Privacy Policy

Who we are

This website (xxi.online) is operated under the trade name XXI Online Games ("we", "us") by:

STROESCU CONSTANTIN-CATALIN PFA
CUI (Tax ID): 51846706
B-dul Bucureștii Noi 136, et. parter, ap. 5
Sector 1, București, Romania

For the purposes of the EU General Data Protection Regulation (GDPR), this entity is the data controller for any personal data processed through this website. You can reach us at me@xxi.online.

Scope of this policy

This Privacy Policy covers the public marketing website at xxi.online only. Each game or app we publish has its own privacy notice that governs in-app data handling. For our flagship title see the MOGUL — Empire Tycoon Privacy Policy.

What this website does

xxi.online is a marketing site. It does not have user accounts, logins, contact forms, newsletter sign-ups, or in-site payments. Purchases of our games happen on Google Play or the Apple App Store under those platforms' own terms and privacy policies.

Information we process

When you visit this website, the following limited data is processed:

• Server logs. Our hosting provider records standard access logs (IP address, user agent, timestamp, requested URL, HTTP status). These are retained short-term for security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service).
• Static asset CDNs. The site loads fonts and styles from third-party CDNs (Google Fonts, jsDelivr / BootstrapCDN, Cloudflare-hosted assets). When your browser fetches these, the CDN provider receives your IP address and user agent under its own privacy policy. We do not control or receive that data.
• Email you send us. If you write to me@xxi.online, we process your email address and whatever you include in the message so we can reply. The mailbox is hosted by Namecheap (Private Email), which receives the message and forwards it to Google's Gmail, where we read and answer it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) or Art. 6(1)(c) where you exercise a legal right.

Information we do not collect

• Names, email addresses, phone numbers, or postal addresses, unless you choose to email us (we do not run a contact form here)
• Payment or billing information (purchases happen on the platform stores)
• Account credentials (the site has no user accounts)
• Newsletter or marketing email subscribers
• Advertising profiles or cross-site tracking IDs
• Web analytics of any kind - this site runs no analytics, tag manager, or measurement script
• Microphone, camera, or location data

Cookies

This website sets no cookies at all. There is no analytics cookie, no advertising cookie, and no session cookie - so there is nothing to consent to and no cookie banner to dismiss. Blocking cookies in your browser will not affect the site in any way.

Data sharing

We do not sell, rent, or share personal data with marketing partners. The only third parties involved are the infrastructure providers listed above (hosting, static asset CDNs, and the email providers Namecheap and Google if you write to us). Each acts as a processor or independent controller under its own published terms.

International transfers

The website itself transfers no data outside the EU/EEA. If you email us, your message is handled by Namecheap and Google, which may process it in the United States under their data-processing terms. Some of the static asset CDNs listed above operate globally, so a request from your browser for a font or stylesheet may be served from a node outside the EU/EEA; the providers involved participate in the EU-U.S. Data Privacy Framework or rely on Standard Contractual Clauses, which provide an appropriate transfer mechanism under Chapter V GDPR.

Your rights

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with a supervisory authority (in Romania, the ANSPDCP). In practice this site holds almost nothing about you: short-lived server access logs are the only record we keep, and they are not tied to an identity. For any request, email me@xxi.online and we will respond within 30 days.

Children

This website is not directed at children under 16. We do not knowingly collect any personal information from children. If you believe a child has provided data through this site, contact us and we will delete it.

Security

The site is served over HTTPS. We apply standard administrative and technical measures to protect any data we process. No internet transmission is ever 100% secure, but the limited nature of what this site processes (effectively just short-lived server access logs) keeps the impact of any breach low.

Changes to this policy

If this policy changes, the "Last updated" date at the top of the page will change. Material changes will be highlighted on the homepage for a reasonable period.

Contact

Questions about this Privacy Policy? Email me@xxi.online.