App requests only necessary permissions

Over-permissioned apps are a primary reason users uninstall or leave one-star reviews. Under GDPR Art. 5(1)(c) (data minimisation) and CCPA §1798.100, you may only collect data necessary for declared purposes — declaring a CAMERA permission when no camera feature exists is both a regulatory red flag and an app store rejection risk. Apple's permission best-practices guidelines make explicit that reviewers check for permissions without corresponding feature code. On Android, Google Play surfaces declared permissions on your store listing; users see every permission before they download. Unused permissions also expand your attack surface: a compromised SDK can silently exploit a declared permission even if your own code never calls it.

Audit every permission in app.json against your active feature inventory, then remove any with no live code path. For location, always prefer the narrowest scope that works.

{
  "expo": {
    "ios": {
      "infoPlist": {
        "NSCameraUsageDescription": "Camera access is needed for video calls",
        "NSLocationWhenInUseUsageDescription": "Location shows nearby content while the app is open"
      }
    },
    "android": {
      "permissions": [
        "android.permission.CAMERA",
        "android.permission.ACCESS_FINE_LOCATION"
      ]
    }
  }
}

Delete any entry whose usage description cannot be traced to a concrete screen or feature. For location, replace LOCATION_ALWAYS with LOCATION_WHEN_IN_USE unless a background-tracking feature genuinely requires it.