hhhhh
how does snapseed access my fs without storage permissions?

Does the app actually request storage permissions at all? If it does, I would guess its requesting All Files Access (under Settings > Apps > Special app access > All files access).

hhhhh images won't upload or display...
https://postimg.cc/w1nq6gQ8

I don't believe this forum has the functionality to show images. I've no idea why the image button is on the editor row.

        Dumdum

        I never noticed it, but there is some text in the file picker saying SnapSeed can only access photos I select, which is quite reassuring. There just are no App Permissions for file storage, there is only Sensors, Network, and Camera permissions.

        https://postimg.cc/BtHfFRfs
        https://postimg.cc/BtHfFRfs
        https://postimg.cc/BtHfFRfs
        https://postimg.cc/BtHfFRfs

            hhhhh
            If Snapseed only uses the File Picker, then you're fine. As you noticed, only files you select can be seen by apps (using the File Picker).

              hhhhh You're confusing the app itself with the system file picker provided by the system file manager. That's not the app accessing your files.

                  Dumdum hhhhh The forum supports embedding images, but we have it configured to block loading them unless they're from https://discuss.grapheneos.org/ to prevent leaking people's IP address and browser metadata to arbitrary sites. It could be used to harm users on our forum if we permitted embedding images from arbitrary sites.

                  We have a media proxy on https://discuss.grapheneos.org/ that's usable for linking images from a whitelist of sites but it's not currently being actively used beyond linking images from our posts on Mastodon via grapheneos.social such as in https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation.

                      hhhhh
                      The website has information on this.

                      TLDR: apps can create their own files, which they always have access to. The access that apps have to files that they didn't create is controlled by permissions and (in GOS' case) Storage Scopes.