Legal

Privacy Policy

Effective August 6, 2026 · Last updated August 9, 2026

Short version: we collect what we need to stream you dramas, remember your place, and process payments. We do not sell your personal information.

1. Who we are

xdrama is operated by Spike Labs, Inc. (“Spike Labs,” “we,” “us”), a Delaware corporation located at 4845 Pearl East Cir Ste 118 PMB 522889, Boulder, Colorado 80301-6112, United States. This Privacy Policy explains how we collect, use, share, and protect personal information when you use xdrama.com, our mobile apps, and related services (the “Service”). It works alongside our Terms of Service.

Spike Labs is the controller of personal information processed through the Service. For residents of the EEA, UK, and Switzerland, references to “personal information” include “personal data” as defined by applicable law.

2. Information we collect

Information you give us

Account information — email address, and optionally a display name and profile details. Authentication is handled by our identity provider; we receive your user identifier and contact details, not your password.
Age and age-verification signals — your stated date of birth or age confirmation, and, where mature content requires stronger verification, the result of a verification check performed by a third-party provider. We aim to retain only the result (for example, “18 or over: yes”), not underlying identity documents.
Payment information — when you buy coins or a subscription, our payment processor collects and processes your card or payment credentials. We do not receive or store full card numbers; we receive a customer or transaction identifier, the last four digits, the amount, and the status.
Communications — messages you send to support, and any reviews, ratings, votes, or comments you submit if we enable those features.

Information we collect automatically

Device identifier for guest viewing — if you browse before creating an account, we generate a random identifier stored on your device so we can remember your progress and unlocks. If you later create an account, we link that activity to it.
Viewing activity — the series and episodes you open, how far you watch, what you unlock, save to My List, or like, and when. This powers continue-watching, entitlements, and recommendations.
Device and technical data — IP address, browser or app version, operating system, device type, language, approximate location derived from IP (typically country or region), referring URLs, and crash and performance diagnostics.
Cookies and similar technologies — used for sign-in sessions, security, preferences, and analytics. See Section 8.

Information from others

App stores and payment providers — purchase, renewal, refund, and entitlement events for in-app purchases and subscriptions.
Advertising and measurement partners — if you arrive from an ad, we may receive attribution data indicating which campaign or creative referred you.

We do not intentionally collect sensitive personal information such as government identifiers, health data, precise geolocation, or biometric data. Please do not send it to us.

3. How we use information

Provide the Service: stream episodes, remember your place, sync across devices.
Manage entitlements: track coins, subscriptions, and which episodes you have unlocked, and enforce paywalls.
Process payments, prevent duplicate charges, and handle refunds and chargebacks.
Apply content ratings and age restrictions, including gating mature (R-rated) content.
Personalize the catalog, rankings, and recommendations.
Communicate with you about your account, purchases, new episodes, and — where you have opted in or as otherwise permitted — marketing.
Measure and improve the Service, including analytics on which titles and features perform well.
Marketing and attribution, including measuring ad campaigns and reaching similar audiences.
Security, fraud prevention, abuse detection, and enforcement of our Terms.
Comply with legal obligations and respond to lawful requests.

We do not use your personal information or your viewing activity to train generative AI models. Our content is produced with AI tools using our own creative inputs and licensed or synthetic assets, not user data.

4. Legal bases (EEA, UK, Switzerland)

Where required, we rely on: performance of a contract (providing the Service, processing purchases); legitimate interests (securing the Service, preventing fraud, improving and promoting our products, in a way balanced against your rights); consent (certain cookies, marketing messages, and any optional features that request it); and legal obligation (tax, accounting, and responding to lawful requests). You may withdraw consent at any time without affecting prior processing.

5. How we share information

We do not sell your personal information for money. We share it only as described here:

Service providers acting on our instructions — cloud hosting and content delivery, identity and authentication, payment processing and subscription management, email delivery, customer support, analytics, and error monitoring.
App stores — for purchases made through them, subject to their own privacy policies.
Advertising and measurement partners — conversion events such as sign-ups, coin purchases, and subscription starts (with their value), plus hashed identifiers used to measure campaigns and build audiences. Which specific videos you watched is shared only with your separate consent, as described in Section 6. Depending on your jurisdiction this is treated as “sharing” or “targeted advertising,” and you can opt out at any time at Your Privacy Choices (Section 10).
Legal and safety — when we believe disclosure is required by law or necessary to protect the rights, property, or safety of Spike Labs, our users, or the public.
Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your direction — for example, when you share a link to an episode.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Your viewing history

We treat what you watch as sensitive, and we handle it differently from everything else in this Policy.

We use it internally. Viewing activity powers playback, continue-watching, entitlements, recommendations, rankings, and our own decisions about which series to make and how to market them. This is first-party use and it is core to the Service.

We do not disclose which specific series or episodes you watched to advertising partners unless you have separately consented to it. That consent is asked for on its own dedicated prompt — it is never part of accepting these policies, creating an account, or making a purchase, and declining changes nothing about the Service. If you give it, it lasts at most two years and you can withdraw it at any time from Your Privacy Choices. We never share viewing activity for titles rated M or R, and never for viewers we do not know to be adults.

What we do share by default. To measure advertising, we may share events that carry no video identity — such as account creation, coin purchases, and subscription starts, together with their value — and hashed identifiers used to build and expand audiences. Where we group viewers into audiences based on what they enjoy, that grouping is done by us and the identifiers we upload do not tell the recipient what anyone watched. You can turn all of this off at Your Privacy Choices.

We never publish your viewing history. Some jurisdictions provide specific statutory protections for video viewing records; where those laws apply, we honor them.

7. Retention

We keep personal information for as long as your account is active and as needed to provide the Service. After you delete your account, we delete or de-identify your personal information within 90 days, except where we must keep records longer for tax, accounting, fraud prevention, dispute resolution, or other legal obligations — for example, transaction records are typically retained for seven years. Backups are purged on a rolling schedule.

8. Cookies and tracking

We use strictly necessary cookies for sign-in and security, preference cookies to remember settings such as sound and playback, and analytics cookies and SDKs to understand usage. Where required by law, we request consent before setting non-essential cookies and provide a way to change your choices.

We honor Global Privacy Control (GPC) signals where legally required. Browser “Do Not Track” signals are not currently standardized and we do not respond to them separately.

9. Apple TV

The xdrama app for Apple TV collects less than our other apps. It has no advertising identifiers, no advertising or attribution SDKs, and no analytics SDK, and it does not request permission to track you across apps or websites. Sections of this Policy describing advertising identifiers, ad measurement partners, and cross-app tracking do not apply to the Apple TV app.

Signing in on Apple TV works differently because typing credentials on a remote is impractical. The TV shows a short code and a QR code, and you approve the sign-in on a phone or computer where you are already signed in. To make that work we create a temporary activation record containing the short code, a one-way hash of a secret the TV generates, an optional device name, and timestamps. The TV never handles your password, and the activation record is stored only until it is used or expires — typically minutes — after which it is deleted.

Once signed in, the Apple TV app uses the same account as our other apps, so your watchlist, viewing history, and entitlements are the same information described elsewhere in this Policy. Video is streamed rather than downloaded, and playback progress is saved to your account so you can continue on another device.

10. Your rights and choices

Depending on where you live, you may have the right to:

access the personal information we hold about you and request a copy;
correct inaccurate information;
delete your account and associated personal information;
port your data to another service;
opt out of targeted advertising, “sales,” or “sharing” — use Your Privacy Choices;
withdraw consent where processing is based on consent;
object to or restrict certain processing;
not be discriminated against for exercising these rights — we will not degrade your service for doing so.

You can update your profile and delete your account in the app or on the website, and you can unsubscribe from marketing email using the link in any message (we will still send necessary account and transaction messages). To make a request, contact legal@spikelabsinc.com. We will verify your request, typically through your account email, and respond within the time required by law. You may use an authorized agent where permitted. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority.

11. Children and teens

The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it and terminate the account. If you believe a child has provided us information, contact legal@spikelabsinc.com.

Users under 18 may access only content rated for their age group. We do not knowingly serve targeted advertising to users we know to be under 18, and we do not sell or share their personal information for targeted advertising.

12. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, credential management, and monitoring. Payment credentials are handled by PCI-compliant processors. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and regulators as required by law.

13. International transfers

We are based in the United States and use service providers in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ. Where required, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum.

14. Changes to this Policy

We may update this Policy as the Service evolves. If we make material changes, we will notify you through the Service or by email before they take effect and update the date above.

15. Contact us

Spike Labs, Inc.
4845 Pearl East Cir Ste 118 PMB 522889
Boulder, Colorado 80301-6112
United States
legal@spikelabsinc.com