Checked the merged manifest, so this is the real answer, not a guess: The app requests exactly one permission: INTERNET. That's it — needed to fetch the news feeds and article pages, and nothing else. No storage, location, contacts, camera, microphone, phone state, Bluetooth, or notification permissions. It doesn't request them because it doesn't do anything that would need them. Saved articles and settings live in the app's own private sandbox, which doesn't require a storage permission. The only other line you'll spot in the manifest is DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION at the signature protection level. That's not a user-facing permission and grants the app no access to anything — Android auto-generates it to lock the app's internal broadcast receivers to its own signing key. Every modern Android app targeting recent API levels has it; it's a security measure, not a capability. So if you install it and check, you should see a single permission: internet access. If it ever asks for more, something's wrong and I'd want to hear about it.