Permissions explained

Parental controls need powerful permissions. Here is every single one.

Permission prompts like “Accessibility” and “Device admin” sound scary — rightly, because bad apps abuse them. This page documents each permission Safentora uses, straight from our Android manifest: why, when, what it touches, what it can never do, and how to turn it off.

Accessibility Service

BIND_ACCESSIBILITY_SERVICEMost asked about

Why we need it: This is how app blocking works. Android only lets an app reliably know which app is in the foreground through an accessibility service. When a blocked app opens, Safentora shows a full-screen “App blocked” notice instead.
When it's active: Only while the child device is paired and the service is enabled in Android Settings. It reacts to app switches — nothing else.
What data it touches: The package name of the app currently in the foreground (e.g. com.instagram.android). That single string is compared against your family's block list.
How to turn it off: Android Settings → Accessibility → Safentora App Blocking → off. App blocking stops working; everything else keeps working, and the parent dashboard shows the gap honestly.

What it can never do

Cannot read screen contents — the service requests no window content and no event text
Cannot see messages, photos, passwords, or anything typed
Never records or transmits what is on the screen
The block screen itself is a normal app screen, visible and labelled — not a hidden overlay

Location (including background)

ACCESS_FINE_LOCATION · ACCESS_BACKGROUND_LOCATION

Why we need it: Live family map and safe-zone alerts. Background access is what lets “arrived at school” alerts work while the phone is in a pocket with the screen off.
When it's active: Only after the child accepts the consent screen and location sharing is enabled. A persistent notification — “Sharing your location with your family” — is visible the entire time.
What data it touches: GPS coordinates with accuracy, speed and battery level, sent to your family's server and visible only to guardians in your family group.
How to turn it off: Android Settings → Apps → Safentora → Permissions → Location. Location sharing and safe-zone alerts stop; the dashboard shows the child as not sharing.

What it can never do

Never shared with advertisers or any third party
Never collected before consent is accepted
Never collected silently — the sharing notification cannot be hidden while tracking runs

Usage Access

PACKAGE_USAGE_STATS

Why we need it: Screen-time insight: how long each app was used per day, so families can talk about habits with facts instead of guesses.
When it's active: Granted once via Settings → Special app access → Usage access; read periodically while monitoring is active.
What data it touches: Per-app foreground time, bucketed per day (e.g. “YouTube — 1 h 40 m on Tuesday”). Time totals only.
How to turn it off: Android Settings → Special app access → Usage access → Safentora → off. Screen-time charts stop updating.

What it can never do

Cannot see what was watched, typed, or browsed inside any app
No screenshots, no screen recording, no content of any kind

Device Administrator

BIND_DEVICE_ADMIN (force-lock policy only)

Why we need it: The remote “pause” button: a parent can temporarily lock the screen — for dinner, homework, or bedtime.
When it's active: Enrolled through Android's own consent dialog (never silently). Used only at the moment a parent taps Lock.
What data it touches: None. This permission performs an action (locking the screen); it reads nothing.
How to turn it off: Android Settings → Security → Device admin apps → Safentora Remote Lock → deactivate. Remote lock stops working; the parent sees the command was not enforced.

What it can never do

Cannot erase the device or any data — Safentora requests only the force-lock policy
Cannot change or read the child's PIN or password
A locked device can still open Settings and make emergency calls

Camera

CAMERA

Why we need it: Scanning the QR pairing code during setup — so a child device can join the family without typing anything.
When it's active: Only while the “Scan QR code” screen is open during pairing. Never in the background.
What data it touches: The QR code in front of the camera is decoded on the device. No image ever leaves the phone.
How to turn it off: Android Settings → Apps → Safentora → Permissions → Camera. You can still type the pairing code manually.

What it can never do

Never takes photos or records video
Never accesses the camera outside the pairing screen

Notifications

POST_NOTIFICATIONS · FOREGROUND_SERVICE

Why we need it: Transparency, ironically: this permission lets Safentora SHOW notifications — including the persistent “Sharing your location with your family” notice that makes monitoring visible.
When it's active: While location sharing runs, the notification is always present.
What data it touches: None — this is about posting our own notices.
How to turn it off: Blocking notifications hides the sharing notice, which reduces transparency on the child device — Android may also stop the background service.

What it can never do

This is NOT “notification access” — Safentora cannot read notifications from other apps
Cannot see message previews, chat notifications, or anything another app posts

Start after reboot

RECEIVE_BOOT_COMPLETED

Why we need it: If the phone restarts, location sharing resumes automatically — otherwise safety features would silently stay off until the app is opened.
When it's active: Once, right after the device boots, and only if tracking was on and permissions are still granted.
What data it touches: None.
How to turn it off: Cannot be revoked individually on Android; disabling location sharing makes it a no-op.

What it can never do

Does nothing if monitoring was off or consent was withdrawn

Internet & wake lock

INTERNET · WAKE_LOCK

Why we need it: Standard plumbing: talking to your family's server over HTTPS, and briefly keeping the CPU awake to finish an upload before sleeping.
When it's active: Whenever the app syncs.
What data it touches: Only the data described above, over TLS-encrypted connections.
How to turn it off: Not individually revocable on Android (standard for all apps).

What it can never do

No third-party endpoints — the app talks to the Safentora API only

Just as important

Permissions we deliberately do not request

An app can't abuse a permission it never asks for. These are common in surveillance-style apps — and absent from Safentora's manifest by design.

Screen overlaynot requested

SYSTEM_ALERT_WINDOW

Spyware favourite for invisible overlays. Safentora's block screen is a normal, labelled app screen instead.

Notification accessnot requested

BIND_NOTIFICATION_LISTENER_SERVICE

Would let an app read every notification — including message previews. We don't request it, so we can't.

SMS & call logsnot requested

READ_SMS · READ_CALL_LOG

Safentora does not read texts or call history, period.

Contacts & microphonenot requested

READ_CONTACTS · RECORD_AUDIO

No contact scraping, no ambient listening. Ever.

How permissions map to consent and visibility on the child's device is covered in Responsible Use.