I have been using Evernote on my Laptop and Mobile phone for quite some time now. Recently, when downloading an update of Evernote app in my phone from Google Play app, I noticed that Evernote asks for some objectionable permissions:

enter image description here

enter image description here

enter image description here

enter image description here

I am not aware of any option/facility/service provided by Evernote which would require any of these permissions. Is Evernote Malicious?


3 Answers 3


The reason for "phone calls" might be quite easy: Looking at the app requirements, they list "Android 1.6 or higher". With that, this permission is automatically set -- whether the developer wants it or not. Reference: Android 1.6 Changelog.

An interesting discussion on this permission can be found at StackOverflow: Android permissions: Phone Calls: read phone state and identity.

Of course this might not be the only reason. If the app e.g. lets you take "call notes" for an ongoing phone call, it might want to connect it with the contact or at least the calling number. To get the contact, it needs the number. To get the number, it needs... yes, READ_PHONE_STATE. Not using EverNote, I cannot say if it offers such a feature.

Personal Information: A possible reason for Contacts I just explained. Some additional reasons, taken from the app description, could be:

  • Email notes and save tweets to your Evernote account (Email taken from contacts)
  • Share notes with friends and colleagues via Facebook and Twitter (again, your friends data is probably stored with your contacts)
  • Take meeting and class notes (meetings are probably among your calendar entries, so they could be connected)
  • Plan a trip: keep track of travel plans, plane tickets and passports (again a clear candidate for calendar: Travel plans)

As for accounts, pick reasons from above: How to share on your Twitter and/or Facebook accounts without accessing them?

So all mentioned permissions could be easily explained. Could, as it takes some guess-work. You may be able to tell my assumptions are true if you investigate the described features. But the devs should be able to confirm or deny -- and IMHO it is their responsibility to explain.

My suggestion to developers always is: If there are sensitive permissions involved, split the connected functionality into addons/plugins. My standard example: Locus Maps. It needs internet access to load maps, that's crucial to the app. Being a navigation app, you might want it to navigate you to your friends -- so accessing your contacts makes sense. But that together with internet, well... you might be concerned. So Menion (the dev) moved this part to a (free) addon. Choice is up to you: Trust him (and install the addon), or enter all addresses manually.

And for another thing I agree with a point mentioned here a couple of times: A 4.7 star rating with almost half a million downloads, I'd say if that app were malicious, we'd have heard about.



Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on"

I think it needs calls to make some appointment from them and all the other permission are maybe in the same feature class. I think other users are having similar concerns about other apps from big providers like facebook see here.

My take would be to ask directly Evernote why they need those features enabled.

This is no way a singular incident see a similar concern here.

  • 1
    There's no need for calls to make contacts for them (that would require calendar and contacts access). As described, many devs say their apps need that to detect incoming calls and react correspondingly (though that should no longer require this permission since Android 2.0). More likely those apps want to access the IMEI as "unique key" for ads. But as you said: Ask the dev, they should know.
    – Izzy
    Commented Nov 7, 2012 at 21:39
  • @Izzy very useful comment, didn't know that, thanks, I think is interesting that the developer put all the features in the same class. In my opinion accession calls should be sepparated from IMEI. And also iformation if there is a call from information about who's calling who. But then I'm not doing it, its not my call. Commented Nov 7, 2012 at 22:19
  • That's not the dev's fault. The permissions are sometimes not fine-grained enough. Take an example: you want to display ads in your free app. What permission do you need? Full internet, there's nothing else. But with that, you could do and more. Some ad services require IMEI (they say, to decide whether a given ad already had been displayed to this user) -- so if the dev wants to use this ad service, he'll have to request that permission. Only other reason I could see is if Evernote allows to take notes for an ongoing call, and would connect the number etc. with it.
    – Izzy
    Commented Nov 7, 2012 at 22:48
  • @Izzy Was tinking about the developer and designer of the platform in this case Google, they should have fine-grained more the access features, and make them more atomized. Commented Nov 8, 2012 at 0:14

I don't think since Evernote is quite big they would do something like that, and if would do so it would be something so easy to see. Actually when you are developing for android some methods would require this kind of permission, if i'm not wrong, if you want, for example, check for data connection needs READ PHONE STATE AND IDENTITY or for some advertising..

I've found an interesting article discussing it: Here

  • interestingly you found the same article as me check my last link ;) Commented Nov 7, 2012 at 22:11
  • Thanks for that link! Up to now I would have said: Data connection requires ACCESS_NETWORK_STATE, but not READ_PHONE_STATE. So the "data connected" phone state would give another argument besides 1.6 compatibility and advertisements.
    – Izzy
    Commented Nov 7, 2012 at 22:54
  • @EduardFlorinescu sorry, didn't saw your last link, just found this on google =p. @Izzy maybe Google should create another permission or let devs check for those things with ACCESS_NETWORK_STATE, but they probably have a reason to do that on READ_PHONE_STATE
    – Markissimo
    Commented Nov 8, 2012 at 10:32
  • @Markissimo no problem with me, this way adds more consistency to the general answer. Commented Nov 8, 2012 at 10:52

You must log in to answer this question.