App Permissions to Refuse Before You Install
A game needs very little from your phone. Reading your texts and acting as an accessibility service are the two permissions to refuse every time. This page covers twelve permissions and how to check your own.
The two to refuse every time
Reading your texts (SMS). Banks, UPI apps and websites send one-time passwords, called OTPs, by text message. An app that can read your texts sees an OTP the second it lands, usually before you do. Android also lets an app receive one verification message without access to your inbox, which Google’s developer documentation describes.
Accessibility service. This feature exists so that someone who cannot easily see or touch a screen can still use a phone. To do that job, a service can read everything on the screen and carry out taps, swipes and typing. In the wrong app, that means watching you sign in, reading codes off the screen and pressing buttons for you.
Twelve permissions at a glance
This table is general, because we have not seen any particular 91 Club app file. The two in bold are the ones to refuse every time. For the rest, “No” means a game has no reason to ask, so a request is your cue to stop and think.
| Permission | What it lets an app do | Does a game need it? |
|---|---|---|
| Read or receive SMS | Read every text, bank codes included, and sometimes send texts | No. Refuse every time. Android can hand an app one verification code without the inbox |
| Accessibility service | Read the screen and tap, swipe and type for you | No. Refuse every time. It exists to help people who struggle with a touchscreen |
| Notification access | Read every notification, codes included, and dismiss them before you see them | No |
| Display over other apps | Draw on top of other apps, such as a fake sign-in box over your banking app | No |
| Install unknown apps | Ask to install more apps from outside a store | No |
| Device administrator | Lock the screen, wipe the phone, and make the app hard to uninstall | No |
| VPN service | Sit between your phone and the internet and see or change where your traffic goes | No |
| All-files access | See, change or delete files across shared storage: photos, downloads, documents | No. A game needs only its own files |
| Contacts | Read the names and numbers of everyone you know | Not to play. “Invite friends” is the usual reason, and it hands over your friends’ numbers |
| Call log and phone state | See who you called and when, your number and SIM details, and whether a call is in progress | No |
| Camera and microphone | Take photos and record video or sound | Rarely, and only for a feature you choose, such as a profile photo. Pick “Allow only while using the app” or “Ask every time” |
| Location | Know where you are, down to your street if precise location is on | Not to play. Online platforms sometimes ask which area you are in. If you allow it, choose “Allow only while using the app” |
How an app asks, and where you can say no
Ordinary permissions, such as contacts or location, arrive as a pop-up with a Don’t allow button, and pressing it is always fine. The riskier ones work differently. Android’s developer documentation says special permissions cannot be granted from a pop-up. The app has to send you to a Settings screen and wait for you to flip the switch. Accessibility and VPN work in a similar way, through their own Settings screen or a system box.
So an app that talks you through switching on a special permission “to make the game work” is asking for something a game does not need. A file from outside a store also has no store page listing its permissions, so the pop-ups and Settings screens are your only preview. If the publisher gives a fingerprint, which is a code worked out from the whole file, check your file against it with the file fingerprint checker first. The App and APK guide has the other checks.
A one-minute audit of your phone
Menu names change with the maker and the Android version. If a screen is not where this page says, use the search bar in Settings and enter the permission’s name.
- App by app. Open Settings, tap Apps, tap the app, then tap Permissions. Tap anything the app does not need and choose Don’t allow. Google’s help page shows the same route.
- Permission by permission. Many phones have a Permission manager under Settings, then Security and privacy, then Privacy. Open SMS to see every app that can read your texts, and switch off any you do not recognise.
- Special access. Open Settings, then Apps, then Special app access. Check Install unknown apps, Display over other apps, Device admin apps, Notification access and All files access, and switch off any app you do not recognise. Only your browser or file manager should be able to install apps, and only while you are installing.
- Accessibility. Open Settings, then Accessibility, and look through the downloaded or installed apps. Switch off any you did not turn on yourself.
- VPN. Open Settings, then Network and internet, then VPN. Forget any VPN you did not set up.
If you already allowed one
- Switch it off and uninstall the app. If the switch turns itself back on, or Settings keeps closing, use the removal checklist in the mod APK guide.
- Treat any code that arrived by text while an app could read your messages as seen. Check your bank and UPI history for payments you do not recognise, and call your bank at once if you find one.
- Change passwords from another device, starting with your email.
- If money has gone, or you gave out a code, follow what to do after a scam.
Common questions
Does any game really need to read my text messages?
Not to play. A game can send you a code by text without reading your inbox, and Android has a built-in way for an app to receive one verification message. An app that asks for all your texts is also asking to see your bank codes.
How do I see which apps can read my texts?
Many phones have a Permission manager, often under Settings, then Security and privacy, then Privacy. Open SMS in it to see every app that holds the permission. Without one, check each app under Settings, Apps, Permissions.
Does “Allow only while using the app” limit what an app can do?
Yes. For permissions that offer it, such as location, the app can use the permission only while it is open on your screen. It does not help with special access such as accessibility, which is simply on or off.
Can an app switch on accessibility without my knowing?
On current versions of Android it cannot. The app has to send you to the Accessibility settings, where you flip the switch yourself, usually after a warning. The danger is being talked into it, so refuse any app that asks.
What if an app will not open unless I allow SMS or accessibility?
Then the app is telling you what it wants. Uninstall it rather than hand over your texts or your screen. A web page cannot read your inbox or use accessibility settings, which is one reason the shortcut route needs neither.