Effective date: 28 July 2026
Last updated: 28 July 2026
The summary above is written for humans. The sections below are the full policy and are what legally applies.
Drunk Cupid ("Drunk Cupid", "we", "us", "our") is an independent project published by Chanon Mallanoo, an individual developer based in Thailand. We publish the Drunk Cupid mobile app (the "App") and the website at www.drunkcupid.com (the "Site"). Together the App and the Site are the "Services".
For the purposes of the EU and UK General Data Protection Regulation, and of Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), Chanon Mallanoo is the data controller for the limited processing described in this policy.
This policy explains what information the Services do and do not handle, and what rights you have. For anything in this policy, or to exercise a right described in section 11, contact hello@drunkcupid.com.
Drunk Cupid is a pass-the-phone party game. To play, you type in the names of the people in the room and may optionally add a ♂/♀ tag so the game knows who to aim a dare at. You also choose which decks to play.
All of that information is stored locally on your device and is never transmitted to us or to anyone else. We operate no server that receives it, and we have no way to read it. Specifically, the App does not collect, transmit, or store on our systems:
Because this data lives only on your phone, deleting the App deletes it. There is no copy anywhere else. Anyone with physical access to an unlocked device can see what is on it, so treat names you enter the way you would treat anything else on your phone.
Practical consequence: if you lose your phone, we cannot recover your data, because we never had it. If you ask us to delete your data, there is nothing on our side to delete.
The App has no registration, no login, no user profiles, and no password. We do not ask for your email address, phone number, date of birth, or name. You use Drunk Cupid entirely anonymously.
Some decks are paid. Purchases are processed entirely by the Apple App Store or Google Play, depending on where you downloaded the App. We never receive or handle your payment card number, billing address, or store account credentials. Apple and Google confirm to the App that a purchase succeeded; that confirmation is what unlocks the deck.
Apple and Google provide us with aggregated, anonymised sales reporting — for example, how many copies of a deck sold in a country in a given week. This reporting does not identify individual buyers.
Your purchase itself is governed by the store's own privacy policy and terms: Apple's Privacy Policy and Google's Privacy Policy. Refunds are handled by the store, not by us.
Downloading any app from the Apple App Store or Google Play involves those companies processing data about you — your store account, your device, download and crash statistics — independently of us and under their own privacy policies. We do not control this and we do not receive the underlying personal data. Please review the store policies linked in section 4 to understand what they collect.
The Site is a static page. It sets no cookies, uses no analytics (no Google Analytics, no Vercel Analytics, no pixels), embeds no third-party trackers, and runs no advertising. There is no contact form and nothing to fill in, so the Site collects nothing you type.
The Site is hosted by Vercel Inc. Like every web server, Vercel's infrastructure automatically records standard technical request data — IP address, timestamp, requested URL, browser user agent — for a limited period, in order to deliver the page, keep the service running, and defend against abuse and denial-of-service attacks. This is a normal and necessary part of serving a website. We do not use these logs to build profiles, and we do not combine them with anything else. See Vercel's Privacy Policy.
The Site links to the App Store and Google Play. Once you follow a link, you are on someone else's website and this policy no longer applies.
If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a legal basis for each processing activity; Thailand's PDPA requires the same, and recognises an equivalent legitimate interest basis under Section 24(5). Because the App processes nothing on our side, the only relevant processing is the hosting of this website:
We do not rely on consent, because we set no cookies and run no tracking that would require it.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We have never done so and have no mechanism to do so.
We disclose nothing to advertisers, data brokers, or analytics companies. The only third parties involved in the Services at all are the app stores that distribute the App and process payments (section 4) and the host that serves this website (section 6). We may disclose information if we are legally required to by a valid legal process — though in practice we hold almost nothing that could be disclosed.
The Site is served exclusively over HTTPS with HSTS enabled. The strongest security measure in the Services, however, is architectural: we cannot lose, leak, or have stolen the data you enter into the App, because it never reaches us. There is no user database to breach.
Data on your phone is protected by your device's own security — your passcode, biometrics, and operating system. Keeping your device locked and updated is the most effective protection for it.
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information; to object to processing based on legitimate interests; to opt out of sale or sharing; and not to be discriminated against for exercising any of these rights.
We honour these rights. In practice, the answer to most requests will be that we hold no personal information about you at all:
To make a request, or if you disagree with any of the above, email hello@drunkcupid.com. We will respond within the time limit that applies to you — 30 days under the GDPR and the Thai PDPA, 45 days under the CCPA. We cannot verify your identity from data we do not have, so we may only be able to confirm that we hold nothing about you.
You also have the right to complain to a supervisory authority. In the EEA that is your national data protection authority; in the UK, the Information Commissioner's Office (ico.org.uk); in Thailand, the Office of the Personal Data Protection Committee (PDPC).
Drunk Cupid is strictly for adults aged 18 and over. The game contains adult themes and references to alcohol. It is not directed at children, and it is not designed to appeal to them.
We do not knowingly collect personal information from anyone, including children under 13 (or under 16 in the EEA and UK). Since the App collects nothing, no data from a minor can reach us. If you believe a minor has somehow provided us with personal information, contact hello@drunkcupid.com and we will delete it.
The Services are available worldwide. Because the App keeps your data on your own device, using it involves no international transfer of your personal information by us. This website is served from a global content delivery network, which means the page itself may be delivered to you from a server outside your country; the only data involved is the technical request data described in section 6.
If the App ever changes in a way that affects your privacy — for example if we were to add analytics, crash reporting, accounts, or online multiplayer — we will update this policy and change the "Last updated" date at the top before that feature ships. Material changes will also be announced in the App.
Continuing to use the Services after an update means you accept the revised policy. We recommend checking this page occasionally.
Privacy questions, requests, or corrections — one address, and a real person reads it:
hello@drunkcupid.com