Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageThe rule behind the rejection
Google's permissions policy says an app may request access only to data and capabilities it needs for features the user can see and expects. Some permissions are additionally restricted: background location, access to all installed apps, broad file access, SMS and call logs, and broad photo or video access require a declaration in Play Console, a prominent in-app disclosure before the prompt, and in some cases a video showing the feature. Requesting them without a qualifying feature leads to a rejection or, for an existing app, a removal notice with a deadline.
A web-wrapped app typically needs very few permissions: internet, notifications if you use push, and camera or location only if your web app actually calls those APIs. Everything else is template capability you can switch off.
Permission by permission: when it is justified and where to switch it off
| Permission | Justified when | WebViewGold setting |
|---|---|---|
| Location (foreground) | Your web app calls the HTML5 geolocation API for a visible feature (store finder, check-in, route) | requireLocation in Config.java; set to false and delete the location entries in AndroidManifest.xml if unused |
| Background location | Location is needed while the app is closed and this is the core feature (delivery tracking, fitness logging); requires a declaration and a demo video | requireBackgroundLocation, plus the FOREGROUND_SERVICE_LOCATION and GPSService blocks in AndroidManifest.xml; keep all of it commented out otherwise |
| Camera | QR or barcode scanning, document scanner, photo uploads from the camera | requireCamera; set filePickerMode to gallery only if you never need the camera |
| Microphone | Voice notes, audio recording, voice chat in your web app | requireRecordAudio; false for almost every web app |
| Storage / photos | File downloads or uploads from the gallery | requireStorage; modern targets use the system photo picker for uploads, which needs no broad photo permission |
| Notifications | Push notifications or local push | Enabled with push; the runtime prompt appears when your web app asks via registerpush:// or at launch |
| Query all packages | Launchers, device management, antivirus. Practically never for a web app | Not part of the template; if it shows up in the merged manifest, a library added it; remove it as shown below |
| Contacts | A visible feature that imports contacts | Only present if you added READ_CONTACTS for the contacts API |
Clean up the manifest and the declarations
Twenty minutes in Android Studio, or a few toggles in the Cloud Builder.
Set the flags in Config.java
Go through
requireLocation,requireBackgroundLocation,requireCamera,requireRecordAudioandrequireStorageand set each one to false unless your web app uses the feature. The docs for geolocation and setup describe each flag.Delete the matching lines in AndroidManifest.xml
The flags stop the app from using a capability; the manifest entries are what Google reads. Remove the uses-permission lines for the capabilities you switched off, as the setting descriptions ask you to.
Check the merged manifest
In Android Studio open AndroidManifest.xml and switch to the Merged Manifest tab. It shows permissions contributed by libraries, which is where surprises like the advertising ID permission or an unexpected package-visibility permission come from.
Add a prominent disclosure for what remains
Before your web app triggers a sensitive prompt (location, camera), show a short in-app explanation of why you need it and what happens with the data. A modal in your web app before calling the API is enough, and it belongs in the privacy policy too.
Complete the declaration forms
Play Console → App content → Sensitive app permissions (and similar forms) for any restricted permission you keep. Describe the feature, name the screen, and upload the requested video. Without a qualifying feature, do not apply; remove the permission instead.
Rebuild, verify, upload
Build the bundle, install it from the internal testing track and go through the flows that should prompt for a permission. Then check the App bundle explorer in Play Console, which lists the permissions Google extracted from your bundle, before you roll out.
My iOS WebView is finally approved. Thanks!!
Example: remove a permission a library merged in
If a dependency contributes a permission you cannot justify, the manifest merger can strip it. Add the tools namespace to the manifest element if it is missing.
xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
xmlns:tools="http://schemas.android.com/tools">
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" tools:node="remove" />
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" tools:node="remove" />
</manifest>Typical mistakes
- Switching a feature off in Config.java but leaving the permission in AndroidManifest.xml. Google reads the manifest.
- Keeping background location "because the template has it". It needs a declaration, a video and a core use case.
- Asking for location at launch before the user understands why. Trigger the HTML5 API from the feature screen instead.
- A privacy policy that does not mention the camera or location although the app requests them.
- Permission texts in the listing that promise features the app does not have, which also hits the misleading-claims rules.
Frequently asked questions
Does Google reject an app just for declaring a permission it never prompts for?
Yes, that is exactly the case this policy covers. A declared permission without a visible feature is treated as unjustified, whether or not the prompt ever appears.
My web app uses the geolocation API only on one page. Is that enough justification?
Yes, if the feature is real and visible, and the app asks for permission in context. Describe it in the declaration if asked, and mention location in the privacy policy.
Why does Play Console list a permission I never added?
Libraries contribute manifest entries. The Google Mobile Ads SDK adds the advertising ID permission, for example. The Merged Manifest tab shows the source, and tools:node="remove" strips what you cannot justify.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.