# Permissions

> Every permission DiapStash requests on iOS and Android, and what each one is used for

DiapStash only asks for the permissions it needs to provide a feature. This page lists every permission the app declares, and exactly which features use it.

<note>

Most permissions are **optional and requested on first use**. If you refuse one, only the related feature is unavailable, and the rest of the app keeps working.

</note>

None of these permissions gives DiapStash access to your location, contacts, microphone, calendar, or your existing photos. See also [What data does the application collect?](/qanda#what-data-does-the-application-collect)

To know which external services receive data (Sentry, push notifications, Stripe…), see [Privacy and third-party services](/privacy).

## Permissions you are asked for

These permissions trigger a prompt (or a system settings page) on your device.

<table>
<thead>
  <tr>
    <th>
      Permission
    </th>
    
    <th>
      iOS
    </th>
    
    <th>
      Android
    </th>
    
    <th>
      Features
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Camera
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      Scan a QR code or a package barcode
    </td>
  </tr>
  
  <tr>
    <td>
      Notifications
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      Change reminders, shared-history notifications
    </td>
  </tr>
  
  <tr>
    <td>
      Face ID / biometrics
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      Unlock the app
    </td>
  </tr>
  
  <tr>
    <td>
      Add photos
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      —
    </td>
    
    <td>
      Save the images generated by the sharing feature to your photo library
    </td>
  </tr>
  
  <tr>
    <td>
      Storage (Android 10 and below)
    </td>
    
    <td>
      —
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      Save the images generated by the sharing feature to your gallery
    </td>
  </tr>
  
  <tr>
    <td>
      Exact alarms
    </td>
    
    <td>
      —
    </td>
    
    <td>
      ✅
    </td>
    
    <td>
      Deliver reminders at the exact time
    </td>
  </tr>
</tbody>
</table>

### Camera

Used only when you open a scanner. The camera preview is processed on your device; **no picture or video is recorded, stored or sent**.

- **Cloud sync**: scan the QR code displayed on another device to link it (see [Setup Cloud Sync](/cloud-sync/setup)).
- **Catalog**: scan a package barcode to jump to the matching type. Only the decoded barcode number is used to search the catalog.

If you refuse the camera permission, you can still link a device with the other method offered in the cloud sync setup, and search the catalog by name.

On Android, the camera is declared as *not required*, so the app can be installed on devices without a camera.

### Notifications

Used to show:

- the [change reminders](/application/settings/notifications) you configure (start of change, end of change, accidents);
- the [sharing notifications](/application/settings/notifications#manage-sharing-notifications), when someone you share a history or a stock with does something.

The prompt appears when you set up a notification. Without it, no reminder is shown.

### Face ID and biometrics

Used only if you enable the [app lock](/application/settings/security) and choose biometrics instead of the PIN code. The app only receives a yes/no answer from the system: **your biometric data never leaves the secure hardware of your device and is never accessible to DiapStash.**

### Add photos (iOS)

Used **only** to save the images generated by the [sharing feature](/sharing/images) (the "save image" button when you share your stock or history). DiapStash only **adds** the image, in a dedicated *DiapStash* album.

The app also declares the read-access description required by iOS for this operation, but it never browses your photo library, and there is no feature to import pictures.

### Storage (Android 10 and below)

Used **only** to save the images generated by the sharing feature to your gallery. On Android 11 and newer, this permission does not exist for DiapStash and no storage access is needed.

<note>

Google Play and the Android settings display this permission as *"Photos/Media/Files"* and *"Storage"*, with the labels *"read the contents of your USB storage"* and *"modify or delete the contents of your USB storage"*. These are Android's generic wordings for any storage permission. DiapStash never browses, reads or deletes your files: it only adds its own images. Files you import (backup, CSV) or export go through the system file picker, which needs no permission.

</note>

### How Android labels the other permissions

Google Play groups permissions by category with generic wording that can sound broader than the real usage:

<table>
<thead>
  <tr>
    <th>
      Android wording
    </th>
    
    <th>
      What it means for DiapStash
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Camera: <em>
        take photos and videos
      </em>
    </td>
    
    <td>
      Generic label of the camera permission. Used only by the <a href="#camera">
        QR code and barcode scanners
      </a>
      
      ; nothing is recorded.
    </td>
  </tr>
  
  <tr>
    <td>
      Other: <em>
        control near field communication
      </em>
    </td>
    
    <td>
      See <a href="#permissions-granted-automatically">
        granted automatically
      </a>
      
      . DiapStash does not read NFC tags.
    </td>
  </tr>
  
  <tr>
    <td>
      Other: <em>
        receive data from Internet
      </em>
      
      , <em>
        view network connections
      </em>
      
      , <em>
        full network access
      </em>
    </td>
    
    <td>
      Needed for cloud sync, sharing and the catalog.
    </td>
  </tr>
  
  <tr>
    <td>
      Other: <em>
        run at startup
      </em>
    </td>
    
    <td>
      To re-schedule reminders after a restart.
    </td>
  </tr>
  
  <tr>
    <td>
      Other: <em>
        control vibration
      </em>
    </td>
    
    <td>
      Vibration of notifications and haptic feedback.
    </td>
  </tr>
  
  <tr>
    <td>
      Other: <em>
        prevent device from sleeping
      </em>
    </td>
    
    <td>
      Only for the few seconds of a background task.
    </td>
  </tr>
</tbody>
</table>

### Exact alarms (Android)

Used by [notifications](/application/settings/notifications) and [night mode](/application/settings/notifications#night-mode), so reminders fire at the minute you chose instead of being delayed by the battery optimizer.

This permission is **optional**: if you refuse it, reminders still work but may arrive a few minutes late.

## Permissions granted automatically

These permissions don't show any prompt. They are either harmless or required by the system for a feature to work.

<table>
<thead>
  <tr>
    <th>
      Permission
    </th>
    
    <th>
      Platform
    </th>
    
    <th>
      Used for
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Internet
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Cloud sync, sharing, catalog, donations, error reports
    </td>
  </tr>
  
  <tr>
    <td>
      Network state
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Detect whether the device is online before syncing
    </td>
  </tr>
  
  <tr>
    <td>
      Vibrate
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Vibration of notifications and haptic feedback
    </td>
  </tr>
  
  <tr>
    <td>
      Run at startup
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Re-schedule your reminders after the device restarts
    </td>
  </tr>
  
  <tr>
    <td>
      Prevent the device from sleeping
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Keep the device awake the few seconds needed to run a background task
    </td>
  </tr>
  
  <tr>
    <td>
      Foreground service (short)
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Let the periodic background check finish when the system asks for it
    </td>
  </tr>
  
  <tr>
    <td>
      Push notifications
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Receive push notifications (sync between your devices, sharing)
    </td>
  </tr>
  
  <tr>
    <td>
      NFC
    </td>
    
    <td>
      Android
    </td>
    
    <td>
      Declared by a third-party library; DiapStash does not read NFC tags
    </td>
  </tr>
  
  <tr>
    <td>
      Push notifications (remote notifications)
    </td>
    
    <td>
      iOS
    </td>
    
    <td>
      Receive push notifications (sync between your devices, sharing)
    </td>
  </tr>
  
  <tr>
    <td>
      Background fetch / processing
    </td>
    
    <td>
      iOS
    </td>
    
    <td>
      Periodic background check for notifications
    </td>
  </tr>
  
  <tr>
    <td>
      Apple Pay
    </td>
    
    <td>
      iOS
    </td>
    
    <td>
      Donations
    </td>
  </tr>
  
  <tr>
    <td>
      Siri and Shortcuts
    </td>
    
    <td>
      iOS
    </td>
    
    <td>
      Voice commands and shortcuts to start a change or record an accident
    </td>
  </tr>
  
  <tr>
    <td>
      App Links (<code>
        diapstash.com
      </code>
      
      , <code>
        diapstash.app
      </code>
      
      )
    </td>
    
    <td>
      iOS
    </td>
    
    <td>
      Open sharing links directly in the app
    </td>
  </tr>
</tbody>
</table>

### Background tasks

On both platforms, the app runs a short background check roughly every 30 minutes. It is used to keep your notifications up to date, in particular when you are using the [Cloud Sync](/cloud-sync). It only runs when the device has network access and, on Android, when the battery and storage are not low. You can disable notifications from the [settings](/application/settings/notifications) to stop it from doing any work.

## What DiapStash does *not* request

- No location
- No contacts or calendar
- No microphone
- No access to your photo library or files, apart from the ones you explicitly pick or save
- No advertising ID: the Android advertising ID permission is explicitly removed from the app
- No full-screen intents: the Android full-screen notification permission is explicitly removed from the app

## Changing a permission

You can review or revoke any permission at any time:

- **iOS**: Settings → DiapStash
- **Android**: Settings → Apps → DiapStash → Permissions