One permission, and nothing else
Miroji no longer requests VIBRATE. It was never used — the app has no haptics dependency and never calls the Vibration API. It came from neither the app's own configuration nor any dependency, but from a default permission set that expo prebuild injects, inherited from Expo Go.
Verified directly on the built release APK, the app now requests:
android.permission.CAMERA
That is the complete list. A second entry, DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, remains in the manifest but is not a capability the app asks for: AndroidX declares it at signature protection level to lock down its own internal broadcast receivers, it is namespaced to this app, it can only ever be granted to code signed with the same certificate, and it is never shown to users.
For an app whose entire purpose is showing you a mirror and keeping nothing, a single-permission surface is the clearest possible statement of that: it cannot reach the network, cannot write to storage, and cannot record audio, because it does not ask to.
Context
This completes the cleanup started in 1.3.2, which removed INTERNET, ACCESS_NETWORK_STATE and two unused dependencies. Together the two releases take the released permission set from seven entries down to one.
Full Changelog: v1.3.2...v1.3.3