0

I installed an app and it has a subscription for the pro version in-app.

It automatically selects the account and shows the added cards in the subscription popup window

I cannot change the payment account, I guess it grabs the account from Google Pay installed on my phone which I use for everyday payments.

I don't like it, I don't like when some arbitrary app that I don't trust has access to my payment profile by default, and I like to disable such possibility for the app. Is there a way?

I don't understand where this possibility comes from, I didn't grant any payment permissions for the app.

Is this permission inherent for any app and I can't disable it?

Answering future questions: I tried to install this app from another account like suggested here, I tried to reinstall, and I even installed this app from APK in the end. No result. It still points to the same payment account, I guess it was saved from the first time in the very beginning when I installed the app from it.

Andrew T.
  • 15,988
  • 10
  • 74
  • 123
Suncatcher
  • 444
  • 6
  • 25
  • AFAIK there's no permission to prevent apps from doing IAPs. com.android.vending.BILLING's protection level is "Normal", so cannot be revoked. There exist some hacks but they won't work without root. – Irfan Latif Aug 23 '22 at 13:36
  • protection level is "Normal", so cannot be revoked it's odd because payment cards information is sensitive one, and accessing it by any app, even installed from APK, is not safe – Suncatcher Aug 23 '22 at 14:10
  • Related, but unanswered: https://android.stackexchange.com/q/106251/96277 – Firelord Aug 23 '22 at 14:45
  • 1
    @Suncatcher when you make purchases (in-app or initial) from Play Store, it's the Play Store app (and possibly Play Services) which have access to your Google account details including the payment methods, not the other apps. What you see is a part of the Play Store app, not the one you are (not) going to purchase. – Irfan Latif Aug 23 '22 at 16:13
  • 1
    Are you aware that the second screen shot shows GooglePlay and not the app? Apps don't have access to your payment data. They can only tell GooglePlay to show the matching purchase dialog. Even if you make an in-app purchase the data the app gets seems to be very limited. See also my question and the comments about in-app purchase and privacy: https://android.stackexchange.com/questions/246557/privacy-of-in-app-purchases-how-much-user-data-does-the-app-developer-get – Robert Aug 23 '22 at 17:59
  • ok then, I got your point guys, the app doesn't have access to Payments API and don't see this data. This, however, doesn't answer my main question: how to prevent app even trigger this Play Store dialog? I treat these "purchase me" popups as ads and I want to do with them the same that I do with ads - to adblock. – Suncatcher Aug 24 '22 at 10:09
  • @Suncatcher root your device and try to use Intent firewall. Nothing less than that. – Irfan Latif Aug 24 '22 at 14:57
  • Honestly at this point just stop using the app and search for an alternative. Why do you want to keep using one which shoves a subscription down your throat? – SSS Sep 22 '22 at 05:22
  • it was a purely scientific research question for learning the ecosystem ;) – Suncatcher Sep 22 '22 at 18:56

1 Answers1

2

For an in-app purchase the app that has the in-app purchases cooperates with Google Play Store app. In that process the app does not get access to the payment info, that is all handled by Google Play Store app.

According to what I know this is what happens when a user performs an in-app purchase:

Preparation: When publishing the app the app developer registers all possible in-app purchases at Google so Google knows exactly for what app what in-app purchases are possible.

On user side the following steps are preformed:

  1. The app shows a button to perform an in-app purchase.
  2. If the user clicks on that button some Google provided code inside the app is triggered that contacts GooglePlay Store app. In that communication Play Store verifies that the app is genuine (app signature is checked). Then the information about the selected in-app purchase package is sent to Play Store app. Also an "obfuscated user name" (the unique identifier of your user account within that app) is sent so that app can later identify for which account a successful subscription has been bought.
  3. Google Play Store app takes over and shows the purchase dialog like your second screen shot.
  4. If the user confirms the subscription in Google Play Store purchase dialog, payment will be performed an Google backend issues a purchase token that is send to the Play Store and for that forwarded to the app you made the purchase for. In that token the previously mentioned obfuscated user name is included and the data what in-app purchase was purchased.
Firelord
  • 25,084
  • 20
  • 124
  • 286
Robert
  • 20,025
  • 6
  • 47
  • 66
  • This doesn't answer my main question: how to prevent app even trigger this Play Store dialog? – Suncatcher Aug 24 '22 at 10:12
  • @Suncatcher Based on your question I assumed that the actual question is about the account data being accessed by the app. On unrooted devices you can't prevent an app from opening in-app purchase dialog. You can only prevent the actual purchase by setting Play Store to always ask for the account password when doing a purchase (see Play Store settings -> Authentication). The only other way I know would be to modify (-> resign) the app. Then in-app purchase would directly fail and no dialog opens. But that also means the app is disconnected from Play Store updates. – Robert Aug 24 '22 at 10:30