Privacy Policy
Who we are
Spotlight Dreams is published under the trade name XXI Online Games ("we", "us"), which is owned and operated by:
STROESCU CONSTANTIN-CATALIN PFA
CUI (Tax ID): 51846706
B-dul Bucureștii Noi 136, et. parter, ap. 5
Sector 1, București, Romania
This entity is the data controller for the purposes of the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how the Spotlight Dreams mobile app handles user data. It applies to app versions released from July 2026 onward; earlier versions did not include analytics. The crash reporting described below applies to versions that include Firebase Crashlytics.
Analytics — only with your consent
On first launch, the app asks once whether you want to share anonymous usage analytics with us via Google Analytics for Firebase. Until you answer, and if you answer no, all analytics consent signals stay denied — the app sends Google only anonymous, identifier-free "consent pings" that contain no device identifiers and cannot be linked to you or your device. Your choice can be changed at any time in Settings → Privacy & Data inside the game, and gameplay is completely identical either way.
If you allow analytics, the following is collected:
- Usage events — app installs (first open), session starts, and confirmations of in-app purchases (product and price, never payment details)
- In-game milestones and screens — which screen of the game you are on (for example "settings" or "phone-bank"), and a small set of progress markers such as starting a new career, finishing the tutorial, landing your first role, releasing your first film, reaching week 10/25/50/100, and opening a purchase screen. These are counted anonymously to show us where players get stuck and to measure our ads; they never include your character's name or any other content from your save
- App-instance identifiers — random IDs generated by the Firebase SDK for this install; they identify the app installation, not you, and reset if you reinstall
- Approximate (city-level) location and technical data — derived transiently by Google from your IP address, along with device model, OS version, and app version
The app never collects, on either platform and regardless of your choice:
- Advertising identifiers — the Android advertising-ID permission is removed from the app entirely, and on iOS the app never requests tracking permission (you will never see an "Allow app to track?" prompt)
- Your name, email, phone number, or address (the app has no accounts and no forms)
- Precise location, contacts, photos, files, microphone, or camera data
- Anything typed or done inside your save — game saves are not analytics data and never leave your device
Analytics data is processed by Google LLC as our processor and is used for two purposes only: understanding aggregate usage (which updates land well) and measuring our own app-install advertising campaigns. It is never used to personalise or target advertising — the app keeps Google's ad-personalisation consent signal switched off permanently, even for players who allow analytics. We do not sell data, we do not use third-party advertising networks inside the app, and the app shows no ads.
Crash reports — only with your separate consent
On the first launch of a version with crash reporting, the app asks whether you want to allow Firebase Crashlytics crash reports before the game starts. Choose Allow or Not now. Your answer is saved on that device, and the startup question is not shown again after either choice. It is separate from analytics consent; allowing one does not allow the other. You can change crash reporting at any time in Settings → Privacy & Data → Change crash reporting.
If you allow crash reporting, Google LLC processes diagnostic reports on our behalf to help identify and fix crashes, startup failures and selected software errors. Reports can include:
- Crash and error information — crash time, stack traces, error locations and types, and limited technical context such as the startup stage or affected resource type
- App and device diagnostics — app identifier and version, operating-system version, device model, CPU architecture, available memory and storage, and app state at the time of an error
- Diagnostic installation and session identifiers — random identifiers assigned by Firebase, including the Crashlytics Installation UUID and Firebase installation ID
These are pseudonymous diagnostics, not completely identifier-free data. We do not attach your character name, game save, messages, email, payment details or a custom player identifier. We do not use crash reports for advertising or connect them to your RevenueCat purchase profile. See Firebase's privacy and security information for the SDK's diagnostic data.
Uploads are disabled until consent is granted. Reports may be held on the device while offline and uploaded on a later launch while crash reporting remains allowed. The first launch on which you allow reporting discards earlier unsent reports; uploads start on a later launch with your saved permission. Choosing Not now or turning reporting off stops future reporting and requests deletion of unsent reports held on the device. It does not delete reports already received by Google. Read our data deletion page for the distinction between local and server data.
In-app purchases
Spotlight Dreams offers optional one-time, non-consumable purchases: "Creator Mode" (US $9.99), "Studio Boss Mode" (US $6.99) and "The Setlist" (US $1.99). Further unlocks of the same kind may be added. There are no subscriptions and no consumables. Payment is processed entirely by Google Play (on Android) or the App Store (on iOS). We never see your payment information, billing address, or store account details.
To unlock your purchase reliably across reinstalls and devices, the store's purchase receipt is validated server-side by RevenueCat (RevenueCat, Inc., USA), our purchase-infrastructure processor. RevenueCat receives the store receipt, a random anonymous app-user ID, and basic device information (model, OS, app version) — never your identity or payment details. See the RevenueCat Privacy Policy.
Google Play license check (Android only)
On Android, the app performs a standard Google Play License Verification check at launch to confirm the copy was installed from Google Play. This is a direct exchange between your device and Google Play using your existing Play account session; we operate no server in this flow and receive no data from it.
Information stored on your device
Your game progress, character, career, relationships, finances, and all other in-game data are saved locally on your device. Save data never leaves your device — it is not uploaded, synced, or backed up to any server we operate. If you uninstall the app, the operating system deletes it; we cannot recover or restore it.
Permissions
On Android, Spotlight Dreams declares the INTERNET permission. It is
used for: loopback networking within the app itself (the game loads its content
from a local 127.0.0.1 server on your device), the platform store and
receipt validation when you make a purchase, the Google Play license check, and
— only with your separate consent choices — analytics and crash reporting. The advertising-ID permissions
(com.google.android.gms.permission.AD_ID and the Android 13+
AdServices ad-ID permission) are explicitly removed from the app.
Third-party processors
| Service | Provider | Purpose | When |
|---|---|---|---|
| Google Analytics for Firebase | Google LLC (USA) | Anonymous usage analytics & ad-campaign measurement | Only after you opt in |
| Firebase Crashlytics | Google LLC (USA) | Crash and error diagnostics to improve reliability | Only with a saved crash reporting opt-in |
| RevenueCat | RevenueCat, Inc. (USA) | Purchase receipt validation & entitlement management | App launch / purchases |
| Google Play / App Store | Google / Apple | Distribution, payment processing, license verification | Install, purchase, launch (Android LVL) |
| Namecheap Private Email / Gmail | Namecheap, Inc. (USA) / Google LLC (USA) | Receiving, forwarding and answering email you send us | Only if you email us |
Google and RevenueCat may transfer data to servers in the United States. Both participate in the EU-U.S. Data Privacy Framework, which provides an appropriate transfer mechanism under Art. 45 GDPR. Email you send us is received by Namecheap, which hosts our mailbox, and forwarded to Gmail, where we read and answer it; it may be processed in the United States under those providers' data-processing terms.
Legal bases & retention
- Analytics — your consent (Art. 6(1)(a) GDPR), withdrawable anytime in Settings → Privacy & Data. Google Analytics retains user-level data for up to 14 months; aggregate reports longer.
- Crash reporting — your separate consent (Art. 6(1)(a) GDPR), withdrawable anytime in Settings → Privacy & Data. Firebase Crashlytics retains crash traces and associated diagnostic identifiers for 90 days before beginning removal from live and backup systems. This is not a promise that every backup is erased exactly on day 90. See Firebase's retention information.
- Purchases — performance of contract (Art. 6(1)(b)): validating the receipt is necessary to deliver what you bought. Purchase records are retained while the product is supported.
- License check — legitimate interest (Art. 6(1)(f)) in preventing piracy of a paid-content app.
Your rights
Under GDPR, CCPA, and similar regulations you may access, correct, delete, export, or restrict processing of your personal data, withdraw consent at any time (Settings → Privacy & Data), and lodge a complaint with a supervisory authority (in Romania, the ANSPDCP). Because analytics data is not linked to your identity, deletion requests work at the app-installation level: email us at the address below with the analytics ID shown in Settings before you uninstall or reset the app. We use Google's available deletion tools for data we can identify. Reinstalling may reset local installation identifiers, but does not erase earlier analytics or crash reports from Google's servers. The app does not assign a custom user ID to Crashlytics, and its diagnostic installation UUID is not included in the game's Copy IDs output, so we may be unable to locate individual crash reports using your email or character name. Contact us for help with a specific request; otherwise those reports follow Firebase's retention schedule. Purchase records are held by your platform store under its own policy. Detailed steps are on our data deletion page.
Children
The app has no accounts, no ads, no advertising identifiers, and analytics is off by default until explicitly enabled. Crash reporting also requires a separate opt-in. We do not knowingly collect personal information from children under 13. Age-appropriateness of the game's content (themes, language, in-game purchases) is indicated by the rating on the app's store listing; parents should review it before letting children download the app.
Changes to this policy
If this policy is updated, the "Last updated" date at the top of the page will change. Material changes are also announced in the app's release notes on Google Play and the App Store. (July 2026: added the optional, consent-based analytics described above; documented RevenueCat receipt validation and the Android license check. September 2026: new contact address and email providers listed. October 2026: added separate first-launch crash reporting consent, Firebase Crashlytics diagnostic data and retention, and clarified withdrawal and deletion.)
Contact
Questions about this Privacy Policy, or a data request? Email [email protected].