Whenever there is an app from Google Inc in the Android market, I am uncomfortable with their permission levels: Why do they always need read/write permissions to personal data/contacts and all our personal stuff?! Even though I believe google, I am not interested in sharing my personal data with them. Can something be done -- like, limiting the permissions?
closed as not constructive by Al Everett, Liam W, t0mm13b, ce4, eldarerathis♦ Dec 19 '12 at 1:39
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
As Goggles is an app that you've said you're curious about, here are the permissions it asks for(copied from the Market web page):
This application has access to the following:
Having used Goggles for a while, these all seem fairly innocuous, here are what Goggles does that needs those permissions:
Your Accounts Everything unuder this heading is needed because Goggles links to your Google account and stores your Goggles history in your Google account, so that you can go back at look at your previous searches, even after you change phones. To do this it needs to access the Google account login credentials already saved in your phone's "Accounts" list, otherwise it would have to prompt you to log in to Google every time you open it, or re-save your credentials again itself, which is a bit silly when they're already stored centrally on the phone. If you have more than one Google account on your phone, then the first time you open Goggles it asks you which one you want to save your history into. There's a setting that stops it saving your search history if you don't want this.
Hardware Controls The entire point of Goggles is to take pictures using the camera, it can't do that without these permissions.
Your location Using Goggles you can take pictures of landmarks and buildings and have it automatically identify them. It uses your location to help it narrow down the guesses of what you're photographing.
Network communication It uses Google's servers and massive databases to help it identify the potentially billions of different things you could photograph and ask it to recognize.
Your personal information *read/write contact data* You can take a photo of a business card with Goggles and have it save the contact details from the business card straight into your Contacts.
Storage You can set Goggles to save all the images it takes to your SD card for later viewing via the gallery app (this is in the Settings and is off by default).
So, as far as I can see, they have a legitimate reason for all of the permissions that the app asks for that fits with one or more of the apps functions or needs. Could they also use these permissions for other purposes? Yes, but personally I trust the app to only use the access for the required purposes, after all Google has plenty of other ways to get all of that info, as I'm already syncing all of my Contacts, etc up to GMail anyway!
The apps are usually in some way tied to your contacts. Like Gmail for example, if they did not read your contacts, you could not get your contacts to show up when you typed in an email address or name. if they did not write, you could not add a new gmail contact.
Do you have a specific app you are curious about?
You cannot limit permissions of an application (by default, but there are some 3rd party ROMs that are testing this functionality)
If you are concerned about your privacy in general, there are approaches that can be taken. You will never convince Google to let go of their data hunger, and you won't argue many developers into changing their permission requirements, as most of those are really needed for core functionalities of the apps -- or at least functionalities most of the users want from them. But you can do something about your devices:
Privacy protectors for rooted devices
If your device is rooted, there are a few apps available to protect your data. Best known in this area is LBE Privacy Guard (which has some troubles with Jelly Bean currently), a closed-source app from China. Used by many people not only there, first doubts (closed source + China = Spyware?) won't hold long: People even tracked what the app was doing, up to now I heard no evil thing.
All these apps allow you to restrict actions an app might want to perform -- without causing the app to crash. Most likely all of them feed the apps fake data instead: Empty contacts/calendar, no network available, no (or a fake) location, randomly generated IMEI, and the like. You can configure on a per-app base which permissions to restrict.
But for sure, root is a must-have for them -- otherwise they wouldn't be able to restrict other apps.
Privacy settings for all devices
Without root, this gets a little tricky -- and not at all that perfect: you can disable all sync, use a non-google calendar/contacts app (with their own databases, not syncing with Google or anything else), decide to not backup your data to Google, etc. If you feel that's not enough, take a look at the article Life without Google for additional hints.
Going paranoid, you can also disable WiFi and mobile network completely. That's almost like buying a dumb-phone then -- but using apps from other sources (as explained in the linked article), you'd still have phone and PDA in one device. You'd just miss the other "half" of its features.
Many of us don't like to give up their privacy, though most don't seem to care. The Android system is still better in keeping it than many other systems around (no bashing, so I won't name any). With some precaution, a compromise seems possible to me: stay away from apps violating your privacy too much, and chose wisely what you install and use :)