We shipped an SMS app with no internet permission — here's why, and what it cost us

Every SMS app says it respects your privacy. The claim is unfalsifiable: an app with the internet permission could upload your messages, and no privacy policy you can read will tell you whether it does. You are trusting a paragraph of English.

When we started building Logic Inbox — our replacement for Microsoft’s discontinued SMS Organizer — we decided the claim had to be checkable instead. So the app ships without android.permission.INTERNET.

What that actually means

Android permissions are not a promise made by the developer; they are a gate enforced by the operating system. With no INTERNET permission declared, every socket the app tries to open fails. Not “we chose not to upload your SMS” — the app cannot upload your SMS, and no future update can quietly change that without the permission appearing in the store listing and in your phone’s app info screen.

The full permission list is short enough to read in one breath:

<uses-permission android:name="android.permission.READ_SMS" />
<uses-permission android:name="android.permission.RECEIVE_SMS" />
<uses-permission android:name="android.permission.RECEIVE_MMS" />
<uses-permission android:name="android.permission.RECEIVE_WAP_PUSH" />
<uses-permission android:name="android.permission.SEND_SMS" />
<uses-permission android:name="android.permission.WRITE_SMS" />
<uses-permission android:name="android.permission.READ_CONTACTS" />
<uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" />

The first six are what Android requires of any app that wants to be your default SMS handler. The last four are notifications, contact names, and re-arming reminder alarms after a reboot. There is nothing in that list that can reach the network.

You can verify it in about fifteen seconds

Long-press the app icon → App info → Permissions, or open the Play listing and expand “See more” under App permissions. If a networked permission had been added, it would be there. That is the whole point: you do not have to believe us, and you should not have to.

What it cost

This is the part most “privacy-first” posts leave out. Removing network access is not free.

No analytics. We have no idea how many people use the finance passbook, which category tabs get opened, or where onboarding drops off. Every product decision is made from user emails and our own usage, not a funnel chart.

No crash reporting. No Crashlytics, no Sentry. When something crashes on a device we do not own, we find out because a human writes to us. That pushed a lot of work forward in the schedule: more defensive parsing, more instrumentation in debug builds, and a much slower path from “someone hit a bug” to “we know what the bug was.”

No cloud backup or multi-device sync. Your messages, passbook and reminders live on the device. If you switch phones, Android’s own SMS backup carries the messages; our derived data starts fresh.

No remote config or A/B tests. Every behavioural change is a release, reviewed by Play, shipped to everyone at once.

No ads, and no ad SDKs. Which also means the app has to be worth keeping on merit.

Why the trade was still obviously right

Because of what SMS is in India. Your inbox holds one-time passwords for your bank, card transaction alerts with balances, ticket PNRs, delivery addresses and OTPs for every KYC flow you have ever completed. An SMS app with network access is, in practice, a live feed of your financial life. The convenience an analytics SDK buys the developer is not on the same scale as the risk it introduces for the user.

Every feature was then designed inside that constraint rather than around it:

• Categorisation runs through an on-device rules engine tuned for India’s DLT sender-ID format — no server round-trip, and it works in airplane mode.
• The finance passbook is built from bank SMS you already received, so there is no bank login, no account aggregator, and nothing to breach.
• Reminders are parsed locally and scheduled as local alarms.
• OTP copy happens in the notification, on the device, and the code is never anywhere else.

If you are building something similar

Three things we would tell you before you start:

1. Decide the constraint first. “We won’t upload anything” as a policy statement decays under deadline pressure. As a missing manifest line, it holds — because adding it back is a visible, deliberate act.
2. Budget for the missing telemetry. Write more logs into debug builds, keep a fast feedback channel open to users, and expect a slower bug-fix loop. Plan it in; don’t discover it.
3. Say plainly what you don’t do. Our Play listing states up front that MMS is limited and that there is no cloud backup. Honest limitations cost fewer installs than a bad review that starts with “it doesn’t even…”.

Logic Inbox is free on Google Play, and the full feature story lives at logicinbox.app. If you want the engineering detail on the classifier itself, that’s in Parsing India’s DLT sender IDs on-device.