Notes

Hi there!
So happy someone finally asked :)
About the internet usage, everything is open source, so every usage can be seen,
And yes, as I checked, the usages mentioned are quite common:

1. Updates
If you use BaldPhone via Direct APK download, it has a feature called in app updater.
It checks github for a new version:

https://github.com/UriahShaulMandel/BaldPhone/blob/9456b9927da0718d23d9299384a59eda7cdea799/app/src/main/java/com/bald/uriah/baldphone/utils/UpdatingUtil.java#L51

and if it has a new version, BaldPhone suggest downloading it:
https://github.com/UriahShaulMandel/BaldPhone/blob/9456b9927da0718d23d9299384a59eda7cdea799/app/src/main/java/com/bald/uriah/baldphone/utils/UpdatingUtil.java#L102

this only happen when you use direct apk, with the in app updating mechanism :)
If you use F-Droid or Google Play, this whole mechanism is disabled:
https://github.com/UriahShaulMandel/BaldPhone/blob/9456b9927da0718d23d9299384a59eda7cdea799/app/src/main/java/com/bald/uriah/baldphone/activities/HomeScreenActivity.java#L300

2. Crash Reports
BaldPhone, such as many open source apps, sends crash reports via a open source crashing report system named Acra: https://github.com/ACRA/acra
It can be turned off in the settings:
image.png
The data is anonymous, and to my understanding, many open source apps use it.
There was a long discussion on it in this thread, which I think you may found really interesting:
https://github.com/UriahShaulMandel/BaldPhone/issues/7

3. Stats
BaldPhone collects simple anonymous stats, that can be seen here:
https://baldphone.com/stats/
The part of the app that sends them is here:
https://github.com/UriahShaulMandel/BaldPhone/blob/9456b9927da0718d23d9299384a59eda7cdea799/app/src/main/java/com/bald/uriah/baldphone/utils/S.java#L355
As can be seen, it first checks where to send, in this url: https://github.com/UriahShaulMandel/BaldPhone/blob/master/logging%20mechanism/loga.txt
and after that, it send a simple http req containing only 4 params:
https://github.com/UriahShaulMandel/BaldPhone/blob/9456b9927da0718d23d9299384a59eda7cdea799/app/src/main/java/com/bald/uriah/baldphone/utils/S.java#L372
a. uuid - random number for each device, that cannot be traced back to any phone (random, created at first log)
b. flavor - means if downloaded from google play / fdroid / directly
c. vcode - version code of app (last one is 101, for example)
d. locale - the language of BaldPhone (en for english, de for german...)

It's completely anonymous :)
it goes to 2 IPs, first to github's to see where to go, and then to where it's told in the github (my website).


Conclusion:
Total of 4 ips, Updates, Crash reports and stats
those things are also being used by F-Droid for example, to my understanding, and many other open source apps, because they are not intrusive, saves the user's privacy, and really really assists in development :)

Also, I wanted to thank you very much! checking what open source apps do it extremely important, and should be done my more people, including me.
Whenever I download an open source app, I say to myself, probably other people have checked it, and goes on to using it.
You are the first one contacting me on this issue, and that's a bit concerning.
More, including me, should check out what data of them is being used and sent.
So, Thank you so much! and I hope you find this answer useful!


Also, about the permissions, please remember BaldPhone is not simply a launcher, it replaces much much more!
if you use only the launcher, it won't ask you for permissions!
but if you go to dialer - it'll ask for call permission
if you go to settings, it'll ask for settings permission
if you go to photos/videos - to file access permission
use flashlight - camera permission
notification of BaldPhone - notification permission
and so on...
if you go to grant all permissions, you can see explanation of each one:
image.png



Here's for everything, and thanks again!
Uriah Shaul Mandel