Permissions explained
Every permission Haven declares, the exact feature that needs it, and what would break without it.
Haven's rule: a permission is only declared when a shipped feature needs it, and the feature is named. There are no "might be useful later" permissions.
Declared permissions#
| Permission | Feature that requires it | Without it |
|---|---|---|
INTERNET | Downloading signed blocklist updates; optional accounts; subscription validation; forwarding allowed DNS queries to the upstream resolver | No rule updates, no accounts, no subscription |
ACCESS_NETWORK_STATE | Required by the background-work scheduler so the blocklist sync only runs when a network is available | The sync would run and fail on a metered or offline device |
FOREGROUND_SERVICE | The protection service must be a foreground service | Android would kill protection in the background |
FOREGROUND_SERVICE_SPECIAL_USE | The declared service type for on-device DNS content filtering | The service could not start on modern Android |
POST_NOTIFICATIONS | The ongoing notification that shows protection is active | The user could not see that protection is running |
RECEIVE_BOOT_COMPLETED | Re-arming protection after a reboot | Restarting the phone would silently disable the block |
QUERY_ALL_PACKAGES | The App-check scan, the financial-protection app picker, and reading the label of the app currently in the foreground | Neither the gambling-app block nor financial protection could identify apps |
REQUEST_DELETE_PACKAGES | Handing a detected gambling app to Android's own uninstall dialog | The user would have to find it in Settings themselves |
Permissions the system grants, not the manifest#
Three capabilities are not ordinary permissions. Each is granted by the user in an explicit system flow, is revocable at any time, and has its own page here:
| Capability | Granted by | Page |
|---|---|---|
| VPN | Android's own VPN consent dialog | VPN service |
| Accessibility service | The user in system accessibility settings | Accessibility service |
| Device administrator | The system "activate device admin?" screen | Device admin |
All three are optional. Haven functions without any of them; it simply says honestly which layers are inactive rather than implying coverage it does not have.
The accessibility permission has a property worth stating: Android silently revokes it whenever the app is updated. Haven therefore re-offers it after an update rather than treating a one-time "not now" as permanent, because a permanently skipped prompt would leave two protection layers off for good.
Sensitive APIs Haven does not use#
Verified across the entire source tree:
| Not used | Would allow |
|---|---|
PACKAGE_USAGE_STATS / usage-stats access | Reading how long the user spends in every app |
SYSTEM_ALERT_WINDOW / draw-over-other-apps | Drawing over arbitrary apps |
| Notification listener service | Reading every notification on the device |
| Media projection / screen capture | Recording or capturing the screen |
| Location, contacts, camera, microphone, SMS, call log, calendar, storage | The obvious |
| Accessibility gesture dispatch, or global actions to manipulate other apps | Acting on the user's behalf inside other apps |
Haven never takes a screenshot, never records the screen, and never reads a notification.
Why QUERY_ALL_PACKAGES specifically#
This is the permission most likely to draw a question, so it is worth being exact.
Haven's protection is fundamentally about apps: a gambling blocker that cannot see that a casino app is installed is not doing its job, and financial protection needs the user to be able to pick their own bank from a list rather than type a package name.
The narrower alternatives do not work here:
- A
<queries>declaration listing specific packages would require Haven to enumerate every gambling operator's package name in the manifest — a list that would go stale immediately, cannot be updated without an app release, and would defeat the entire "no app update needed" design. - The launcher-intent
<queries>element is also declared and covers the visible-app listing, but the foreground-package label lookup and the heuristic classification need general visibility.
What Haven does with it is deliberately narrow:
- The list is read on-device only, to build a picker and to classify apps.
- Nothing about installed apps is stored off-device or transmitted anywhere.
- The scan result is not written to any log that leaves the phone.
See Package visibility.
Manifest facts a reviewer can check quickly#
<application
android:name=".AppBlockApplication"
android:allowBackup="false"
android:networkSecurityConfig="@xml/network_security_config"
... >allowBackup="false"— the app's data is not carried off the device by Android backup.- The release network-security configuration denies all cleartext traffic with no exceptions.
- All three intercept screens are
android:exported="false"and can only be launched by Haven's own service. - The VPN service declares
android:permission="android.permission.BIND_VPN_SERVICE"; the accessibility service declaresBIND_ACCESSIBILITY_SERVICE; the device-admin receiver declaresBIND_DEVICE_ADMIN. All three are system-enforced. - The device-admin policy file requests zero policies.