Hi folks – I wanted to install the ODK collect but noted that the software wants access to contacts and phone status & identity. Also, it indicates that ODK collect may add further settings.
Could you indicate why this might be necessary for this type of app?
On Android versions prior to 6.0, all device permissions are asked for on install. For an app that has as many different features as Collect, that can seem really scary! That's one of the big reasons that on Android 6.0 and later, permissions are requested only at time of use. Additionally, an explanation of how that permission is used has to be displayed by the application which is helpful for users to decide whether or not they want to grant that permission. You can read more in the Collect documentation.
It sounds like you're using a device that has an Android version under 6. That means you see a dialog like:
Here are the explanations for the permissions I believe you've asked about:
- Identity: this is so that Collect can request Google accounts associated with the device when submission to Google Sheets is selected. Contacts are not accessed.
- Device ID & call information: this is so that device ID can be accessed for forms that require it.
Because Collect is open source, you can verify how those permissions are used in the source code and make sure nothing malicious is going on. Additionally, since you control your own server, you can choose your own configuration to be confident that no private information is being sent to a third party.