Privacy Policy
Who we are
Spotlight Dreams is published under the trade name XXI Online Games ("we", "us"), which is owned and operated by:
STROESCU CONSTANTIN-CATALIN PFA
CUI (Tax ID): 51846706
B-dul Bucureștii Noi 136, et. parter, ap. 5
Sector 1, București, Romania
This entity is the data controller for the purposes of the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how the Spotlight Dreams mobile app handles user data. It applies to app versions released from July 2026 onward; earlier versions did not include analytics.
Analytics — only with your consent
On first launch, the app asks once whether you want to share anonymous usage analytics with us via Google Analytics for Firebase. Until you answer, and if you answer no, all analytics consent signals stay denied — the app sends Google only anonymous, identifier-free "consent pings" that contain no device identifiers and cannot be linked to you or your device. Your choice can be changed at any time in Settings → Privacy & Data inside the game, and gameplay is completely identical either way.
If you allow analytics, the following is collected:
- Usage events — app installs (first open), session starts, and confirmations of in-app purchases (product and price, never payment details)
- In-game milestones and screens — which screen of the game you are on (for example "settings" or "phone-bank"), and a small set of progress markers such as starting a new career, finishing the tutorial, landing your first role, releasing your first film, reaching week 10/25/50/100, and opening a purchase screen. These are counted anonymously to show us where players get stuck and to measure our ads; they never include your character's name or any other content from your save
- App-instance identifiers — random IDs generated by the Firebase SDK for this install; they identify the app installation, not you, and reset if you reinstall
- Approximate (city-level) location and technical data — derived transiently by Google from your IP address, along with device model, OS version, and app version
The app never collects, on either platform and regardless of your choice:
- Advertising identifiers — the Android advertising-ID permission is removed from the app entirely, and on iOS the app never requests tracking permission (you will never see an "Allow app to track?" prompt)
- Your name, email, phone number, or address (the app has no accounts and no forms)
- Precise location, contacts, photos, files, microphone, or camera data
- Anything typed or done inside your save — game saves are not analytics data and never leave your device
Analytics data is processed by Google LLC as our processor and is used for two purposes only: understanding aggregate usage (which updates land well) and measuring our own app-install advertising campaigns. It is never used to personalise or target advertising — the app keeps Google's ad-personalisation consent signal switched off permanently, even for players who allow analytics. We do not sell data, we do not use third-party advertising networks inside the app, and the app shows no ads.
In-app purchases
Spotlight Dreams offers optional one-time purchases ("Creator Mode", US $9.99, and "Studio Boss Mode", US $6.99). Payment is processed entirely by Google Play (on Android) or the App Store (on iOS). We never see your payment information, billing address, or store account details.
To unlock your purchase reliably across reinstalls and devices, the store's purchase receipt is validated server-side by RevenueCat (RevenueCat, Inc., USA), our purchase-infrastructure processor. RevenueCat receives the store receipt, a random anonymous app-user ID, and basic device information (model, OS, app version) — never your identity or payment details. See the RevenueCat Privacy Policy.
Google Play license check (Android only)
On Android, the app performs a standard Google Play License Verification check at launch to confirm the copy was installed from Google Play. This is a direct exchange between your device and Google Play using your existing Play account session; we operate no server in this flow and receive no data from it.
Information stored on your device
Your game progress, character, career, relationships, finances, and all other in-game data are saved locally on your device. Save data never leaves your device — it is not uploaded, synced, or backed up to any server we operate. If you uninstall the app, the operating system deletes it; we cannot recover or restore it.
Permissions
On Android, Spotlight Dreams declares the INTERNET permission. It is
used for: loopback networking within the app itself (the game loads its content
from a local 127.0.0.1 server on your device), the platform store and
receipt validation when you make a purchase, the Google Play license check, and
— only with your consent — analytics. The advertising-ID permissions
(com.google.android.gms.permission.AD_ID and the Android 13+
AdServices ad-ID permission) are explicitly removed from the app.
Third-party processors
| Service | Provider | Purpose | When |
|---|---|---|---|
| Google Analytics for Firebase | Google LLC (USA) | Anonymous usage analytics & ad-campaign measurement | Only after you opt in |
| RevenueCat | RevenueCat, Inc. (USA) | Purchase receipt validation & entitlement management | App launch / purchases |
| Google Play / App Store | Google / Apple | Distribution, payment processing, license verification | Install, purchase, launch (Android LVL) |
Google and RevenueCat may transfer data to servers in the United States. Both participate in the EU-U.S. Data Privacy Framework, which provides an appropriate transfer mechanism under Art. 45 GDPR.
Legal bases & retention
- Analytics — your consent (Art. 6(1)(a) GDPR), withdrawable anytime in Settings → Privacy & Data. Google Analytics retains user-level data for up to 14 months; aggregate reports longer.
- Purchases — performance of contract (Art. 6(1)(b)): validating the receipt is necessary to deliver what you bought. Purchase records are retained while the product is supported.
- License check — legitimate interest (Art. 6(1)(f)) in preventing piracy of a paid-content app.
Your rights
Under GDPR, CCPA, and similar regulations you may access, correct, delete, export, or restrict processing of your personal data, withdraw consent at any time (Settings → Privacy & Data), and lodge a complaint with a supervisory authority (in Romania, the ANSPDCP). Because analytics data is not linked to your identity, deletion requests work at the app-installation level: email us at the address below and we will delete the associated analytics data via Google's deletion tools, or simply reinstall the app, which resets the app-instance identifier. Purchase records are held by your platform store under its own policy.
Children
The app has no accounts, no ads, no advertising identifiers, and analytics is off by default until explicitly enabled. We do not knowingly collect personal information from children under 13. Age-appropriateness of the game's content (themes, language, in-game purchases) is indicated by the rating on the app's store listing; parents should review it before letting children download the app.
Changes to this policy
If this policy is updated, the "Last updated" date at the top of the page will change. Material changes are also announced in the app's release notes on Google Play and the App Store. (July 2026: added the optional, consent-based analytics described above; documented RevenueCat receipt validation and the Android license check.)
Contact
Questions about this Privacy Policy, or a data request? Email xxionlinegames@gmail.com.