Permissions are justified and minimized

App stores actively audit permission declarations for proportionality — a notes app requesting ACCESS_FINE_LOCATION or NSCameraUsageDescription without a plausible justification triggers manual review and frequently results in rejection or removal. Under GDPR Art. 5(1)(c) (data minimisation) and CWE-272 (least privilege violation), requesting permissions beyond what your app's core function requires constitutes a legal compliance failure, not just a policy violation. Apple's privacy nutrition label (apple-privacy-permission-usage) surfaces every declared permission to users before install; overly broad permission sets reduce install conversion and increase uninstalls. iOS rejects binaries that declare a permission in Info.plist without a corresponding NS*UsageDescription string — this is an automated binary validation failure.

Audit app.json for every declared permission and add a precise usage description for iOS. Remove any permissions your app does not actually invoke at runtime.

// app.json
{
  "expo": {
    "ios": {
      "infoPlist": {
        "NSCameraUsageDescription": "Used to scan QR codes for event check-in.",
        "NSPhotoLibraryUsageDescription": "Used to attach photos to your reports."
      }
    },
    "android": {
      "permissions": [
        "android.permission.CAMERA"
      ]
    }
  }
}

For each permission, verify with a code search that it is actually called (Camera.requestCameraPermissionsAsync(), etc.) — remove any that aren't. Cross-reference with the App Store Privacy & Data audit (app-store-privacy-data) for the full ATT and data collection declaration requirements.