A smart fitness tracking application requests several permissions during installation. The app claims these permissions improve personalisation and social engagement features. Which requested permissions introduce realistic security attack surfaces? Select two correct options.