MMY app permissions, all 13
The MMY app declares thirteen permissions. Most of them cover the network, the screen and the sound. One of them reads device state, and that is the line to weigh.
INTERNET | Opens the network connection the app uses. Without it the app cannot load or stay in a session. |
ACCESS_NETWORK_STATE | Lets the app check whether the phone is online before it tries a request. |
ACCESS_WIFI_STATE | Reads the Wi-Fi state. The manifest also declares the wifi hardware feature alongside it. |
MODIFY_AUDIO_SETTINGS | Changes the app's own volume stream, so a mute inside the app stays inside the app. |
WAKE_LOCK | Keeps the screen from sleeping while you are in a round. |
POST_NOTIFICATIONS | Shows notifications on Android 13 and newer. The phone asks at runtime, not at install. |
VIBRATE | Vibrates the handset on events inside the app. |
READ_PHONE_STATE | Reads the phone state. This is the one permission worth weighing before you install. |
AD_ID | Reads the Google advertising id. Granted to Play services; you do not see a prompt for it. |
BIND_GET_INSTALL_REFERRER_SERVICE | Lets the app ask Play which link led to the install. |
RECEIVE | Receives downstream messages through Google Cloud Messaging. |
READ_APP_INFO | A Samsung-only permission for the maps agent. Other phones ignore it. |
GET_COMMON_DATA | A Huawei AppGallery permission. Other phones ignore it. |
The one to weigh
READ_PHONE_STATE lets an app read the phone's state, which on current Android includes device identifiers that used to require nothing. It is declared here, so treat it as a real ask rather than a formality. If that is more access than you want an app to have, the decision point is before you install, not after. The other twelve do not read your contacts, your messages, your camera or your location.
READ_SMS is absent. That is why the login code, which arrives as a text message, has to be typed in by hand. The app cannot open the message and lift the code out. The registration flow that depends on this is on the account page.
What you are asked, and when
Most of the thirteen are install-time declarations: they appear on the sheet and are granted with the install. Two behave differently. POST_NOTIFICATIONS is requested at runtime on Android 13 and newer, so you see a prompt you can decline; the notifications page covers that prompt. AD_ID is granted to Play services rather than through a prompt of your own.
Declining the runtime prompt does not unwind the install and does not block login. There is no per-permission toggle at install time for the rest of the list; the choice there is install or not.
Vendor lines that sit idle
READ_APP_INFO belongs to Samsung's maps agent, and GET_COMMON_DATA belongs to Huawei AppGallery. On a Pixel, Xiaomi, Oppo, Vivo or Realme phone those two lines do nothing. They are present because the package ships one manifest for every brand, not because the app reaches into those services on your handset. Seeing a Samsung permission on a non-Samsung phone is expected, and it is not a sign the file was repacked.
What is not in the list
No contacts permission, no SMS read permission, no camera permission, no location permission. A page that claims the app asks for two permissions is undercounting; a page that claims it asks for your contacts is adding lines the manifest does not have. The count here is thirteen, read from the package.
A channel file packed inside the APK carries an AppsFlyer source marker and names a data-collection host. The app reports install attribution. That reporting is separate from the permission list: it describes where an install report goes, not an extra permission you can toggle.