Casino App Permissions: Overlay, Accessibility and What to Refuse
The install screen is the last moment you have any leverage. After you tap Allow, an Android app has whatever you granted it, and two of the permissions commonly requested by sideloaded casino clients are powerful enough to read everything else on your phone. This page is about that screen: what each request means, which ones have no gaming justification at all, and how to take them back if you already agreed. 100JILI is an independent guide — no deposits, no balances, no games, no installer links. 21+.
Contents
- The two permissions that matter most
- The full permission table: what it is for, what it enables
- Why there is no casino app in Google Play or the App Store here
- What an APK is, and why the signature matters
- Sideloading risks beyond permissions
- Repackaged builds
- A pre-install checklist
- Taking permissions back after the fact
- iPhone: a shortcut, not an app
- Storage, Android version and device expectations
- Data and battery
- Notifications and tracking
- Troubleshooting five common faults
- What we will never publish
The two that matter most
Accessibility service exists so that screen readers and switch controls can work: an app holding it can see the content of every other app and act on your behalf inside them. It is the single most powerful thing you can hand an Android application, and a casino client has no legitimate use for it. If an install or a first-run screen asks you to enable it in settings, that is the end of the conversation.
Display over other apps is the second. It lets an app draw on top of whatever you are looking at, which is how a convincing fake login box ends up sitting over a real banking or e-wallet screen. Some legitimate apps use it for floating chat heads; a gambling client does not need it, and the cost of being wrong is your credentials.
Everything else on the list below is a smaller version of the same question: what does this permission make possible that the app would not otherwise be able to do?
The permission table
| Request | Stated purpose | What it actually enables |
|---|---|---|
| Accessibility service | "Improve your experience" | Reading and controlling every other app on the device |
| Display over other apps | "Floating game window" | Drawing a counterfeit screen over a genuine one |
| SMS or notification access | "Faster login codes" | Reading one-time passwords as they arrive |
| Install unknown apps | "Automatic updates" | Fetching and installing further code later |
| Contacts | "Invite your friends" | Harvesting your address book |
| Storage or photos | "Upload your ID" | Reading files beyond the one you chose, on older Android versions |
| Device administrator | "Security" | Resisting uninstall and controlling device policy |
| Network access | Running the games | This is the one a casino client genuinely needs |
The last row is the point of the table. A client that streams games needs the network and effectively nothing else; a document upload can use the system picker without blanket file access.
Why the stores do not carry these apps
Both Google and Apple gate real-money gambling apps country by country: the operator applies, proves a licence for that market, and is published only to that storefront. Most lobbies serving Philippine players have not gone through it, so a store search returns nothing relevant — or a crowd of unrelated apps using a familiar name. The resulting vacuum is what download pages fill, and they do not fill it with the operator's software.
APK, and why the signature matters
An APK is one file containing an Android app: code, assets, the declared permission list and a cryptographic signature identifying who built it. Play ships APKs as well; the difference is that Play screened the file and remembers the signature, so every later update must come from the same builder.
Outside the store there is no such continuity. Android refuses to upgrade a package signed by a different key, which is why a sideloaded build often cannot be updated at all, and why fixing it means uninstalling — losing local data and any saved login in the process.
- Nobody screened the file before it reached you
- No automatic security updates
- No dispute route, because a store dispute process does not exist outside a store
- A build can be abandoned, then silently break when the operator changes servers
- Malware families target exactly this distribution path because it has no gatekeeper
Repackaged builds
Anybody can take a legitimate APK, insert code, re-sign it and publish it with the original name and icon. The copy installs cleanly, the splash screen is correct, the games work — and the added code reads notifications, logs input or presents an overlay at the right moment. There is no visual difference, because looking identical is the entire purpose.
So provenance is the only usable control. A file reached from the operator's own verified domain while you were logged in is a different object from a file forwarded in a chat, pulled from an APK archive, scanned from a QR code or served by a search advertisement, even when the bytes claim otherwise.
A pre-install checklist
- Read the permission list before anything else; cancel on accessibility, overlay or SMS access.
- Type the operator's address yourself and check it letter by letter for substitutions.
- Find any download reference inside your logged-in account on that site and nowhere else.
- Check the operating company named in the terms against PAGCOR's published records.
- Ask support, in writing, whether an Android package exists and which address publishes it; keep the reply.
- Keep Play Protect switched on.
- Decide in advance that no OTP, MPIN or password leaves your phone, for anyone.
A step you cannot complete is the answer, not an inconvenience. The mobile browser gives you the same games with no permission grants at all.
Taking permissions back
If something is already installed, none of this is permanent. Android's app-info screen lists what an app holds and lets you revoke it; accessibility services live in a separate settings section, and overlay access usually in a "special app access" area. Revoke the dangerous ones and keep playing — in almost every case the games carry on working, which is itself the evidence that the permissions were never needed.
If an app refuses to run without accessibility access, that refusal has told you something more useful than any review could.
iPhone: a shortcut, not an app
On iOS there is normally nothing to install and no permissions to grant. The operator asks you to open the site in Safari, tap Share and choose Add to Home Screen; iOS saves a bookmark wearing the site's icon, which opens a browser window without visible controls.
The upside is that a shortcut can do nothing a web page cannot. The thing to refuse is any page asking you to trust a configuration profile or enterprise certificate so you can run a "real" iOS casino app — that is device-level control, far beyond anything a casino requires.
Storage, Android version and device expectations
| Common assumption | What to expect |
|---|---|
| "Small download, small footprint" | Assets download per title opened, so the cache keeps growing |
| "My Android version is supported" | A build targeting an old release runs under that release's weaker permission rules |
| "Any phone will do" | Live dealer video is the demanding case; slots are the forgiving one |
| "It updates itself" | A sideloaded package is outside the store and updates never |
Published minimums tell you whether an app launches, not whether it will behave for an hour. Free space and available memory decide that.
Data and battery
Slots send small amounts of data per spin once a game's assets have loaded. Live dealer tables are continuous video for as long as the table is open, and that is where a prepaid load disappears. Lower the stream quality if the client allows it, and prefer Wi-Fi for live play.
Battery follows the same shape, with heat as the complication: a warm phone throttles, frame rates drop, and people read that as the game stalling. A handset that shuts down mid-round leaves you guessing about a bet that was already resolved on the server.
Notifications and tracking
Push notifications from a gambling client are marketing, scheduled for when you are idle. Turn them off at the operating-system level rather than inside the app, so a reinstall cannot restore them without you noticing.
Every client logs which games you open and for how long, and the device advertising identifier joins that record to the rest of your phone. Resetting the identifier on Android and limiting tracking on iOS both reduce it. If you have set a deposit limit or taken a break, promotional pushes are the mechanism most likely to undo it.
Troubleshooting
| Fault | Check first | Who resolves it |
|---|---|---|
| Login loop after a correct password | Automatic date and time, cleared cache, no VPN or blocker, the same login in a browser | You — unless the browser loops too, in which case open a written ticket with the operator |
| Blank or white screen | Connection, content blocker or private DNS, free memory, cache | You, or nobody if the build is abandoned; use the mobile site instead |
| Deposit not credited | Your e-wallet or bank record of a completed transfer and its reference | The operator's cashier, in writing, with the reference — never an agent offering to release it for a fee |
| Live stream will not load | Bandwidth, Wi-Fi versus data, lower quality, the same table in a browser | Operator support; a studio outage is theirs |
| Update failed | Free storage, and whether the installed build was sideloaded under a different signature | No one remotely — uninstall and reinstall from the same verified source |
Every money row ends at the operator that holds the balance. We have no cashier, cannot see your account and cannot release anything, and nobody who offers to do so for a fee is telling the truth.
What we will never publish
No installer files, no download buttons, no mirrors, no version archives. That is permanent. A page that offers you one of those while claiming to keep you safe has already answered the question about itself.
Gambling in the Philippines is for adults aged 21 and over at licensed venues. If play has stopped feeling like a choice, the responsible-gaming page covers deposit limits, time-outs and self-exclusion.
Frequently Asked Questions
Why should I refuse accessibility access?
Because it is the most powerful permission on Android: an app holding it can read the contents of every other app and act inside them. Screen readers need it. A casino client does not, and malware families rely on people approving it without reading.
What is 'display over other apps' used for?
Legitimately, floating windows and chat bubbles. Abusively, drawing a fake input screen on top of a real one so that what you type goes somewhere else. A gambling app has no need for it.
I already granted these. What do I do?
Revoke them. Android's app-info screen lists ordinary permissions; accessibility and overlay access sit in their own settings sections. In nearly every case the games keep working afterwards, which shows the access was never required.
Does 100JILI have an app?
No. 100JILI is this independent guide — no cashier, no lobby, no games, no app. Whether a specific operator publishes an Android package is a question for that operator, answered in writing inside your logged-in account.
Can I tell a repackaged APK from a real one?
Not by looking. Name, icon and layout all survive repackaging because the attacker wants them to. Only provenance helps: the operator's own verified domain while logged in, never a chat, mirror, QR code or advertisement.
Why will the app not update?
Android will not replace a package with one signed by a different key, so a sideloaded build cannot be upgraded by a file from elsewhere. Uninstalling and reinstalling works but clears local data.
Is the browser genuinely safer?
Yes, for most people. A browser runs the same games in a sandbox, grants no device permissions, needs no update management and can have its site data cleared whenever you want.
Does an app pay more than the website?
No. Outcomes are generated on the operator's servers; the client only displays them. Any claim of better payouts in an app version is invented, and a studio's published RTP does not change by client.