Why a website suddenly needs permissions
In Chrome, your site asks for the camera and Chrome asks the user. Chrome already holds the Android permission; it just decides whether to pass it on. When the same page runs inside your own app, your app is the one that must hold the permission — and if it is not declared in the manifest, Android refuses silently. The page's getUserMedia() call rejects, the file input opens nothing, geolocation returns an error, and nothing tells you why.
So converting a website to an app means listing, once, everything the site does with the phone. This tool turns the list of features into the list of permissions, and tells you what the visitor will see and what Google Play will ask.
Normal, dangerous and runtime
Android sorts permissions into two families. Normal permissions (internet, vibrate) are granted at install with no prompt. Dangerous permissions (camera, microphone, location, storage, notifications since Android 13) are granted at runtime: the visitor sees a system dialog the first time a page uses the feature and can refuse. A refused permission makes the web API fail exactly as it does when someone refuses in Chrome, so a page that already handles the "denied" branch handles the app too.
Declare less than you think
| You want | You need | You do not need |
|---|---|---|
| Tap-to-call links | Nothing — tel: goes to the dialler | CALL_PHONE |
| File downloads | Nothing on Android 10+ | WRITE_EXTERNAL_STORAGE, except capped to API 28 |
| Photo upload on Android 13+ | Nothing — the photo picker is permission-free | READ_MEDIA_IMAGES, unless you need older phones or "all files" |
| Approximate location | ACCESS_COARSE_LOCATION | ACCESS_FINE_LOCATION |
| Opening maps or email | Nothing — geo: and mailto: are handed off | Anything |
Every dangerous permission you declare is a line in Play Console's permissions declaration and a question in the review. An app that declares the microphone and never visibly uses it is a rejection waiting to happen. Declare what a feature needs, and nothing for the features you might add later — permissions can be added in an update.
The Data safety form
Google Play asks every app what data it collects and shares, and the answers are shown on the listing. A permission is not itself data collection — holding the camera permission does not mean you collect photos — but the feature behind it usually is. The third column above is the honest mapping: if a photo taken in the app is uploaded to your server, declare "Photos and videos" as collected; if location is sent with a form, declare location. The Play policy guide walks through the form for a typical website app.
Android 13 and notifications
Since Android 13, notifications need a runtime permission like the camera does. An app that skips POST_NOTIFICATIONS can still send pushes — they are just never shown. The builder's push option declares it and asks at the right moment; if you are building natively, ask after the visitor has seen why notifications would be useful, not on the first launch.