Permissions
When installing Fully Kiosk app the following permissions are implicitly granted:
- INTERNET – Internet connection
- RECEIVE_BOOT_COMPLETED – start at boot
- DISABLE_KEYGUARD – unlock screen
- INSTALL_SHORTCUT – add links to the home screen
- SYSTEM_ALERT_WINDOW – required for kiosk mode
- REORDER_TASKS – required for kiosk mode
- WAKE_LOCK – required for kiosk mode
- READ_EXTERNAL_STORAGE – show local files with file:// and import settings
- WRITE_EXTERNAL_STORAGE – export settings to file
- ACCESS_NETWORK_STATE – check network state
- ACCESS_WIFI_STATE – check WiFi connection
- CAMERA – required for visual motion detection
- SET_ALARM – required for scheduled sleep and wakeup
- ACCESS_COARSE_LOCATION – required for HTML geolocation access
- ACCESS_FINE_LOCATION – required for HTML geolocation access
- RECORD_AUDIO – required for HTML microphone access and acoustic motion detection
- MODIFY_AUDIO_SETTINGS – required for HTML microphone access
- CHANGE_WIFI_STATE – required for Wifi pre-config
- GET_TASKS and PACKAGE_USAGE_STATS – required for Kiosk mode
- WRITE_SETTINGS – required for setting screen brightness
- NFC – read URLs from NFC tags
- READ_PHONE_STATE – access IMEI and SIM Serial
- VIBRATE – make vibration from Webview
- GET_PACKAGE_SIZE – get app storage stats
- BLUETOOTH and BLUETOOTH_ADMIN – detect iBeacons, JavaScript BT interface
- EXPAND_STATUS_BAR – required for Kiosk Mode
- READ_LOGS – read logcat to show in Remote Admin
When activating the Screen Off Timer, JavaScript Interface, Remote Admin or Scheduled Sleep time Device Administrator Permission is requested in order to lock the device and turn the screen off by Fully Kiosk app. The safe mode lock requires administrator permission in order to set the device PIN. The Device Administrator Permission must be disabled for Fully Kiosk before the app can be uninstalled.
Fully Kiosk apps use Android’s Accessibility Service exclusively to support kiosk mode. The service prevents access to the status bar, notification shade, and certain system dialogs so the device remains locked to the designated application. No personal data, typed text, or accessibility event information is collected, stored, or transmitted.
On Android 5+, the following runtime permissions are requested when the appropriate settings are activated:
- Access to Usage Stats – for Kiosk mode protection
- Notification Access – for blocking notifications from other apps in kiosk mode
On Android 6+, the following runtime permissions are requested when the appropriate settings are activated or on demand:
- Read/write USB media – on access to a file-URL, on export/import settings, on activating Remote Admin and Kiosk Mode
- Draw over other apps – on the first start in Kiosk mode, with activated Motion detection and for detecting touches in other apps
- Disable battery optimization – used if prevent sleep feature or motion detection with screen off timer is enabled
- Access to Camera – on Motion Detection, JavaScript Interface, QR scan button or HTML Camera access activation
- Access to Geolocation – on HTML geolocation access, iBeacon detection or Remote Admin activation
- Record Audio – on HTML microphone access activation or acoustic motion detection
- Write Settings – when using screen brightness or screensaver brightness settings
- Make and Manage Phone Calls – when activating Remote Admin or JavaScript Interface for reading IMEI and SIM Serial
On Android 7+, the following runtime permission is requested when the appropriate settings are activated:
- Change Do Not Disturb Settings – for Playing Alarm Sounds.
On Android 8+, the following runtime permission is requested when the appropriate settings are activated:
- Install Apps from Unknown Sources – for installing apps via Remote Admin.
On Android 9+, the following runtime permission is requested when the appropriate settings are activated:
- Answer phone calls – for disabling phone calls in kiosk mode
On Android 11+, the following runtime permission is requested when the appropriate settings are activated:
- Manage external storage – if files are used on public shared storage, this permission is not available on apps installed from Google Play
On Android 12+, the following runtime permissions are requested when the appropriate settings are activated:
- Bluetooth Scan – for bluetooth scan, if enabled by Website Integration options
- Bluetooth Connect – for connecting to bluetooth or setting device name
- Read Phone State – for disabling phone calls in kiosk mode
On Android 13+, the following runtime permissions are requested when the appropriate settings are activated:
- Media Access Permissions – if image, video or sound files are used on public shared storage
- Post Notifications – for showing notifications and using foreground services (motion detection, remote admin)
On Android 14+, the following runtime permission is requested when the appropriate settings are activated:
- Schedule Exact Alarms – for scheduled sleep/wakeup and securing the kiosk mode
None of the runtime permissions listed above are used to collect personal information.
Some vendors changed Android in a way that prevents some runtime permissions from being granted. You may see a list of missing permissions and press OK, but nothing happens. Or you may see an empty page with “This feature is not available on this device”. Continue pressing OK on subsequent requests. After 3-4 attempts, an IGNORE button will appear. You can allow Fully Kiosk to ignore/forget the missing permissions. Some features that rely on these permissions will, of course, fail.
In Android 13+ devices when installing from APK file some permissions may be disabled (shows “Restricted setting” info). You can enable them by opening the App Info for Fully Kiosk (hold the app icon), clicking on three dots in the right upper corner and selecting Allow restricted settings. Learn more.
When enabling the Remote Admin or JavaScript Interface Fully Kiosk tries to obtain all potentially needed runtime permissions in order to avoid confirmation dialogs when changing settings later remotely or by using the JavaScript. There is also a solution for ignoring some permissions by configuration available, ask us for details.
The number of runtime permissions to confirm manually can be reduced to 4 or 5 when using the device provisioning. Those permissions unfortunately can’t be granted automatically in the Android OS.