Currently when you build an Exponent app, the android manifest requires access to Camera, Contacts, etc. even if your app doesn't use these. You should be able to disable these permissions in exp.json.