The Phangan Quest

Privacy Notice

Last updated 19 September 2026 · Published by MAD Global LLC

This notice explains what happens to your personal data when you visit phanganquest.com, buy The Phangan Quest, play the game, or write to us. It is written to be read on a phone, in plain English.

It covers privacy only. What you get, how it reaches you and how to cancel are in our Terms of Use and our Refund Policy.

The short version: this website sets no cookies, runs no analytics and loads no third-party trackers. The only thing stored in your browser is a single sessionStorage entry that remembers a display preference — which crew type you picked. It is cleared when you close the tab and never leaves your device. Your card details never reach us: the sale is handled by Creem.

1. Who we are

The Phangan Quest is published by MAD Global LLC, a limited liability company registered in Wyoming, USA.

Registered office: 30 N Gould St, Sheridan, WY 82801, USA Website: phanganquest.com Email: support@phanganquest.com

We are the data controller for the personal data we process and describe in this notice: the request data behind your visit to this website, your game, any photo you choose to send, and the emails you send us.

The sale works differently. The seller is Creem — Armitage Labs OU (registry code 16977866), registered in Estonia at Rotermanni 14, Tallinn 10111. Creem is the merchant of record and contractual reseller: it sells The Phangan Quest to you in its own name, takes the payment, handles tax, issues your receipt and processes refunds. Creem collects your payment data itself and decides how it handles it, so for that data Creem is the controller, not us. Creem's Buyer Terms govern the sale: https://www.creem.io/buyer-terms

Support is by email only, at support@phanganquest.com. We aim to reply within 2 business days.

2. Cookies and what is stored on your device

This section describes phanganquest.com — the site you are reading now — as it is on the date at the bottom of this page.

• The website sets no cookies of its own, and we have not switched on any hosting feature that sets one.
• It runs no analytics and loads no third-party trackers and no advertising pixels.
• The only browser storage is one sessionStorage entry holding a display preference: the crew type you chose. It stays on your device, is never sent to us, and disappears when you close the tab.

There is no cookie banner here because there is nothing to consent to. We store nothing on your device to track or measure you, and the one entry we do use exists only because you asked for that display.

If this ever changes — for example if we switch on a bot-protection challenge that sets a security cookie, or add any kind of measurement — we will update this page before the change goes live, and ask for your consent where consent is required.

3. What we collect, and why

a) When you visit this website

The site is hosted on Cloudflare (Cloudflare Workers static assets). To serve the pages and protect the site from attacks and abuse, Cloudflare processes the standard request data that any web server receives: your IP address, the page you asked for, the time of the request, your browser's user-agent string and similar technical details. We do not build profiles from it and we do not use it for marketing.

b) When you buy

Your payment data — card details and billing address — is collected and processed by Creem, not by us. We never see or store your card details.

From Creem we receive limited order information: the email address used for the order, an order identifier and the country of the order. We use it to deliver your access code, to keep the record of the order, and to help you if something goes wrong.

Your purchase contract is with Creem as the seller. What you can cancel and what you are entitled to if the game does not work as described are set out in our Refund Policy; the rules of the game itself are in our Terms of Use.

c) When you play

To run your game we process:

• the answers you type,
• your progress through the story,
• your access code.

We use this only to deliver the game you bought: to send you the right chapter, to let you carry on where you left off, and to help you if the game gets stuck.

The game runs automatically. Nobody has to read your answer before you can continue — any answer moves the story on — and there is no live support while you play.

d) Photos you choose to send

Some tasks invite you to send a photo of a place or an object. Sending a photo is always optional, and any reply moves the story forward. Photo tasks are about places and objects, never people.

We use a photo you send only to run your game. We will never publish it without asking you separately and getting your explicit consent, and you can withdraw that consent at any time. If someone can be recognised in a photo you send, we will not publish it, and we delete the photo once it is no longer needed to run your game. Please do not send photos showing children.

One thing worth knowing: photos usually carry hidden metadata — where and when the picture was taken, and the device that took it. If you would rather not share that, switch location off in your camera app before you take the photo, or send a screenshot of the photo instead.

e) When you email support

We process your email address, whatever you write and anything you attach, so that we can answer you and keep a record of the issue.

4. Our legal bases

Where the GDPR applies, we rely on:

• Performance of a contract with you — our Terms of Use govern the game. We rely on them to deliver your access code, run the game, deactivate a code after a cancellation, and support you.
• Legitimate interests — keeping the website and the game secure, preventing abuse, and defending or resolving a claim.
• Consent — for anything optional, such as publishing a photo you chose to send. You can withdraw consent at any time; withdrawing it does not affect what we did with the data before you withdrew it.

Refunds themselves are handled and paid out by Creem, under Creem's own terms and its own responsibility.

5. How long we keep it

We keep each kind of data only as long as we need it, and we decide that by the following criteria:

• Order information from Creem (order email, order identifier, country) — for as long as tax, accounting and company-law obligations require us to keep the record of a sale.
• Game data (your answers, your progress, your access code) — while your game is open, and afterwards for as long as we need it to settle a support request, a cancellation or a refund about that game. Then we delete it or stop being able to link it to you.
• Photos you send — only while they are needed to run your game, and we delete them after your game ends. If you gave separate consent to publish one, we keep that photo until you withdraw your consent.
• Support emails — for as long as we need them to deal with your issue and to show how we dealt with it.
• Website request logs — only for as long as they are useful for security and abuse prevention.

If we need something to establish, exercise or defend a legal claim, we keep only what that requires, and only until the claim is resolved.

6. Who else is involved

• Hosting and infrastructure — Cloudflare, which serves this website and protects it from attacks and abuse.
• The merchant of record — Creem (Armitage Labs OU). Creem collects your payment data itself, as the seller, and sends us only the limited order information described in section 3(b). Your card details go to Creem, not through us.
• Email — your access code, the game's messages and our replies reach you by email, so the provider that runs our email handles those messages on the way.

Each of them gets only what they need for that purpose.

We do not sell personal data. We do not use it to make automated decisions that produce legal effects for you.

We may also disclose data if the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

7. Where your data goes

We are based in the USA, so we process your data there. Creem processes the sale in the EU. Cloudflare serves this website from a global network, which means your request is answered by a server close to you, and that server may be outside the EU/EEA.

Where the GDPR applies to a transfer, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, to protect your data. You can ask us for a copy of the safeguards we use by emailing support@phanganquest.com.

8. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you,
• correct it if it is wrong,
• erase it,
• restrict how we use it,
• receive it in a portable format,
• object to processing we base on legitimate interests,
• withdraw consent you gave for anything optional.

To use any of these rights, email support@phanganquest.com. We may ask you for information that helps us confirm the request really comes from you. We aim to reply within 2 business days, and we will deal with your request within the time limit that data protection law sets. If your request is complex and we need longer, we will tell you before that time limit runs out and explain why.

A request about your payment data — a copy of the card transaction record, for example — has to go to Creem, because Creem holds it and decides how it is handled. Tell us and we will point you to the right place.

If you are unhappy with how we handled your data, please tell us first — we would like the chance to fix it. You can also complain to a supervisory authority:

• EU/EEA: the data protection authority in the country where you live, where you work, or where you think the problem happened.
• Elsewhere: the data protection authority of the country you live in, if there is one.

9. Children and age

The game is sold to adults. You must be 18 or older — or the local age of majority, if that is higher — to buy the game or unlock a code, and the adult buyer stays responsible for the game.

Anyone under 18 may play only together with a parent, guardian or other responsible adult who stays with them, and that adult decides what is sent to us. Even then, everything we process stays attached to the buyer's game: the answers, the progress and the access code. The game does not ask any player for a name, an age or contact details, and we do not build a separate profile for a child.

The game is not directed to children under 13, and we do not knowingly collect a child's personal data. Please never send us photos showing children; if one reaches us, we delete it. If you believe we hold a child's personal data that we should not, write to support@phanganquest.com and we will delete it.

10. Security

We limit access to personal data to what is needed to run the game and answer support requests. Card details never reach us — they go to Creem. The website is served over Cloudflare's infrastructure, which also protects it from attacks and abuse. No system on the internet can be protected against every possible risk; if something goes wrong and the law requires us to tell you, we will.

11. Changes to this notice

If we change how we handle personal data, we will update this page and change the version number and date at the bottom. If a change materially affects how we use your data, we will say so clearly on this page and, where consent is required, we will ask for it before the change applies to you.

12. Contact

MAD Global LLC 30 N Gould St, Sheridan, WY 82801, USA support@phanganquest.com

Version 1.0 — 19 September 2026