Location permission and Bluetooth
Technical notes are plain statements about how the app behaves, with the source for each one, so you can check them yourself rather than take our word for it.
Short version
Section titled “Short version”On Android 11 and older, Android will not let an app search for nearby Bluetooth devices unless that app holds the location permission. This is an operating system rule, not a choice Anonomi Messenger makes.
Anonomi Messenger asks for that permission only in three places — Add contact nearby, Connect via Bluetooth, and Share this app offline — and only on the Android versions listed below. It uses the permission to find the other phone, and nothing else. The app does not read your position, does not store it, and does not send it anywhere. On Android 12 and newer, the two Bluetooth flows ask for the “nearby devices” permission instead, and no longer mention location.
Why Android ties Bluetooth to location
Section titled “Why Android ties Bluetooth to location”A Bluetooth scan returns the identifiers of every nearby device. Some of those devices are BLE beacons, installed at fixed and publicly known places — shops, stations, buildings. An app that recognises a beacon can work out roughly where you are without ever touching GPS.
Android cannot tell the difference between an app scanning to find your friend’s phone and an app scanning to harvest beacons. Both look identical to the operating system. So on Android 6 through Android 11, Android put scan results behind the location permission and treated every scanning app the same way.
Google’s own documentation states it plainly:
ACCESS_FINE_LOCATION is necessary because, on Android 11 and lower, a Bluetooth scan could potentially be used to gather information about the location of the user.
— Bluetooth permissions, Android developer documentation
Android 12 fixed this. An app can now declare BLUETOOTH_SCAN with the flag
usesPermissionFlags="neverForLocation", which tells the system the app is not
using scan results to derive location, and cap the old location permission with
android:maxSdkVersion so it is not requested on newer releases. Anonomi
Messenger declares BLUETOOTH_SCAN with neverForLocation, and declares
NEARBY_WIFI_DEVICES with the same flag.
What Anonomi Messenger asks for, and when
Section titled “What Anonomi Messenger asks for, and when”The app declares ACCESS_FINE_LOCATION with android:maxSdkVersion="32", so
Android will not grant it at all above Android 12L. It never declares
ACCESS_COARSE_LOCATION.
There are three flows that ask for it, and each stops at a different Android version:
| What you are doing | Android 7–11 | Android 12 and 12L | Android 13 and newer |
|---|---|---|---|
| Add contact nearby (QR scan) | Camera + location | Camera + nearby devices | Camera + nearby devices |
| Connect via Bluetooth (manual retry) | Location | Nearby devices | Nearby devices |
| Share this app offline (Wi-Fi hotspot) | Location, from Android 10 | Location | No location |
Notes on the table:
- In Add contact nearby, the camera cannot open until the permissions in that row are granted — the QR scanner and the Bluetooth handshake are part of the same step. On a device with no Bluetooth adapter, the app asks for the camera only.
- Connect via Bluetooth is the manual fallback in the menu of a conversation, for when Bluetooth does not connect on its own.
- Share this app offline starts asking at Android 10, because that flow creates a Wi-Fi hotspot rather than scanning Bluetooth.
Separately from the permission, Android sometimes requires the device’s location setting to be switched on before it will return results at all:
- On Android 9, 10 and 11, for Bluetooth discovery.
- On Android 12 and 12L, for creating the Wi-Fi hotspot.
The app detects this and asks you to turn the setting on. You can turn it off again afterwards.
What we do with it
Section titled “What we do with it”The permission is used to let the Bluetooth scan return results during those flows. That is the whole purpose.
The app does not call any Android API that returns your position. No part of the contact-adding code reads a location, and across the whole app the only place that touches Android’s location service is a helper that asks a single yes/no question: is the location setting currently switched on? That is a check on a system toggle, not a reading of where you are.
The rationale text you see in the app says the same thing: it explains that the app needs the permission to discover Bluetooth devices, and that it “does not store your location or share it with anyone”.
Offline maps is a separate, opt-in feature and does not use this permission. It works from a point you choose on the map yourself — the app reads coordinates from the map view you are looking at, not from your device’s position.
If you would rather not grant it
Section titled “If you would rather not grant it”You do not have to. Add contact at a distance
exchanges anon:// contact links through a channel you pick, and asks for no
camera and no location permission at all. It reaches a working contact without a
Bluetooth scan — but it does not give you the in-person check that scanning a QR
code face to face does, so handle the links carefully.
Scanning an Anonomi Postbox QR code asks for the camera only.
Checking this yourself
Section titled “Checking this yourself”Everything above is a description of code you can read. Nothing on this page has
been through an external audit, and you should not treat it as one. The relevant
files are AndroidManifest.xml, AddNearbyContactPermissionManager.java,
BluetoothConditionManager.java, ConditionManager29.java and
PermissionUtils.java in the Anonomi Messenger source.
Related documentation
Section titled “Related documentation”- Adding contacts — the two contact flows and which one asks for what.
- Threat model — what the app is and is not designed to protect against.
- Offline maps — the separate, opt-in maps feature.
- Share this app offline — the Wi-Fi hotspot flow.