Do permissions have to be declared in the manifest for an app to have the access they provide? I was using Universal Copy for a while to be able to copy text from fields that are not normally able to be selected, but due to it being able to see all contents on the screen when running, I would disable the it in accessibility settings until needed, which was a pain. I found Copycat, which does the same thing but with only one permission (run at startup) declared, and it states the following:


  This app does not use any internet connection at all, So it never syncs any of your saved data anywhere. You can confirm it yourself by checking the app permissions. Your data is safe in your device.


On the surface, this seems great, since it appears there's no concern about giving it the access involved with the accessibility service. However, I know that Android permissions aren't so well-defined, unfortunately, and that if an app has any permission in a category, it has all permissions in that category. Since the "run at startup" permission is in the "Other" category, which is also where the internet permissions are located, it would seem that it would have that access, even though it doesn't specifically request it.

So my question is, is that true, or does an app have to declare a permission in its manifest in order to be able to use it, and does that declaration always mean that permission will show when viewing an app's permissions in the Play Store? IOW, is Copycat truly safe, or could it potentially still be sending information, and the developer is either misguided, which wouldn't exactly be promising, or outright lying, which would clearly be bad? I emailed them a few weeks ago but have not received a response.

P.S. I wasn't sure if this should go on Stack Overflow, since it relates to programming, or not, since it's not related to any specific code.
A basic Android application has no permissions associated with it by default, meaning it cannot do anything that would adversely impact the user experience or any data on the device. To make use of protected features of the device, you must include in your AndroidManifest.xml one or more  tags declaring the permissions that your application needs. At application install time, permissions requested by the application are granted to it by the package installer, based on checks against the signatures of the applications declaring those permissions and/or interaction with the user. No checks with the user are done while an application is running; the app is either granted a particular permission when installed, and can use that feature as desired, or the permission is not granted and any attempt to use the feature fails without prompting the user. 

Read more here https://developer.android.com/guide/topics/permissions/overview