What are the permissions the Android app needs?

Question

The Android app just prompted for an update and it shows that it needs a new permission to see phone call stuff. Why would that be necessary for this app?

What other permissions does the app require, and why?

Answer 1

Required Permission

1. Modify or delete file contents of your USB storage

   We use this to cache data onto your phone's external storage (normally an SD card) per Google's standards

2. Full network access

   This one's pretty obvious. We need to access the internet.

3. Access your contacts

   If you're running Android Marshmallow (6.0) or above, and you attempt to login or register via Google, we use Marshmallow's new permission flow to request access to your accounts. This is described as "Allow Stack Exchange to access your contacts?" in the pop-up. We use this to retrieve a list of Google accounts enabled on your device, so that we can log you in using the one of your choosing.

   There is a new Google Login SDK that will allow us to not require this permission (instead of you telling the SDK which Google account of the user you want to authorize, it takes care of letting the user decide that on their own [or defaulting to an account if there's only one enabled]) but it requires significant back-end modifications to work for us, if/when we switch over to it this permission will be removed.

   This permission was added in version 1.0.76, before this version users on Android Marshmallow were not able to login using their Google accounts at all.

4. Retrieve running apps

   We use this to check the installation status of Facebook on your phone, to provide that login option or hide it completely. We also use this to bring up a list of applications when you try to open a question or answer in the browser that doesn't include ourselves.

   This permission was removed in version 1.0.2.

5. Read phone status and identity

   As AI E pointed out in the comments, this is a terrifyingly scary message for a very common requirement. Without this permission we can't access any unique identifier for your device which throws off both our internal analytics and those from our partners (Quantcast, same company used for analytics on the websites). Without this even more basic analytics are questionable.

   Using the phone status permission lets us look at number of unique installs without relying on Google's dashboard for it, it also lets us know if multiple people are using one device, be able to tell the session length for each user in that scenario, etc.

   This permission was removed in version 1.0.2.

We also use some more minor permissions which the Play Store actually hides from you unless you ask for them, they are:

1. Read contents of your USB storage

   Without this we can't read the cached data we write using the counterpart permission.

2. Retrieve data from the Internet, view network connections

   Without this we can't check if the phone is connected to the internet before trying to retrieve something, leading to a crash.

3. Control vibration, prevent phone from sleeping

   These are both required for our notifications and for Google's built-in push notification system.

4. Find accounts on the device

   This is to give you one-tap login when using your phone's Google account to login to Stack Exchange.

If you have any questions or concerns about any of these permissions, please let me know. I wouldn't want to use an app that was doing something weird with my phone either.