delete your card.
• Who you've mugged. Your Lineup, who has your card, your crews, finishes and free cards. That's the game.
• Orders. The name, shipping address and email you give at checkout, to ship your cards and send receipts and tracking. Payments aren't live yet. When they are, you pay on Stripe's own secure page: we never see or store your card number.
• A random phone id. Stored with each mug so one phone can't mug the same person from several cards.
• Anonymous usage counts. Which steps people reach (like “made a card”), with a random id, never your name, handle, photo, IP address or anything you type. Turned off entirely if your browser sends Do Not Track or Global Privacy Control. Kept 90 days.
• Your IP address is used briefly to stop abuse (rate limits, counting reports) and isn't stored.

Who else touches it

• Cloudflare hosts the site and its data (cards, portraits and orders), and runs the AI that checks your photo, checks phone scans and suggests your card's words.
• OpenAI paints your portrait from your selfie.
• Our printer gets the card images and the shipping address for printed orders, once payments are live, and Stripe will handle payment details (we never see your card number). When friends split a crew box, Stripe handles each share the same way.

They process it for us, under their business terms, to provide those services. We don't sell your information, and today we don't share anything with advertisers. If that ever changes (for example, telling an ad network that a visit from one of its ads became a card), it will be listed here first, it will never include your photo, card or name, and you'll be able to opt out.

Who can see your card

Cards are private by default: anyone with your link or your printed card can see it, and nobody else. It's not on Most Wanted or in search engines unless you turn those on in Edit. Your crew can see your card on the crew wall. Printed cards carry the version you ordered.

On your phone

There are no accounts. Your card's key lives in your browser, which is why we offer a backup link (Me → Back up your card). Treat that link like a password. If you order, your address is remembered in your browser to save typing next time.

Deleting

Edit → Delete my card removes your card, your portraits and your Lineup for good. Printed cards stay in the world, and their numbers keep working, but they show that the card was deleted. Order records keep their card numbers (so printed QRs resolve) with your name, address and email removed. Our backups roll over within 14 days.

Age

Mug is for people 18 and older. If you think someone younger made a card, report it.

Changes

If this changes in a way that matters, we'll say so on the site before it takes effect.