Ultrebo permissions explained

Ultrebo asks for a few sensitive permissions because tapping for you needs them. Here is what each one is used for, how to switch it off, and what Ultrebo does not do.

What each permission is for

Permission	What it is used for	How to turn it off
Accessibility service	Android only lets an app tap and swipe on other apps through this service, so every auto-clicker uses it. Ultrebo uses it to perform your macros' taps and swipes and to show its floating RUN / REC bar. It does not request permission to read the content of other apps.	Settings > Accessibility > Ultrebo > Off
Screen capture optional	Only for image and text steps, so Ultrebo can look at the screen and find your target. Frames are examined in memory on your phone and discarded. The only picture ever saved is the small region you crop yourself.	Tap Stop capture in the app, or swipe away the capture notification
Notifications	Android requires a visible notice while screen capture is running. It is the only notification Ultrebo shows.	Settings > Apps > Ultrebo > Notifications
Internet	Used to ask GitHub whether a newer version exists, and to download it if you tap Update now. Nothing about you, your phone or your macros is sent. If you set a Discord webhook (the bell button) and switch it on for a step or rule, it is also used to post a screenshot to that webhook when the step or rule is found.	Switch off Check for updates on launch in the About screen. Empty the Discord webhook to stop screenshots
Install unknown apps optional	Only used by the in-app updater to install Ultrebo's own new version. Android only accepts an update signed with the same key as the app you already have.	Settings > Apps > Ultrebo > Install unknown apps

What Ultrebo does not do

• It does not upload your macros, screenshots or cropped images. They stay on your phone, except a screenshot you have asked for: only if you set a Discord webhook and switch it on for a step or rule is that screenshot posted to your webhook.
• It does not read what is inside other apps through the accessibility service.
• It has no ads and no accounts at the moment.
• It does not hide itself or try to avoid detection by games.

Text recognition and Google ML Kit

Finding text on screen uses Google's ML Kit library. The recognition itself runs on your phone with a model bundled in the app, and your screen content is never uploaded. ML Kit may send anonymous usage statistics to Google. If you don't want that, don't use text steps. Image steps don't use ML Kit.

Check it yourself

• The code is public on GitHub, so you can read what it does.
• The downloadable APK is built by GitHub's build system from that code, and the release page lists its SHA-256 checksum.
• You can upload the APK to VirusTotal for a second opinion.

Questions

Ask in the Discord server, or see the install guide for setup help.