Legal

Privacy Policy

Last updated: August 1, 2026. Plain English where we can manage it; lawyer English where we must.

MrStach.com ("Mr. Stach", "we", "us") is a website celebrating mustaches: an entertainment publication, an encyclopedia, a community and a collectible-card platform. This policy explains what information we collect, how we use it, and the choices you have. By using the site you agree to this policy and our Terms of Service.

1. Information We Collect

Information you give us

Account information: email, password (stored only as a secure hash), display name and optional first name.
Stach profile & uploads: your photo, name/nickname, location, occupation, employer/department, service details you choose to share (e.g. military branch), story answers, social links, identity tags, and your privacy choices.
Votes and battle votes, and reactions you leave on legends and community profiles.
Newsletter sign-up: email, optional first name, topic preferences and the time of consent.
Print and book orders: product, quantity and shipping details. We do not collect or store card numbers — payment processing is handled by a third-party processor when it launches, and we'll update this policy at that time.
Contact messages sent through our contact form.

Information collected automatically

First-party analytics: page views, events such as card views, shares, votes and sign-ups, a hashed session identifier, a hashed IP address, referrer and browser type. We run our own analytics; we do not load third-party tracking pixels for advertising.
Cookies: a session cookie (login and CSRF protection), an optional "remember me" cookie if you choose it, and a small amount of local storage for preferences (e.g. dismissing the install banner). No third-party advertising cookies.
Server logs for security and debugging, retained for a limited time.

2. How We Use Information

To run the site: accounts, profiles, cards, rankings, battles and the newsletter.
To moderate submissions and enforce our Submission Guidelines.
To create your collectible card and, only if you opt in, AI-stylized "Legend" versions of your photo (see Section 4).
To fulfil print and book orders through a print-on-demand partner (we share only what's needed to print and ship).
To prevent abuse: rate limiting, duplicate-vote detection and spam filtering.
To understand what's working, via first-party analytics, so we can make a better site.
To reply to you when you contact us.

3. Uploads, Likeness and Public Display

When you upload a photo and story you are choosing to make a public profile. Approved profiles, cards and the information you marked public are visible to anyone, may appear in rankings, battles, Stach of the Day, social previews and print products you order, and may be shared by other users via links. Use the privacy toggles in your account to hide your city, state, last name, occupation, employer, military details or story. Your email address is never displayed publicly.

The license you grant us for your likeness and uploads is described in the Terms of Service. You can delete your account at any time (Section 8).

4. AI Transformations — Consent and Revocation

Some card editions use AI image tools to create a stylized version of your photo (for example a vintage baseball or 1880s gentleman look). This is strictly opt-in:

We only create AI variants if you tick the AI consent box, and we record the date and consent version.
Your photo is sent to our AI image provider solely to generate your variant. We instruct providers not to use your image to train their models, where the provider offers that control.
You can revoke consent at any time from your account profile page. On revocation we stop generating AI variants, remove the AI image from your card, and delete the stored AI variant within 30 days.
AI variants are clearly labeled as AI-styled. We don't create AI images of people who have not consented, and we reject uploads of other people's photos.

5. Cookies and Analytics

We use strictly necessary cookies (session, CSRF, optional remember-me) and first-party analytics that rely on hashed identifiers rather than third-party tracking. You can clear or block cookies in your browser; the site will still work, but you'll be logged out and some preferences will reset. If we ever add third-party analytics or advertising technology we will update this policy and, where required, ask for consent first.

6. Newsletter (The Stach Report)

We send The Stach Report only to people who subscribed (on the site, at registration, or in their account) and we record the time of consent. Every email contains a one-click unsubscribe link, and you can change topics or unsubscribe from your account. We may use a third-party email provider to deliver the newsletter; they process your email on our behalf only.

7. Children

MrStach.com is not directed to children and we do not permit anyone under 13 to create an account, upload photos or subscribe. We also do not accept photos of minors in submissions. If you believe a child has provided us personal information, contact us and we will delete it promptly.

8. Your Choices and Rights

Access and update your information in your account.
Delete your account from Settings. This deactivates the account and removes your profile, card and uploads from public view. We keep minimal records (e.g. order history, anti-abuse hashes, legal holds) as required, then delete or anonymize the rest within a reasonable period.
Unsubscribe from the newsletter at any time.
Revoke AI consent (Section 4).
Request a copy or erasure of your data by contacting us. Depending on where you live (e.g. EU/UK, California) you may have additional rights, including to object to processing or lodge a complaint with a regulator. We don't sell personal information and we don't "share" it for cross-context behavioral advertising.

9. Sharing

We share information only with service providers who help us run the site (hosting, email delivery, AI image generation under Section 4, print-on-demand fulfilment, payment processing when available), when required by law, to protect the safety and rights of users and the public, or in connection with a merger or sale of the business (we'd tell you first). We never sell your data.

10. Security and Retention

We use industry-standard measures: hashed passwords, encrypted connections, CSRF protection, rate limiting and access controls. No system is perfect — please use a unique password. We keep information for as long as your account is active or as needed for the purposes above, then delete or anonymize it.

11. Not Medical Advice

Our grooming and "stach care" content is educational and for entertainment. It is not medical or dermatological advice. If you have a skin or hair condition, talk to a professional, not a website with a mustache logo.

12. Takedown and DMCA Contact

If you believe content on MrStach.com infringes your copyright, uses your likeness without permission, or otherwise violates your rights, send a notice via our contact form (subject: "Takedown request") or email hello@mrstach.com. Include the page URL, a description of the material, your contact details and a statement of good-faith belief. We act on valid notices promptly and may remove content while we investigate.

13. Governing Law and Changes

This policy is governed by the laws of the State of [Your State], USA, without regard to conflict-of-law rules. We may update this policy from time to time; we'll change the date at the top and, for material changes, notify account holders by email or a site notice.

14. Contact

Questions about privacy? Contact us. We answer faster than a mustache grows, which is to say within a few days.