The QUERY_ALL_PACKAGES permission (what an Android app needs to see all the packages installed on your phone) is a little weird. The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE- having it in the app’s manifest alone is sufficient to query packages. However, Google Play Console does make you submit a video of how the permission is used in your app in order to publish on Google Play if they detect it in your manifest.

The acceptance criteria made sense for our app (it displays your phone’s notifications on your smart glasses HUD, and users need a way of selecting which apps can/can’t display notifications). I don’t know how HSBC justifies it though.