So I decided to check if this is really as described. I downloaded a copy of the app from here, which is the Pixel 8 firmware for June 2024: https://dumps.tadi

So I decided to check if this is really as described. I downloaded a copy of the app from here, which is the Pixel 8 firmware for June 2024: https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-user-14-AP2A.240605.024-11860263-release-keys/product/priv-app/Showcase/Showcase.apk https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-u... The app has two components that are exported: - broadcast receiver com.customermobile.preload.StartOnBoot, which receives the ACTION_BOOT_COMPLETED broadcast that is sent by the system after the device is booted and first unlocked by the user - activity com.customermobile.preload.DebugActivity The onReceive method in StartOnBoot is this: public void onReceive(Context context, Intent intent) { Log.d(LOG_ID, "on boot called: " + (intent != null ? intent.toString() : "null")); boolean demoEnabled = getDemoEnabled(context); boolean checkAppPermissions = checkAppPermissions(context); Log.d(LOG_ID, "demoEnabled: " + demoEnabled); Log.d(LOG_ID, "permissionsCheck: " + checkAppPermissions); if (demoEnabled && checkAppPermissions) { startDemoStub(context); } else { if (!demoEnabled || checkAppPermissions) { return; } startPermissionsCheck(context); } } It relies on the getDemoEnabled method returning true to do anything: public static boolean getDemoEnabled(Context context) { int iStoreDemoMode = 0; int iVzwStoreDemoMode = 0; String szStoreDemoMode; String szVzwStoreDemoMode; try { iStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { iVzwStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} try { szStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { szVzwStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} return (iStoreDemoMode > 0) || (iVzwStoreDemoMode > 0) || "true".equalsIgnoreCase(szStoreDemoMode) || "true".equalsIgnoreCase(szVzwStoreDemoMode) } Which will only happen if system settings "store_demo_mode" or "verizonwireless_store_demo_mode" are set to a positive integer or to "true". As neither of these are set by default, none of the code behind the startDemoStub method will be executed when the device boots. The DebugActivity layout is as follows, and consists of a single button labelled "Simulate StartOnBoot": <?xml version="1.0" encoding="utf-8"?> <androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto" android:layout_width="match_parent" android:layout_height="match_parent"> <Button android:id="@+id/startOnBoot" android:layout_width="wrap_content" android:layout_height="wrap_content" android:layout_marginLeft="8dp" android:layout_marginTop="8dp" android:layout_marginRight="8dp" android:text="Simulate StartOnBoot" app:layout_constraintLeft_toLeftOf="parent" app:layout_constraintRight_toRightOf="parent" app:layout_constraintTop_toTopOf="@+id/guideline"/> <androidx.constraintlayout.widget.Guideline android:orientation="horizontal" android:id="@+id/guideline" android:layout_width="wrap_content" android:layout_height="wrap_content" app:layout_constraintGuide_percent="0.1"/> </androidx.constraintlayout.widget.ConstraintLayout> All this does if clicked is send an intent which will end up at the onReceive of the StartOnBoot receiver: public class DebugActivity extends AppCompatActivity implements View.OnClickListener { public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView(R.layout.activity_debug); findViewById(R.id.startOnBoot).setOnClickListener(this); } public void onClick(View view) { if (view.getId() == R.id.startOnBoot) { sendStartOnBootIntent(); } } private void sendStartOnBootIntent() { sendBroadcast(new Intent("com.customermobile.preload.StartOnBoot"), "com.customermobile.preload.StartOnBoot.PERMISSION"); } } We know this because the receiver filters for this action: <receiver android:name="com.customermobile.preload.StartOnBoot" android:enabled="true" android:exported="true"> <intent-filter> <category android:name="android.intent.category.DEFAULT"/> <action android:name="android.intent.action.BOOT_COMPLETED"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.ManualStart"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.StartOnBoot"/> </intent-filter> </receiver> So, nothing to worry about. The app does nothing unless one of the two system settings described above are set.