1. Installed-app inventory is personal and sensitive user data. From Android 11 (API 30), the platform filters which other packages an app can see, so methods such as queryIntentActivities(), getPackageInfo(), and getInstalledApplications() no longer return a full device catalog by default. Broad visibility — seeing essentially any and all installed packages — is the QUERY_ALL_PACKAGES permission, and Google Play limits it tightly. Use it only when awareness of, or interoperability with, any and all apps on the device is required for a user-facing core function. Prefer finite, targeted queries whenever the product can work without a full inventory. Primary source: Play Console Help, "Permissions and APIs that Access Sensitive Information," Package (App) Visibility Permission section (https://support.google.com/googleplay/android-developer/answer/16558241). Related permitted-uses article: "Use of the broad package (App) visibility (QUERY_ALL_PACKAGES) permission" (https://support.google.com/googleplay/android-developer/answer/10158779).
2. QUERY_ALL_PACKAGES only takes effect when the app targets API 30 or later on Android 11+. Play defines core functionality as the main purpose of the app: without the ability to search for all apps on the device, the app is "broken" or unusable, and that purpose plus its core features must be prominently documented in the store listing. Help's permitted uses are products whose job is to discover any and all installed apps for awareness or interoperability — device search, antivirus, file managers, and browsers. A single-app shortcut, a share-to-one-messenger flow, or an "open in Chrome" button is not enough. Help also lists narrow temporary exceptions (certain real-money gambling apps that need broad visibility for mandated geofencing, and dedicated banking or digital-wallet apps solely for security). Personal-loan, credit, or loan-facilitation use is explicitly ineligible for that exception.
3. Default to limited, targeted package visibility. On Android 11+, declare the specific packages, intents, or providers you need with the manifest <queries> element instead of QUERY_ALL_PACKAGES. Limited visibility is the policy-preferred path: query only the apps your product actually launches, searches, or manages. You may not use QUERY_ALL_PACKAGES if a more targeted scoped package-visibility declaration is enough. Platform docs: Android Developers, "Package visibility filtering on Android" (https://developer.android.com/training/package-visibility). If <queries> covers the interaction, do not request QUERY_ALL_PACKAGES.
4. Alternative methods that approximate QUERY_ALL_PACKAGES-level visibility are restricted the same way as the permission itself. Policy allows those workarounds only for user-facing core functionality and interoperability with apps discovered that way — and the Package (App) Visibility Don'ts say not to gain broad visibility via methods Play has not explicitly allowed. Treat undocumented APIs, accessibility scraping, file-system walks, or other sidecar tricks that rebuild a full inventory as a policy problem, not a fallback. If reviewers can see every package without an approved QUERY_ALL_PACKAGES declaration, expect a rejection or removal.
5. If the product truly needs QUERY_ALL_PACKAGES, submit the Permissions Declaration Form in Play Console before you ship (Policy → App content → Permissions and APIs, or the high-risk / sensitive-permissions declaration Play shows when the permission is in the manifest). Declare QUERY_ALL_PACKAGES and any other high-risk permissions. For review, document why awareness of any and all apps is required for the core function, why <queries> is not enough, and how inventory data is used. If you change how the permission is used, revise the declaration with current, accurate information. Apps that keep the permission in the manifest without an accurate form, or that fail the use-case test, can be removed. Deceptive or undeclared use can suspend the app or terminate the developer account.
6. App inventory data queried from Play-distributed apps may never be sold or shared for analytics or ads monetization. That ban does not depend on consent copy. Do not send package lists to ad networks, attribution vendors, or device-graph partners. Access only the minimum data the core feature needs, keep it on-device when you can, and treat the list as Personal and Sensitive Information — permitted QUERY_ALL_PACKAGES apps still owe User Data policy, including prominent disclosure and consent. Invalid uses in Help include: the permission is not tied to core purpose (P2P sharing qualifies only when P2P is the core purpose); data acquired for sale; inventory used for analytics or ads monetization; and any task a less-broad visibility method can do.
7. Common rejections and the usual fixes: (a) QUERY_ALL_PACKAGES in the manifest for a feature <queries> can express — drop the permission and declare the specific packages or intents; (b) declaration missing, stale, or describing a different use than the code — update Policy → App content and resubmit; (c) store listing describes a single-purpose utility while the binary enumerates every package — either the listing or the permission is wrong; (d) an SDK silently adds QUERY_ALL_PACKAGES (security, fraud, or "app discovery" kits) — remove or replace the SDK; (e) inventory forwarded to analytics or ads — stop the export; (f) a workaround that approximates broad visibility without the permission — remove it; (g) a personal-loan or credit app relying on the financial-security exception — that exception does not apply.
8. Compliance checklist before upload: confirm Android 11+ / target API 30+ filtering on a real device or emulator; prefer <queries> and test with package-visibility filtering enabled; request QUERY_ALL_PACKAGES only when the core, user-facing purpose requires awareness of any and all apps; complete the Play Console declaration and keep it in sync with the artifact; never sell or share inventory for analytics or ads; do not ship alternative broad-visibility tricks; re-read the Package (App) Visibility section of https://support.google.com/googleplay/android-developer/answer/16558241 and the permitted-uses article https://support.google.com/googleplay/android-developer/answer/10158779 after any SDK or feature change.