I was using Universal Copy for a while to be able to copy text from fields that are not normally able to be selected, but due to it being able to see all contents on the screen when running, I would disable the it in accessibility settings until needed, which was a pain. I found Copycat, which does the same thing but with only one permission (run at startup) declared, and it states the following:
This app does not use any internet connection at all, So it never syncs any of your saved data anywhere. You can confirm it yourself by checking the app permissions. Your data is safe in your device.
On the surface, this seems great, since it appears there's no concern about giving it the access involved with the accessibility service. However, I know that Android permissions aren't so well-defined, unfortunately, and that if an app has any permission in a category, it has all permissions in that category. Since the "run at startup" permission is in the "Other" category, which is also where the internet permissions are located, it would seem that it would have that access, even though it doesn't specifically request it.
So my question is, is that true, or does an app have to declare a permission in its manifest in order to be able to use it, and does that declaration always mean that permission will show when viewing an app's permissions in the Play Store? IOW, is Copycat truly safe, or could it potentially still be sending information, and the developer is either misguided, which wouldn't exactly be promising, or outright lying, which would clearly be bad? I emailed them a few weeks ago but have not received a response.
P.S. I wasn't sure if this should go on Stack Overflow, since it relates to programming, or not, since it's not related to any specific code.