Needle Quest: Haystack Secrets
Privacy policy

Android edition · Version 0.63.2 · Onknee Games · Updated 14 November 2026

Your game stays on your device

The game does not require a player account. Progress and preferences are stored in the app on your device: haystacks, collected straws, currencies, tools, upgrades, needles, tutorial progress, and audio, language, camera and graphics settings. Local save identifiers, revisions and timestamps help recover the latest valid save. Complete save files and their identifiers are not uploaded to Onknee Games or Google Analytics. Optional usage statistics, described below, can include limited progress milestones. The Android edition does not load the Playgama or GamePush services.

Optional usage statistics: Google Analytics for Firebase

Google Analytics for Firebase helps Onknee Games understand the tutorial, early purchases with game currency, and where play sessions stop. It starts off on a fresh installation and requires a voluntary saved permission. In version 0.62.13, Settings → Privacy settings offers two direct actions: Send all analytics enables the configured optional services described in this policy, including Firebase; Send only necessary data turns these optional services off. Closing the card or continuing to play does not grant permission or change existing choices. The Android edition is not directed to children and does not ask for an age at startup. A local general-audience application setting does not mean that a player has declared an age, and does not grant any analytics permission. Previously saved recipient permissions and refusals, including partial selections, remain in effect until an explicit new choice; previously declared under-16 restrictions remain effective. The local application-audience setting and consent choices are not sent as analytics events.

When enabled, limited events describe tutorial steps and acknowledgements, first discoveries, shops opened, successful purchases with game currency, approximate active play time, loading time, and fixed technical-error categories. The game does not send save files, words you enter, exact world positions, names, emails, or advertising identifiers through this analytics feature. Firebase assigns a pseudonymous app-instance identifier and processes basic application and device information, app lifecycle/session events, and coarse location derived from network information. This is not anonymous data. Granular location/device collection, Google Signals, advertising personalisation and Google Ads account links are disabled for our analytics property. Analytics data is sent to Google over encrypted connections. See Firebase data collection and Google's privacy policy.

You can turn Firebase statistics off with Send only necessary data in Settings → Privacy settings. This stops new gameplay-statistics collection and resets the local Firebase analytics identifier. It does not delete statistics already received by Google. Event-level Firebase analytics is configured for two-month retention; standard aggregated reports can remain longer. Analytics choices do not affect gameplay or grant advertising consent. Debug/development Firebase statistics use a separate test property.

Other optional statistics and installation measurement

Version 0.61.58 introduced GameAnalytics gameplay statistics and, when configured, Meta installation measurement. Version 0.62.1 added AppMetrica. Earlier editions offered recipient-specific switches. Version 0.63.0 replaces those switches with the two direct actions above: Send all analytics allows all configured optional recipients described here for their stated purposes; Send only necessary data declines all of them. The app keeps a separate saved permission for each recipient and preserves older partial selections when you open or dismiss the card. An old permission for one recipient does not enable another, and an integration requiring a new permission does not inherit an older one. Reading this policy, agreeing to general terms or continuing to play is not permission to start any of these services. The Privacy policy remains accessible from the main Settings screen.

GameAnalytics: optional gameplay statistics

GameAnalytics can receive limited tutorial milestones, discoveries, shops, purchases with game currency and session progress to help us improve the game. Its saved permission is independent of Firebase. It starts off and is included in the explicit Send all analytics action in Privacy settings; choosing Send only necessary data keeps it off. Closing or leaving the card unanswered does not enable it. It does not initialise for previously declared under-16 players or a retained legacy unknown-age restriction.

When allowed and configured, GameAnalytics processes a pseudonymous SDK-generated app identifier and app-set identifier, basic app and device information, session timing and country derived from network information, together with the permitted gameplay events. This is not anonymous data. Advertising-identifier tracking is disabled. We do not supply a custom player identifier or send precise location, complete saves, exact world positions, exact age, names, emails or free-form player text. You can stop future submissions in Settings → Privacy settings; a request already in flight may finish. This does not erase data already received by the provider or promise to reset its identifiers. See the GameAnalytics privacy notice for retention, deletion and contact information.

Meta App Events: optional installation measurement

Where a build includes configured Meta App Events, its optional purpose is to measure whether a promotion led to an installation or opening of the Android app. This installation-measurement purpose is included in Send all analytics and disabled by Send only necessary data. Its permission is stored separately: an older Firebase or other gameplay-statistics permission does not enable Meta. It does not initialise for previously declared under-16 players, a retained legacy unknown-age restriction, or anyone who has not allowed it. If Meta is not configured, no Meta measurement starts.

When allowed and configured, Meta receives installation/opening events and basic application, device and network information for measurement. Android Advertising ID collection, automatic app-metadata collection and automatic product-improvement data collection are disabled. The game does not send names, emails, exact age, save files or gameplay-statistics events to Meta. Settings → Privacy settings lets you stop new measurement; this does not delete data already received. See Meta's privacy policy.

AppMetrica: optional gameplay statistics

Beginning with Android version 0.62.1, configured builds include AppMetrica, provided by Yandex, for limited tutorial, discovery, upgrade and level-progress statistics. It starts off and requires a saved, voluntary permission, now included in Send all analytics. It is not initialised before that permission, for previously declared under-16 players or a retained legacy unknown-age restriction, or after Send only necessary data. Existing permissions for other services are not reused. Choosing not to allow AppMetrica does not affect gameplay.

When allowed, AppMetrica receives the same limited, predefined gameplay-event fields, session and installation information, basic app/device information and SDK-generated pseudonymous app/device identifiers. From Android version 0.62.6, this optional analytics integration also includes Google's App Set ID for statistics. Depending on how the app was installed and Google Play services availability, this identifier can be scoped to this app or to apps published under the same Google Play developer account. It is distinct from an advertising ID. The app requires a new AppMetrica permission for this updated disclosure; a permission saved for an earlier version does not enable the updated integration, and your choices for other services are preserved until you explicitly select Send all analytics or Send only necessary data. AppMetrica processes network information, including the IP address needed for communication, which can be used to infer a country. This is not anonymous data. We do not set a custom user/profile identifier or send names, emails, exact age, complete saves, exact world positions or free-form player text. The advertising-identifier, device-location, automatic-purchase, remote-permission and screenshot modules are excluded. Advertising-ID and device-location tracking, crash/ANR reporting, automatic activity/app-open tracking and automatic revenue tracking are also disabled in the app configuration. Gameplay sessions are controlled by the app lifecycle. See Google's App Set ID documentation for its scope and reset conditions.

You can turn AppMetrica off in Settings → Privacy settings. This stops new gameplay-event submissions and disables SDK sending; a request already in flight may finish. Turning it off or clearing local progress does not delete data or identifiers already received by the service. See AppMetrica's privacy controls and Yandex's privacy policy for provider processing, retention and request routes.

These optional permissions can be changed together in Settings → Privacy settings; they do not block the opening comic or gameplay. Refusing does not affect gameplay, rewards or advertising choices. Send only necessary data disables the optional gameplay-statistics and installation-measurement services described above. Technical processing needed for local saves, delivery of permitted advertisements, their operation and fraud prevention can continue; this action does not grant advertising consent. Exact age and the locally stored age group are not sent to the optional analytics services. Gameplay events are not buffered before permission for later upload.

From version 0.62.7, successful purchases with game currency also describe the price, balances before and after, upgrade levels and their effect, and active gameplay time at the purchase. Currency exchanges are recorded only after they succeed. These are game-economy statistics, not real-money purchases. When an advertising SDK reports actual impression revenue, the game can send the amount, currency, advertising network, format, fixed in-game placement and revenue precision separately to each analytics service you have allowed. AppMetrica uses its advertising-revenue report. Firebase and GameAnalytics receive separate revenue diagnostics, so a provider's automatic Firebase impression is not counted twice by our callback. This is manual, consent-gated reporting; automatic AppMetrica revenue tracking remains disabled. No advertising SDK callback enables an analytics service, and advertising privacy choices do not grant optional analytics permission.

From version 0.62.12, players with previously saved refusals or limited advertising choices may receive a one-time invitation to review updated privacy options after the opening comic or game has appeared. The invitation does not erase a previous refusal or enable a service. In version 0.62.13 it uses the same Send all analytics and Send only necessary data actions; closing it keeps existing choices and acknowledges the invitation. A new refusal does not cause a new request on every launch. An interrupted invitation may be offered on a later launch. Only an explicit analytics action changes the optional recipient permissions, and only Google's form changes the advertising choice.

Advertising in Android version 0.62.3 and later

The Android app uses CAS.AI (Clever Ads Solutions) to mediate advertisements. Versions 0.62.3–0.62.7 include Google Mobile Ads, Unity Ads and Kidoz. From Android version 0.62.8, the included adapters also cover Chartboost, InMobi, ironSource and Liftoff Monetize (Vungle). From Android version 0.62.9, the included adapters also cover AppLovin, Mintegral and Pangle. Their availability also depends on the CAS account configuration and available inventory; including an adapter does not guarantee an advertisement will be available. Earlier Android versions used Google AdMob directly. This change does not change the advertising provider used by the separate iOS edition.

Optional rewarded advertisements offer the bonus described on screen. A reward is granted only after the advertising SDK confirms that it was earned; an unavailable advertisement, early dismissal or failed request does not grant it. Interstitial advertisements can appear at natural breaks, such as closing an upgrades or sale window or moving to another haystack. They do not appear during the first four minutes of a game session, and the game allows at least three minutes after a completed full-screen advertisement before another interstitial. You can continue playing when an advertisement is unavailable. Internal debug builds use CAS test advertisements.

Advertising services process connection and technical information needed to deliver advertisements, measure their operation and prevent fraud. Depending on the included network, this can include IP-derived approximate location, application and device information, advertisement interactions, diagnostic information and permitted app-scoped identifiers. CAS's retained startup provider prepares local application/lifecycle preferences and a random installation identifier; this is separate from optional gameplay statistics. From version 0.62.11 a fresh installation opens the comic directly, without asking for an age. A local general_app setting describes the application's non-child target audience, not the player's age. Previously declared under-16 restrictions and separately saved analytics decisions are preserved. An explicit unknown-age choice from an earlier version retains its protected advertising treatment unless the player changes their privacy settings. The advertising privacy check begins only after the comic or returning player's game is visible. Applicable Google UMP choices are required before mediated advertising requests; declining gameplay analytics does not itself block ads. Rewarded inventory is prepared after the second successful player sale of a session, and interstitial inventory after the fourth; explicit rewarded offers can prepare their own inventory. Preparation does not show an advertisement. Unity's network setup is deferred until the advertising checks finish. Some included libraries register local lifecycle hooks, independently of advertising loads. AppLovin's automatic startup provider is removed. The TikTok companion library does not enable TikTok installation analytics. We do not supply a custom advertising user identifier or a personal age.

Google, Unity, Kidoz, Chartboost, InMobi, ironSource, Liftoff, AppLovin, Mintegral and Pangle handle information under their own privacy policies. This app does not request Android Advertising ID, AdServices advertising-identifier or attribution permissions, precise or coarse device-location permissions, or phone-state permissions. These restrictions do not mean that an advertising network cannot receive an IP address or process an app-scoped identifier. We do not report real-money purchases to CAS or enable its optional analytics integrations. See CAS.AI's privacy policy, Google's privacy policy, Unity's game-player privacy policy Kidoz's privacy policies, Chartboost/LoopMe's privacy notice, InMobi's privacy policy, Unity/ironSource's game-player privacy policy Liftoff/Vungle's privacy policy, AppLovin's privacy policy, Mintegral's privacy policy and Pangle's regional end-user privacy policies. Advertising service connections use encrypted transport.

Your advertising choices

Fresh installations use the application's general-audience setting, not a declared personal age. Retained age groups from earlier editions continue to affect advertising: known ages below 16 can play but do not initialize mediated advertising or load ads; ages 16–17 use Google teen treatment, and ages 18 and over use unspecified age-restricted treatment. A retained legacy unknown-age choice uses protected child-directed treatment, Google child treatment, an under-age-of-consent flag and a G ad-content cap. Networks that do not support that protected treatment are not eligible for that request. Merely opening Privacy settings preserves it. Explicitly saving either of the current analytics actions may adopt the application's general-audience setting for an older unknown-age profile; this does not assert the player's age or grant advertising personalization. A previously declared under-16 restriction cannot be removed through these actions.

The app requests a conservative denied-consent fallback from CAS; applicable choices actually recorded by Google's UMP are still read by the advertising integration. The game's code never treats Google's permission to request an advertisement, or its form's saved-answer status, as consent to all personalized advertising. The sale-of-data opt-out, disabled location collection and Google's G maximum ad-content rating remain in the app's request configuration. The adapters use explicitly pinned SDK versions selected for compatibility with CAS. If an initialized advertising treatment changes during a running process, the game discards cached advertisements and disables further advertising until the app is fully restarted; gameplay remains available.

The opening comic, or a returning player's game, becomes visible before the publisher-owned Google UMP advertising privacy check begins. UMP stores and reuses its choices; Google displays its own form only when required. Known ages below 16 skip this advertising check. The network check has a bounded wait and does not prevent the comic from appearing if the connection is slow; a visible Google form remains under your control. This check does not initialize the CAS advertising manager, initialize Unity, or preload advertisements. Advertising setup and inventory requests are deferred until the applicable privacy checks and an eligible preparation or placement request. The app does not show a second CAS consent form.

In Settings → Privacy settings, an Ad choices saved row is available when Google requires a way to revisit advertising choices. Its checkmark means that the official form has a saved answer, which may include a refusal; it does not mean that every advertising purpose or vendor was accepted. Tapping the row opens Google's official privacy form. The app's checkbox cannot grant or rewrite advertising consent. Advertising choices remain independent of Send all analytics and Send only necessary data. The Privacy policy can still be opened from the main Settings screen. You can also manage your device's advertising privacy settings in Android. The game does not ask for your name, email, precise location, contacts, camera or microphone.

For an advertising-data question or deletion request, contact nermachkov@gmail.com using the privacy-request route below and name CAS, Google advertising, Unity Ads, Kidoz, Chartboost, InMobi, ironSource, Liftoff/Vungle, AppLovin, Mintegral or Pangle as appropriate. Their linked policies also describe provider-specific request routes. Turning an advertising or statistics option off, clearing local progress, or uninstalling the game does not by itself delete records already received by a provider.

Backups and deletion requests

To request deletion of data processed through an optional service, email nermachkov@gmail.com with the subject “Needle Quest privacy request”. Include your app version, the approximate date you played and the service concerned: Google Analytics for Firebase, GameAnalytics, AppMetrica or Meta. Do not send passwords, payment details or your complete game save. Because the game has no player account and these services use pseudonymous identifiers, these details may not identify a server record by themselves. If more information is needed to locate it and verify your request, we will explain the minimum required; we cannot promise that clearing the game or switching an option off deletes server records. You can also use the deletion and privacy-request routes in Google's, GameAnalytics', Meta's and Yandex's privacy policies. This contact route is also available to parents or guardians with a concern about a child.

Download backup and Load backup let you explicitly save a progress file or choose one to restore using Android's document picker. These files are not uploaded to Onknee Games. You choose the destination and control any sharing. Files saved to another provider are subject to that provider's rules.

Automatic Android cloud backup and device transfer of the app's private progress are disabled. You can start over with the in-game New game confirmation or clear the app's storage in Android. Uninstalling removes app-private progress. Exported files must be deleted separately from the location you selected.

Children and changes

The current Android edition is intended for players aged 16 and over and does not collect an age at first launch or in the current Privacy settings card. Earlier editions stored only a broad age group (under 13, 13–15, 16–17, 18 and over, or unknown), not the exact entered age. Retained groups stay on the device and are not sent as an age or age-group field to Onknee Games or the optional analytics services. Previously declared under-16 players retain their restrictions on advertising and optional statistics. A retained unknown-age profile keeps optional statistics off and receives protected advertising until an explicit current settings action adopts the application's general-audience setting as described above. The general-audience marker is an application setting, not an inferred or declared personal age.

Firebase Analytics, GameAnalytics, AppMetrica and Meta App Events require their saved optional permissions as well as an eligible local audience setting. Send all analytics cannot override a previously declared under-16 restriction. We do not treat a parental gate, general terms, an advertising privacy answer or continuing to play as permission for these services.

The game has no chat, user-generated content or player account system. For privacy questions or concerns about a child, contact us below. If the app's data handling changes, this policy and the store disclosures will be updated.

Contact

Onknee Games · nermachkov@gmail.com · onknee.games