ACE Micro Cloud — Permissions & Prominent Disclosures

DRAFT — for Armored Gate / counsel review and approval before use. Not legal advice.

Enumerated directly from the app manifests in the ACE-Cloud repo (audit 2026-07-09).
Two Android modules exist under the same package com.armoredgate.cloud:
android-client/ (the newer contributor/sponsored client) and android/ (an earlier
build). Their permission sets and foreground-service types differ — Karl must
confirm which module is the Play-shipping APK so the declarations match. Both are listed.
This drives the Play Console Foreground Service and Permissions declarations and
the in-app prominent-disclosure copy.

A. Which module ships? (must resolve first)

Recommendation: ship one module. Whichever ships, this document's declarations and the Play Console form must reflect exactly that module's manifest. [CONFIRM]

B. Permission-by-permission

FOREGROUND_SERVICE + FOREGROUND_SERVICE_SPECIAL_USE

• Why: the contribution service runs as a foreground service with a persistent

notification so the user always knows work is running and Android keeps it alive.

• specialUse FGS type — special Play review required. Google requires apps using

FOREGROUND_SERVICE_SPECIAL_USE to justify the use in Play Console with a description, user impact, and a demonstration video, because it does not fit a standard FGS category. Prepare that justification (subtype container_runtime / distributed_compute_node: "runs signed, user-consented distributed compute/bandwidth workloads while the device is charging and idle; user sees a persistent notification and can stop at any time").

• [CONFIRM with review guidance] whether Google will accept specialUse for this use

case, or require a different type. If the work is mainly network data transfer, Google may prefer dataSync or a user-initiated data-transfer job; the android/ module already uses a dataSync service for MQTT. Aligning the FGS type to Google's expectations is the single biggest Play-review risk here.

POST_NOTIFICATIONS

• Why: to show the required foreground-service notification and operational alerts

(status, earnings) on Android 13+. Requested at runtime with the system prompt.

INTERNET

• Why: all communication with the ACE Cloud control plane, message broker, Stripe

onboarding handoff, and Firebase. Install-time permission.

ACCESS_NETWORK_STATE

• Why: to read the active transport type (Wi-Fi vs cellular vs ethernet) so the app

honors the Wi-Fi-only default and reports network_type. Install-time. No network content is read.

ACCESS_WIFI_STATE (android/ module)

• Why: determine Wi-Fi connectivity for the Wi-Fi-only policy. Install-time.

WAKE_LOCK (android/ module)

• Why: keep the CPU awake enough to run/finish a workload while the screen is off and

the device is charging.

RECEIVE_BOOT_COMPLETED (android/ module)

• Why: restart the (user-enrolled) contribution service after a reboot so contribution

resumes without the user reopening the app. Disclose that the service auto-resumes on boot; ensure it only does so if the user previously enrolled.

REQUEST_IGNORE_BATTERY_OPTIMIZATIONS (android/ module)

• Why: ask the user to exempt the app from Doze so long-running contribution isn't

killed. Sensitive to Play review — Google restricts this and expects a legitimate, disclosed, user-benefiting reason and a runtime request the user can decline. [CONFIRM] whether to keep it; if kept, provide clear rationale and make it optional.

BIND_VPN_SERVICE (via WorkloadVpnService) (android-client/ module)

• Why: confines workload-originated network traffic into a per-deploy VPN tunnel to

enforce network policy on the workloads (not on the user's own traffic). Android shows its stock VPN-consent dialog; the app shows an in-app rationale first.

• Disclosure is critical. A VPN permission is highly sensitive. The in-app rationale

must make clear it applies to workload traffic policy, that the app does not inspect, log, or route the user's personal browsing, and it must obtain affirmative consent before VpnService.prepare().

C. Prominent-disclosure copy (in-app, before enrollment/permission)

Google requires a prominent disclosure + affirmative consent shown in normal app flow (not buried in settings, not the store listing), immediately before the relevant capability, with a clear accept action. Draft copy:

C.1 Enrollment / background-work disclosure (before starting the service)

ACE Micro Cloud uses your device to do background work for others.
When you enroll, this app runs a foreground service that performs **compute and
bandwidth workloads for third parties, primarily while your device is charging and
idle**. This uses battery, data (Wi-Fi only unless you enable cellular), storage, and
causes normal device wear.
- You will only ever see your own device's resource stats — never what the workloads
are.
- A resource governor protects your battery and limits heat.
- You can stop or un-enroll at any time.
[ I understand and want to contribute ] [ Not now ]

C.2 Cellular opt-in disclosure (before enabling cellular)

Use mobile data for contribution?
Turning this on lets ACE Micro Cloud use cellular data, which may count against your
plan and must comply with your carrier's terms. Wi-Fi-only is the default.
[ Enable cellular ] [ Keep Wi-Fi only ]

C.3 VPN consent rationale (android-client, before the system VPN dialog)

ACE Cloud needs to apply a network policy to workload traffic.
Android will now ask you to allow a VPN. This VPN applies **only to the workloads running
on your device — to enforce their network rules. ACE Cloud does not** inspect, log, or
route your personal internet traffic.
[ Continue ] [ Cancel ]

C.4 Notifications (system runtime prompt)

Explain in-context that notifications are used for the required running-service notice and status/earnings updates.

D. Play Console declarations this document drives

• App content → Foreground service types: declare specialUse (+ dataSync if

shipped), with description, user impact, and demo video.

• Permissions declaration form: justify any sensitive permission kept (special-use FGS;

battery-optimization exemption; VPN).

• Data safety: cross-reference (no sensitive data collected via these permissions).
• In-app: the prominent-disclosure screens above must exist and gate the capabilities.

E. Open items for Karl / counsel

• [ ] Which module (android-client/ vs android/) is the shipping APK.
• [ ] specialUse vs dataSync vs user-initiated data-transfer job — align to Google's

expected FGS type to reduce review risk.

• [ ] Keep or drop REQUEST_IGNORE_BATTERY_OPTIMIZATIONS.
• [ ] Record/prepare the FGS demonstration video Google requires.
• [ ] Confirm VPN rationale copy and that no user traffic is captured/logged.