Culvert VPNWhich permissions a VPN app actually needs on Android
A VPN app on Android needs the system VPN permission, network access and notifications. It does not need contacts, SMS, location, camera or storage.
A VPN app on Android needs three things: the system's VPN permission, which you grant through the "connection request" dialog the first time you connect; ordinary network access, which every app gets without asking; and, on Android 13 and newer, permission to show a notification so the running tunnel stays visible. That is the complete list for the tunnel itself. Contacts, SMS, call logs, location, camera, microphone and storage are not on it, and a VPN app that asks for them is doing something else.
The one permission that matters
Android does not let an app read the device's network traffic on its own. To carry every other app's packets, a VPN app has to ask the operating system for a virtual network interface, and the operating system only hands one over after you have approved it. That approval is the dialog that says the app "wants to set up a VPN connection that allows it to monitor network traffic" and asks you to accept.
Two things about that dialog are worth knowing. It comes from Android, not from the app, and it uses the same words for every VPN, so its wording tells you nothing about a particular app. And it says exactly what it means: once you accept, the app can see every packet your phone sends. That is the point of a VPN, and it is also why the rest of this post matters, because you are choosing which app to hand that to. What the "connection request" prompt means goes into the dialog itself.
Only one app can hold an active VPN at a time. Accepting a second VPN app's request disconnects the first.
The rest of the legitimate list
| Permission | Shown to you? | Why a VPN needs it |
|---|---|---|
| VPN connection (the system dialog) | Yes, once | To create the tunnel interface at all |
| Internet and network state | No, granted automatically | To reach the VPN server and notice when Wi-Fi changes |
| Run a foreground service | No | To keep the tunnel alive while the app is in the background |
| Notifications (Android 13 and newer) | Yes | Android requires a service running in the background to post a persistent notification, and this permission lets you see it |
| See installed apps | Listed in the Play listing | Only if the app offers split tunnelling, so it can show you a list of apps to exclude |
| Google Play billing | Listed in the Play listing | Only if the app sells a subscription |
| Run at startup | Listed in the Play listing | Some apps use it to reconnect after a reboot; Android's own always-on VPN setting does this without it |
The "see installed apps" row is the one people ask about. Since Android 11, an app that wants to list what else is installed has to declare it, and Google requires a reason. For a VPN with an exclude list (split tunnelling), the reason is that it cannot show you a list of apps to exclude without knowing which apps you have. A VPN with no split-tunnelling feature has no reason to ask.
What a VPN never needs
| Permission | What its presence usually means |
|---|---|
| Contacts | Growth features ("invite a friend") or data collection |
| SMS or call log | Almost always data collection; Google restricts these heavily for good reason |
| Precise or background location | Data collection. A VPN already knows your rough location from your IP address and needs nothing finer |
| Camera or microphone | No VPN function uses either |
| Photos, media or files | No VPN function uses these; some older apps asked for storage to write log files, which is no longer necessary |
| Accessibility service | The most serious. An accessibility service can read what is on screen and act on your behalf in other apps. No VPN needs it |
| Device administrator | Lets an app resist being uninstalled. No VPN needs it |
An app can request a permission without being granted it, and Android lets you refuse each one at runtime. But a VPN that asks is telling you what it would like to do, and the answer to "why does a VPN want my contacts?" has never been reassuring.
How to check before you install
On the Play listing, open About this app and scroll to App permissions, then tap See more. This lists what the app can request. Read it against the two tables above. The Data safety section just above it is the developer's own declaration of what is collected and shared, and the two should agree with each other. Seven red flags in a free VPN's listing covers what to do when they do not.
How to check after you install
Open Android's Settings, then Apps, find the VPN, and tap Permissions. Anything listed under "Allowed" the app currently has. You can revoke individual permissions here without uninstalling; the tunnel does not depend on any of them except the VPN permission itself, which lives separately under Settings, Network and internet, VPN.
If a VPN app stops working after you revoke, say, location, that is informative in itself.
The notification is not optional
People sometimes try to silence a VPN's persistent notification and find the tunnel becomes unreliable. Android ties a background service's right to keep running to that notification, so a VPN that cannot show one is a VPN the system feels free to stop. On Android 13 and newer, refusing the notification permission does not stop the tunnel, but it does hide the one honest signal that traffic is being carried, or, with a kill switch armed, that traffic is being held closed. Why a VPN shows a permanent notification explains the mechanism.
Why the list is short by design
Android draws a hard line around the VPN permission precisely because it is so powerful. The app that holds it sees everything; in exchange, it should need nothing else. A provider whose app matches the first table and none of the second has built the thing it says it built.
Culvert VPN's tunnel runs on the system VPN permission and notifications alone, and the rest of its listing is the ordinary network, foreground-service and run-at-startup entries, Google Play billing for Premium, and an advertising-ID entry for the optional analytics that collects nothing until you turn the analytics toggle on (all set out in its privacy policy), with nothing from the second table; it is on Google Play.
Questions people also ask
Why does the VPN prompt say the app can "monitor network traffic"?
Because that is literally what a VPN does. To carry every other app's traffic it has to see every packet, and Android's dialog says so plainly. The wording is the system's and is identical for every VPN app, so it tells you nothing about a particular one.
Can I revoke a VPN app's permissions without uninstalling it?
Yes. Settings, Apps, the VPN, then Permissions lets you switch off anything it was granted. The tunnel itself depends only on the VPN permission, which lives separately under Settings, Network and internet, VPN.
Why does my VPN app want to see the other apps I have installed?
If it offers split tunnelling, it needs the list to show you which apps to exclude from the tunnel. A VPN with no split-tunnelling feature has no reason to ask.