Comment by jackfraser

So the app should ask for a permission to a reasonable set of domains, and when you're installing it, you should get a clearly laid out permissions / privacy risk management worksheet to look at and agree to.