GlowUp Android Permissions

Camera

Manifest: android.permission.CAMERA
Why we ask: Take a new avatar photo inside the Profile centre.
When we ask: Profile → Avatar → Take a photo.
What we do with it: Live capture into the local avatar editor; saved per the avatar pipeline only.
If you decline: Avatar capture disabled; you can still choose from the gallery.

Microphone

Manifest: android.permission.RECORD_AUDIO
Why: Record a 5-second Cue Note voice memo attached to a checkpoint in Replay.
When: Replay checkpoint → mic.
What: Encode locally and bind to the checkpoint object.
Decline: Cue Note disabled; written checkpoints still work.

Photos / videos (read)

Manifest: READ_MEDIA_IMAGES / READ_MEDIA_VIDEO on API 33+; READ_EXTERNAL_STORAGE on older Android.
Why: Pick a photo from your gallery to use as your avatar.
When: Profile → Avatar → Choose from gallery.
What: Scoped read through the system picker — no scanning, no bulk indexing.
Decline: Gallery pick disabled; camera capture remains.

Photos / videos (write)

Manifest: MediaStore insert (no runtime permission on API 29+); WRITE_EXTERNAL_STORAGE on older Android.
Why: Save the Replay Summary Card to your gallery on export.
When: Replay → Summary Card → Export.
What: Insert one image item per gesture into the public Pictures collection or app-scoped folder.
Decline: Save-to-gallery fails; the card stays in the in-app archive.

Notifications

Why: Incoming call or message alerts if build enables.
When: OS prompt on first alert-worthy event.
What: Channel metadata only—no sale of notification content.
Decline: Alerts may be delayed until you open the app.

Network / state signals

Why: Detect offline states, retry queues.
When: Often bundled without a modal; still disclosed here.
What: Reachability flags, not browsing history.
Decline: Rarely user-toggleable; app may exit if fully air-gapped.

Signals that may flow without a runtime sheet

Diagnostics bundles can include installation-scoped identifiers the OS or SDK exposes—colloquially grouped as “Device ID” in questionnaires. They support crash deduplication and fraud clustering, ride inside the analytics category, and are not sold.

Recipients after permissions are satisfied

Media moves through CDN/storage; flagged content may route to moderation SaaS; diagnostics go to crash vendor. Contracts prohibit independent marketing use.

Storage periods (compressed)

Call path data minimized post-session; chat follows product TTL; diagnostics roll; safety artefacts case-based.

Your rights (mail)

Access/delete/correct/portability/object/restrict—ask customer@liangcoupytrading.com. Fifteen-business-day target post-verification. No login means we may request harmless corroboration.

Regional (short)

California “California Privacy Request”; Virginia opt-out subject lines as in other notices; EEA/UK GDPR rights via same inbox.

Sale / targeted ads opt-out strings

Subjects “Opt-Out of Sale/Sharing Request” and “Opt-Out of Targeted Advertising” even though we do not monetise those channels here.

Permission-first privacy map