Required for the WebView to access the internet. Without this permission, Privacy Browser would be “No Browser: Protecting Your Privacy by Staying Completely Off the Internet”.
com.android.launcher.permission.INSTALL_SHORTCUT
Required to add shortcuts for websites to the launcher desktop.
android.permission.WRITE_EXTERNAL_STORAGE
Required to download files to the public download folder. On Android Marshmallow (API 23) and newer, if this permission is denied Privacy Browser will store downloads in the app’s download folder instead.
In addition, Privacy Browser Free displays ads from Google’s AdMob network using the Firebase backend. For the free flavor, Firebase adds the following permissions even though they are not listed in the manifest file.
android.permission.ACCESS_NETWORK_STATE
Allows the ads to tell when you are connected to the internet and when you aren’t (presumably so they don’t try to reload an ad when you are disconnected). They can also tell if you are connected via Wi-Fi, 2G, 3G, 4G, etc.
Allows the ads to keep the processor from sleeping and the screen from dimming, although in my testing I don't think the ads actually do this.
com.google.android.c2dm.permission.RECEIVE
Allows Google to send information directly to the AdView without having to receive a request first (cloud-to-device messaging).
com.stoutner.privacybrowser.free.permission.C2D_MESSAGE
Secures the cloud-to-device messages so that only Privacy Browser Free can receive them.