[r2sk5t]

We had this issue and went back and forth with Google for weeks with no progress. It was infuriating, since the peeps on the other end just cut and pasted responses.

Then, we hashed the Contacts before uploading them and our app was immediately approved.

Subsequently, they decided to ding us on this permission "QUERY_ALL_PACKAGES", which we needed for inviting people you know to our app. Since we were so beaten down, we removed that feature. Congrats Google!

[seanhunter]

From a user perspective it’s good to hear about apps being forced to remove the “invite everyone you know” feature. It’s time for that obnoxious user-hostile growth hack to stop.

[datavirtue]

Too late. Probably the single biggest user exploit responsible for Facebook's popularity.

[TheRealDunkirk]

Twitter and TikTok are still pestering me. It's not too late to ban it outright.

[waqf]

I don't want you to query my packages and I don't want your help to invite people I know to your app. That sounds like a feature that was made for your benefit, not for mine.

So it seems that Google made your app better for me as a user. Congrats Google indeed.

[franga2000]

It's not helping them invite your friends to their app (which is impossible). It's helping you invite them if that's something you want to do (probably by listing the messaging apps you have and giving you pre-compose buttons; EDIT: confirmed by sibling comment).

If you don't want to use that feature, don't press the "invite friends" button and that code will likely never run. If you don't want the app to even theoretically have access to your app list, don't give it the permission. Is it not a runtime permission? That sounds like Google's fault, not the app's.

[esprehn]

Why do you need to know every app installed on the device to invite people you know?

[r2sk5t]

Because we were using this: https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plu... ...and didn't want to invest in this feature.

[saagarjha]

Not to channel the usual Hacker News acid at you but have you considered the optics of “we are using code that requests fairly broad permissions because we couldn’t be bothered to invest in doing a better job that didn’t have to do this”? I don’t see this explanation as being particularly comforting.

[Firmwarrior]

Good news, my friend: https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plu...