Scan All Data & Permissions

LAST UPDATED: SEPTEMBER 2026

Full transparency into hardware access and privileges.

Scan All requests only the bare essential permissions required to decode barcodes and provide haptic feedback. Camera frames are processed strictly in volatile device memory and immediately released. Invasive privileges like GPS location, address book scraping, and audio recording are strictly omitted.

1. Minimal Privileges Philosophy

Every permission declared in Scan All's AndroidManifest.xml is directly tied to a visible user-facing function. We believe true security begins with architectural restraint: an application cannot abuse a privilege it does not possess.

2. CAMERA Permission

android.permission.CAMERA

Purpose: Required to open your phone's optical camera sensor and stream live video frames into Google Play Services ML Kit and CameraX for real-time barcode decoding.

Data Accessed: Live viewfinder frames are processed in volatile RAM only. No images, video recordings, or facial data are ever saved to disk or transmitted to any server. When the scanner screen is closed, the camera session is instantly released.

3. VIBRATE Permission

android.permission.VIBRATE

Purpose: Triggers your smartphone's physical haptic actuator to provide an instant tactile pulse when a barcode is recognized.

Data Accessed: None. Haptic feedback can be toggled on or off at any time in the app's Settings menu.

4. INTERNET & Network State

android.permission.INTERNET & ACCESS_NETWORK_STATE

Purpose: Declared to allow launching external web intents when a user explicitly taps “Open in Browser” on a scanned URL.

Data Accessed: None by the app. Scan All performs zero background HTTP/HTTPS telemetry, zero analytics pings, and zero cloud uploads. The Anti-Scam Brand Protection system verifies domain syntax using local regular expressions without contacting the internet.

5. Permissions Deliberately Omitted

To protect user safety and device integrity, Scan All deliberately omits the following permissions commonly found in other scanner apps:

ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION: Scan All never tracks your physical location or GPS coordinates.

READ_CONTACTS: Contact vCards created in the QR generator are constructed strictly from manual input. We never read your existing phone book.

RECORD_AUDIO: Scan All contains zero audio recording, speech listening, or microphone access capabilities.

READ_EXTERNAL_STORAGE: Scan history is saved strictly in Android's private sandbox, avoiding unnecessary broad storage privileges.

6. Security & Audit Verification

You can independently verify the permissions requested by Scan All on your Android device at any time by navigating to Settings → Apps → Scan All → Permissions. No hidden runtime permissions are requested or granted.

7. Contact the Security Team

If you are an independent security researcher or user with questions regarding our permission model, please contact PMC Labs at: pmclab.dev@gmail.com