UNDA — Runtime Permissions
Status: Draft. Permissions are requested at the moment the corresponding feature is enabled (§8.2 incremental permissions), never all-up-front.
iOS
| Permission (Info.plist key) | Requested when | Rationale (user-visible) | Notes |
|---|---|---|---|
NSUserNotificationsUsageDescription | User toggles reminders ON | "Send you reminders for your workout of the day and upcoming period." | Off by default (§3.3). |
NSHealthShareUsageDescription (HealthKit read, base scope) | User enables HealthKit sync | "Read workouts and menstrual flow so UNDA can build cycle history and personalise workouts." | Base scope: WORKOUT + MENSTRUATION_FLOW only. |
NSHealthShareUsageDescription (HealthKit read, readiness scope) | User turns on "Use readiness signals" in Personalize | "Read sleep, steps, HRV, and resting HR so UNDA can suggest an easier workout when you need one." | Separate grant. Requested only when the readiness feature is enabled. Values are never persisted — used in memory at render-time only. |
NSHealthUpdateUsageDescription (HealthKit write) | User enables "write completed workouts to Health" | "Write completed workouts to Apple Health so they appear in your Fitness ring." | Optional; user can enable read without write. |
NSCalendarsUsageDescription (only if user opts in) | User taps "Add to Calendar" on a workout | "Add planned workouts to the calendar you choose." | Not requested at startup. |
Permissions not requested: contacts, precise location, background location, camera, microphone, photos, motion & fitness at OS level (beyond what HealthKit covers), reminders, or advertising identifier.
Android
| Permission | Requested when | Rationale | Notes |
|---|---|---|---|
POST_NOTIFICATIONS (Android 13+) | User toggles reminders ON | "Send you reminders for your workout of the day and upcoming period." | Off by default. |
| Health Connect read permissions | User enables Health Connect sync | Per-category: heart rate, exercise, sleep, weight (if used later). | Requested per category, at feature enable. |
| Health Connect write permissions | Same as iOS write path | Optional. | — |
READ_CALENDAR / WRITE_CALENDAR (only if opts in) | Same as iOS | Same. | — |
Permissions not requested: ACCESS_FINE_LOCATION, READ_CONTACTS, READ_SMS, READ_MEDIA_*, advertising ID.
Play/Store declarations
- Google Play Health Apps declaration: we will declare period tracking + activity/fitness features per §18. Answers must match the running app; keep this doc updated when Health Connect scopes change.
- App Store privacy details: health & fitness data + identifiers (UUID) + diagnostics (if a crash SDK is later added); never "advertising or marketing" or "third-party advertising".
Change control
Adding a new permission requires:
- Updating this doc +
data-flow.md. - Confirming the permission is only requested at feature-enable time (not app launch).
- Confirming the App Store / Play declaration answers still hold.