The Phangan Quest

Privacy Notice

Version 2.5 · Last updated 1 October 2026 · Published by MAD Global LLC

This notice explains what happens to your personal data when you visit phanganquest.com, buy The Phangan Quest, play the game, or write to us. It is written to be read on a phone, in plain English.

It covers privacy only. What you get, how it reaches you and how to cancel are in our Terms of Use and our Refund Policy.

The short version: we measure visits and purchases with Meta (Facebook and Instagram) and Google Analytics, through Cloudflare Zaraz. It starts when you open the site, and you can switch it off at any time with Cookie settings at the bottom of the home page. If you visit from the EU, the EEA, the UK or Switzerland, a banner also tells you about it and lets you switch it off straight away. When you press a buy button, you go to Fungies' checkout page, which runs under Fungies' own privacy policy. Your card details never reach us. The game is played in Telegram, which handles your account and messages under its own privacy policy. We keep only what we need to run your game and support you, and we delete game data 90 days after your last message.

1. Who we are

The Phangan Quest is made and published by MAD Global LLC, a limited liability company registered in Wyoming, USA. Registered address (registered agent): 30 N Gould St, Sheridan, WY 82801, USA. Email: support@phanganquest.com.

We are the data controller for the personal data described in this notice: the data behind your visit to this website, your start code, your game in Telegram, and the messages you send us.

Our order process is conducted by our online reseller Fungies. Fungies is the Merchant of Record for all our orders and handles payment, receipts and refunds. Help with the game itself comes from us: write to support@phanganquest.com and we aim to reply within 2 business days.

Fungies collects the data needed for the purchase, such as your email address, country and payment details, and decides how it handles them. For that data, Fungies acts as a controller in its own right, not us, and Fungies' Privacy Policy applies. You can reach Fungies about it at contact@fungies.io.

Telegram is also an independent controller, for your Telegram account and messages, under Telegram's own privacy policy.

2. Cookies and what is stored on your device

This section describes phanganquest.com as it is on the date at the bottom of this page.

• Advertising measurement (Meta). The home page loads Cloudflare Zaraz, a service of our host, Cloudflare. Zaraz tells Meta (the company behind Facebook and Instagram) when you open the page, when you look at the price section and when you press a buy button. It sends this from Cloudflare's servers: no Meta script runs in your browser. To link these events to Meta's ads, Zaraz keeps two first-party cookies on phanganquest.com: a random browser identifier and, if you arrived by clicking a Meta ad, the identifier of that click.
• Visit statistics (Google Analytics). Through the same Zaraz setup, Google Analytics (a Google service) learns which pages you open, how far you scroll, which buttons and questions you open, when you look at the price section and when you press a buy button. This is also sent from Cloudflare's servers: no Google script runs in your browser. To count visits and return visits, Zaraz keeps two first-party cookies on phanganquest.com: one with a random browser identifier, the identifier of your current visit and simple counters (such as how many pages you opened), and one that lasts only until you close the browser. Google Signals and Google's advertising features are switched off for this site.
• When it starts. The measurement starts when you open the home page. If you visit from the EU, the EEA, the UK or Switzerland, a banner tells you about it the first time and lets you switch it off; the measurement is already on while the banner shows. We work out the country from your IP address, through Cloudflare; if it is unknown, you see the banner.
• Your choice. Zaraz stores the setting in a cookie called pq_consent. One switch covers both Meta and Google Analytics. You can switch the measurement off, or back on, at any time with Cookie settings at the bottom of the home page, wherever you are. Once you switch it off, we send nothing more to Meta or Google about you, purchases included.
• The only browser storage is one sessionStorage entry that remembers which crew type you picked. It stays on your device and disappears when you close the tab.
• When you press a buy button, you go to Fungies' checkout page, which is served by Fungies. After payment, Fungies sends you back to our thank-you page with your order number. Fungies and its payment processor, Stripe, may use cookies or similar technologies in the checkout that are needed to take the payment and prevent fraud. Their own notices describe them.
• Our host, Cloudflare, may ask your browser to send it network error reports so it can keep the site running. These contain technical details, not tracking data.

We updated this page before switching the measurement on, and again before adding Google Analytics.

3. What we collect, and why

a) When you visit this website

The site is hosted on Cloudflare (Cloudflare Workers static assets). To serve the pages and protect the site from attacks and abuse, Cloudflare processes the standard request data that any web server receives: your IP address, the page you asked for, the time of the request, your browser's user-agent string and similar technical details. We do not build profiles from it and we do not use it for marketing.

b) When you buy

Fungies runs the checkout, and we never see or store your full card details.

From Fungies we receive the order information we need: the email address used for the order, the order ID, the Fungies customer ID, the country, the product, and the amount and currency. We use it to issue and email your start code, to keep the record of the sale, and to help you.

Your purchase contract is with Fungies. Your licence to play the game (your team ticket) is with us.

c) Your start code

We create your start code and store it with your order email, your order ID, the time it was issued and whether the email was delivered. Resend sends the email with your code, and the confirmation page shows it.

d) When you play in Telegram

The game runs in a Telegram chat with our game account, @PhanganQuest_Bot. To run it, we process:

• your Telegram chat ID (in a private chat, this is the same number as your Telegram user ID);
• the name and username Telegram shows us, which we do not store;
• your start code, your progress and the times of your messages;
• the replies you type.

We use this only to:

• run your game and let you continue where you stopped;
• stop one code being used by two crews;
• switch off your start code after an approved refund;
• help you if the game gets stuck.

We keep a short log of replies to fix problems. The game never asks for your location.

e) Photos you choose to send

Sending a photo is always optional. We do not download or keep the photos you send. They stay in your Telegram chat, where you can delete them, and Telegram handles them under its own privacy policy.

We will never publish a photo of yours without first asking you and getting your clear permission. Please never send photos in which a person can be recognised, especially a child.

f) When you email us or leave a voicemail

We process your email address, what you write and anything you attach, so that we can answer you and keep a record of the issue.

If you call our support number, an automated voicemail run by Twilio, our phone provider, answers. We receive your phone number and your recorded message by email, and we then delete the recording at Twilio. We treat the message like a support email.

g) Your terms version

We record which version of our Terms of Use applied to your order. We keep this record so we can respond to a legal claim.

h) Advertising measurement (Meta)

This is the measurement described in section 2. It runs for every visitor unless they switch it off, with Cookie settings or with the banner that visitors from the EU, the EEA, the UK and Switzerland see.

• When you browse: Zaraz sends Meta the page address, the event (page view, price section viewed, buy button pressed), your IP address, your browser's user-agent string and the two Meta cookie identifiers.
• When you buy: after payment, when you reach our thank-you page, our server sends Meta a purchase event: the order ID, the amount and the currency, your country and your order email address, together with your IP address, your user-agent string and the Meta cookie identifiers. The email address and the country are sent as a one-way hash (SHA-256), not in readable form.

We use this to see which ads lead to people buying the game, and to show our ads to people who are more likely to enjoy it. We never send Meta your name, your card details, your start code, your game replies or anything from Telegram.

i) Visit statistics (Google Analytics)

This is the visit statistics described in section 2. It runs, and switches off, together with the Meta measurement.

• When you browse: Zaraz sends Google Analytics the page address and the address of the page that sent you here, the event (page view, scroll depth, button or question opened, price section viewed, buy button pressed), the Zaraz identifiers described in section 2, your browser's user-agent string and your IP address. Google Analytics uses the IP address to work out your approximate location (country, region, city) and does not store it.
• When you buy: after payment, when you reach our thank-you page, our server sends Google Analytics a purchase event: the order ID, the product, the amount and the currency, your approximate location (country, region, city, as Cloudflare sees it) and the Zaraz identifiers, so the purchase joins the visit that led to it. We do not send your email address or your IP address with it.

We use this to see which pages and ads bring people who buy and enjoy the game, and to make the site better. We never send Google your name, your email address, your card details, your start code, your game replies or anything from Telegram.

4. Our legal bases

Where the GDPR, the UK GDPR or Thailand's Personal Data Protection Act (PDPA) applies, we rely on:

• Contract (GDPR and UK GDPR Art. 6(1)(b); PDPA s.24(3)): issuing your start code, running the game, switching off your start code after an approved refund, and support.
• Legitimate interests (Art. 6(1)(f); PDPA s.24(5)): keeping the website and the game secure, preventing abuse, keeping the terms-version record, establishing or defending legal claims, and measuring our advertising and our visits (section 2), which you can switch off at any time with Cookie settings.
• Legal obligation (Art. 6(1)(c); PDPA s.24(6)): keeping sales records where the law requires it.
• Consent (Art. 6(1)(a); PDPA s.19): anything optional, such as publishing a photo. You can withdraw consent at any time. Withdrawing it does not affect what we did before.

5. How long we keep it

• Game data (the link between your code and your chat, your progress and your replies): 90 days after your last message in the game. Then it is deleted or made anonymous.
• Reply logs: 30 days.
• Order record (order email, order ID, Fungies customer ID, amount, start code): as long as tax, accounting and company law require.
• Terms-version record: as long as a legal claim about your game could be brought.
• Support emails and voicemails: as long as we need them to deal with your issue and to show how we dealt with it, and no longer than 2 years.
• Website request data: kept by Cloudflare only as long as it is useful for security.
• Your cookie choice (pq_consent) and the Meta and Google Analytics cookie identifiers: kept in your browser; you can change your choice or delete them at any time. What Meta receives, Meta keeps under its own policy.
• Google Analytics data: 14 months, then Google deletes it from our statistics.
• The notes that a purchase was reported to Meta and to Google Analytics (time stamps on the order): as long as the order record.

If we need something to deal with a legal claim, we keep only what that needs, until the claim is resolved.

6. Who else is involved

• Fungies (Fungies Inc., USA, and Fungies Europe PSA, Poland): our reseller and Merchant of Record. A controller in its own right for checkout and payment data. It uses Stripe to process card payments.
• Telegram: the game is played in Telegram. Independent controller for your account and messages.
• Cloudflare: hosts this website, stores start-code records and runs Zaraz, which sends the measurement events to Meta and Google Analytics for us.
• Meta (Meta Platforms Ireland Limited for people in the EU, the EEA, the UK and Switzerland; Meta Platforms, Inc. elsewhere): receives the measurement and purchase events described above. For collecting and sending these events, Meta and we can be joint controllers under Meta's Business Tools Terms; Meta then uses the data as a controller in its own right, under the Meta Privacy Policy.
• Google (Google LLC and its affiliates, including Google Ireland Limited): provides Google Analytics to us and receives the statistics and purchase events described above. Google processes them to provide that service to us, under the Google Analytics terms and the Google Privacy Policy.
• Resend: sends the email with your start code.
• Twilio: runs our support phone line and voicemail.
• Our server provider: runs the game server behind our Telegram game account.
• Our email provider: runs our support mailbox.

Each gets only what it needs. We do not sell personal data, and we make no automated decisions that have legal effects for you. We may disclose data if the law requires it, or to establish, exercise or defend a legal claim.

7. Where your data goes

MAD Global LLC is a US company. We and our providers process data in the USA, the EU and other countries where we or those providers work. Cloudflare answers your request from a server close to you. Fungies processes the sale through its companies in the USA and Poland, with Stripe as its payment processor. Meta processes the measurement data, and Google the visit statistics, in the USA and other countries, under their own safeguards.

Where the GDPR or UK GDPR applies to a transfer, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses. You can ask us for a copy at support@phanganquest.com.

8. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you,
• correct it if it is wrong,
• erase it,
• restrict how we use it,
• receive it in a portable format,
• object to processing we base on legitimate interests,
• withdraw consent you gave for anything optional, and switch the advertising measurement off at any time with Cookie settings at the bottom of the home page.

To use any of these rights, email support@phanganquest.com. We may ask you for information that helps us confirm the request really comes from you. We aim to reply within 2 business days, and we will deal with your request within the time limit that data protection law sets. If your request is complex and we need longer, we will tell you before that time limit runs out and explain why.

Requests about payment data, such as a copy of the card transaction record, go to Fungies at contact@fungies.io, because Fungies holds that data. Tell us and we will point you there.

If you are unhappy with how we handled your data, please tell us first. You can also complain to a supervisory authority:

• in Thailand, the Personal Data Protection Committee (PDPC);
• in the UK, the Information Commissioner's Office (ICO);
• in the EU/EEA, the data protection authority where you live, where you work or where the problem happened;
• elsewhere, your national authority, if there is one.

9. Children and age

The website and the game chat are for adults. The buyer must be 18 or older. Children can join the day only together with a parent, guardian or other responsible adult, and the game runs on that adult's Telegram account.

We never ask for or collect a child's details. Please never send photos showing children. If you believe we hold a child's personal data, write to support@phanganquest.com and we will delete it.

10. Security

We limit access to personal data to what is needed to run the game and answer support requests. Card details never reach us; they go to Fungies and its payment processor. The website is served over Cloudflare's infrastructure, which also protects it from attacks and abuse. No system on the internet can be protected against every risk. If something goes wrong and the law requires us to tell you, we will.

11. Changes to this notice

If we change how we handle personal data, we will update this page and change the version number and date at the bottom. If a change materially affects how we use your data, we will say so clearly on this page and, where consent is required, we will ask for it before the change applies to you.

12. Contact

MAD Global LLC
30 N Gould St, Sheridan, WY 82801, USA (registered agent)
Phone (voice messages only): +1 307 309 3585
Email: support@phanganquest.com

Version 2.5 — 1 October 2026