Skip to content

Show prominent disclosure before runtime permission requests#66

Draft
Miggets7 wants to merge 7 commits into
mainfrom
fix/prominent-disclosure
Draft

Show prominent disclosure before runtime permission requests#66
Miggets7 wants to merge 7 commits into
mainfrom
fix/prominent-disclosure

Conversation

@Miggets7

@Miggets7 Miggets7 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Why

Google Play rejected the Generic App: not compliant with the Prominent Disclosure and Consent Requirement of the User Data policy. Their review video shows the system location dialog firing with no in-app disclosure before it, and the "Background location needed" dialog appearing only after the system prompt.

Root cause: across ORLib, explanatory dialogs were gated behind shouldShowRequestPermissionRationale, so they only appeared after a first denial. First-time requests went straight to the system dialog.

What

New PermissionDisclosures helper shows an in-app disclosure (Continue / No thanks) and fires the system permission request only after the user taps Continue. Runs on the UI thread internally since several callers run on the WebView JS bridge thread.

All permission request sites now route through it:

  • Geofence location (the flagged flow, GeofenceProvider): disclosure → system fine-location dialog → background disclosure → system background dialog. Guard flag prevents a re-prompt loop after background denial. Decline answers the web app the same way a denial does.
  • WebView geolocation (OrMainActivity.onGeolocationPermissionsShowPrompt)
  • Push notifications (Android 13+, POST_NOTIFICATIONS)
  • Storage for downloads (WRITE_EXTERNAL_STORAGE, only requested below Android 10 — not needed on 10+ for DownloadManager)
  • Camera (QrScannerActivity)
  • Bluetooth (BleProvider, ESPProvisionProvider; below Android 12 the disclosure also explains the location permission needed for BLE scans)

Disclosure strings for location include the wording Google requires for background collection ("even when the app is closed or not in use").

Behavior fixes along the way:

  • Web app is now notified when the user denies the location or push system dialog (previously silence).
  • A download now actually starts after the storage permission is granted (previously the request was lost and the user had to tap the link again).
  • QR scanner: declining camera access closes the scanner instead of leaving a black preview.
  • Fixed two "Do you want to enabled it" typos.

Closes #67.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Google Play rejection: no prominent disclosure before runtime permission requests

1 participant