Why Unlit has no internet permission, and what that actually guarantees

Almost every app you own says it respects your privacy. The sentence costs nothing to write, it appears in a document nobody reads, and it is compatible with sending a great deal of information to a great many places. An app that says it does not collect your data, while holding the permission that would let it, is asking you to trust it. That is a reasonable thing to ask. It is just not the same as a guarantee.

Unlit does not request android.permission.INTERNET. It never has, and it never will. This post is about what that means technically, how you can check it without taking our word for anything, and which things it very specifically does not protect you from.

Why this matters more for a launcher than for other apps

A launcher sits in an unusual position. To do its job at all it has to know things that most apps never see.

• Every app installed on your phone, by name.
• Which app you open, and at what time, because it is the thing you opened it from.
• What you type into search, which on a launcher is often an app you are slightly embarrassed to be opening.
• Which apps you chose to hide, which is a strong signal about a person.
• Your screen time and unlock patterns, if it shows you any of that.

Put together, that is an unusually complete picture of somebody's day: what they own, what they reach for, when they reach for it, and what they are trying not to reach for. It is a genuinely valuable dataset, which is precisely why so many free launchers are supported by advertising.

Given that, we did not think a promise was good enough. The only credible way to claim that none of this is being collected is to make collecting it impossible.

The entire permission list, in full

Here is everything Unlit asks the operating system for. Not a summary, the whole list.

That is six, and four of them are the ones Android hands out without asking because they cannot do any harm. There is no camera, no microphone, no location, no contacts, no storage, no phone state, no advertising identifier, and no internet.

Three decisions inside that list worth explaining

Seeing your apps without QUERY_ALL_PACKAGES. A launcher needs to list your apps. The blunt way is a permission called QUERY_ALL_PACKAGES, which reveals every package on the device including ones that are not apps you launch. Play restricts it, and rightly. Unlit instead declares a query filter for things that can be opened from a home screen, so it sees launchable apps and nothing else.

The notification counter. The pill on the home screen that says how many notifications are waiting uses Android's notification listener service, which you grant explicitly. That service is capable of reading notification text, and it is worth being plain about that. Unlit reads the live list, counts it, and holds three integers in memory. No text is stored anywhere, and with no internet permission there is nowhere for any of it to go even in principle.

The screen lock service. The lock gesture needs an accessibility service, because that is the only way Android lets an app turn the screen off without destroying fingerprint unlock. Ours is declared with no event types at all, so the system delivers nothing to it, and with canRetrieveWindowContent set to false, so it cannot read the screen even if it tried. That is the service definition in the app's own configuration, not an assurance. We also deliberately do not set isAccessibilityTool, because Unlit is a launcher and not a disability aid, and claiming otherwise to dodge a policy is how apps get removed.

How Android actually enforces this

This is the part that makes it a guarantee rather than a policy. The internet permission is not a runtime prompt you can accept or decline. It is declared at install time, and the operating system uses it to decide whether the app's process is allowed to create a network connection at all.

An app without it does not get a failed request or an error page. It gets refused below the app layer, by the networking stack, when it tries to open a socket. There is no permission dialog to show you, no setting to flip, and nothing the app's own code can do about it. From inside Unlit, the network does not exist.

This is why we can say nothing leaves your phone as a fact rather than a promise. It is not that we choose not to send anything. It is that the attempt would fail.

How to verify it yourself

You should not have to believe any of the above. Three ways to check, from easiest to most thorough.

1. 01

   Read the Play Store listing

   On the Unlit listing, scroll to About this app, then down to the app permissions section, and expand it. Google generates this list from the app's manifest, not from anything we write. Internet access will not be in it. This is the check to use if you only do one, because it is independent of us.

2. 02

   Run it through an independent analyzer

   Exodus Privacy scans Android apps for embedded trackers and lists every requested permission. There are also offline tools such as App Manager that read the manifest of anything installed on your own phone. Point either at Unlit and compare the output with the table above.

3. 03

   Ask your phone directly

   If you have developer tools set up, connect the phone and run: adb shell dumpsys package app.unlit.launcher. Look for the requested permissions section. What is printed there is what the installed app asked for, read out of the installed package by Android itself.

A note on why the Settings app is not a good check here. Settings, then Apps, then Permissions only shows the dangerous permissions that need your consent. Internet access is not in that category, so its absence will not show up there. Use the Play listing or an analyzer instead.

What this guarantees

• No analytics, ever. Not anonymized, not aggregated, not optional. There is no mechanism.
• No crash reporting. We find out about bugs when somebody tells us.
• No ads. An ad has to be fetched, and fetching requires a network.
• No account and no sync. There is nothing to sign in to, because there is no server. This is structural, not a roadmap item.
• Your app list, your searches, your hidden apps and your screen time stay on the device. They are written to local storage on your phone and read back by the app. Nothing else is possible.
• No remote configuration. The app cannot be changed after you install it. What you installed is what runs.

What it does not guarantee

This section is the reason the post exists. A privacy claim that only lists its own strengths is marketing.

• It does not make your phone private. Every other app you own still has internet access and its own permissions. Unlit improves one app's behavior, not your phone's.
• Google knows you installed it. You got it from the Play Store, over the network, with your account. That is between you and Google, and nothing we do can affect it.
• Opening an app hands everything over to that app. The moment Instagram launches, Instagram's permissions apply. Unlit is the door, not the building.
• Android itself still reports things. The operating system has its own telemetry and its own network activity, entirely outside any app's control.
• It is not an anti tracking tool. It does not block ads, does not filter DNS, does not do anything to other apps' network traffic, and claiming otherwise would be nonsense.
• A future version could, in principle, add the permission. We will not, and the permission list is public on the Play listing for every version we ship, so the change would be visible. If you want to be certain, turn off automatic updates for Unlit in the Play Store and read the list before each update. That is the honest answer rather than asking you to trust a promise about the future.

The useful side effect

There is an argument here that goes beyond our app, and it is the most useful thing in this post if you are evaluating any app at all.

Permissions are usually judged one at a time, which is the wrong frame. What matters is the combination. A notification listener is worrying because it can read notifications and send them somewhere. An accessibility service is worrying because it can read your screen and send it somewhere. Remove the second half of both sentences and the risk changes character entirely. Information that cannot leave the device can only be used on the device, by you.

So when you look at the next app that wants accessibility access to help you focus, the question worth asking is not only what it can see. It is whether it can also reach the network. That one line in a manifest tells you more than the entire privacy policy.

What this decision costs

It would be dishonest to present this as free. It is a set of real trade offs, and you are paying some of them.

• No backup of your settings. Automatic backup is switched off in the app's configuration as well. Change phones and you will set Unlit up again from scratch, which takes a minute but is still a minute.
• No crash reports, which makes bugs harder to find. If something breaks on your specific phone, we have no way of knowing unless you write to us. This is why the app asks for feedback more than most apps do.
• Every fix needs a release. With no remote configuration, there are no server side switches. A one character change goes through a full Play Store review.
• No feature can ever need a network. No weather, no calendar sync, no shared settings between your phone and your tablet, no cloud anything. Some reasonable feature requests are permanently impossible, and we have to say no to them.

If you check any of this and find something that contradicts what is written here, tell us and we will correct the page. That offer is part of the point: a claim nobody can test is not really a claim.