Audit Your App Permissions in 10 Minutes Flat (Android + iPhone)
Your weather app knows your exact location and your photo editor once read your contacts. This 10-minute app permissions audit finds every over-privileged app and locks them down.
The average phone carries dozens of apps with permissions they never use. Your weather app knows your exact location. Your photo editor once read your contacts. This 10-minute app permissions audit finds every one of them and locks them down — no new apps, no technical background, nothing to install.
Why your permissions are probably a mess
App permissions fail for a very human reason: the moment an app asks is the moment you least want to think about it. You're setting up a new app, you're in a hurry, and the dialog pops up — Allow, obviously. Months later, that casual tap is still there, and the app still has your location.
It gets worse from there. Permissions accumulate silently. An update adds a feature you never asked for, and with it a new permission request you approve on reflex. And it is not just the app itself — the SDKs bundled inside apps (analytics, ads, crash reporting) can piggyback on whatever access the host app holds.
This isn't theoretical. Time and again, researchers find apps collecting location, contacts, and identifiers they have no business touching. The fix isn't paranoia; it is a routine. Here is the routine.
Start with the dashboards: your 7-day visitor log
Both platforms now keep a log of who touched what. On iPhone, go to Settings > Privacy & Security > App Privacy Report and turn it on — Apple only starts collecting data after you enable it, so give it a day or two of normal use. Then come back: Data & Sensor Access shows how often each app hit your Location, Photos, Camera, Microphone, and Contacts over the past week, and Network Activity lists the domains those apps talked to.
On Android 12 and up, open Settings > Security and Privacy (or just Privacy) and tap Privacy dashboard. Same idea: which apps used Camera, Microphone, or Location in the last 24 hours (Android 12) or 7 days (Android 13 and up). Tap any permission to see the apps behind it, then tap an app to change it. On Android 16 and newer, a blue dot appears in the status bar whenever an app is actively using your location — tap the indicator to see exactly which app it is.
Read the log the way you would read a visitor sign-in sheet: mostly boring, which is good. What you are hunting is the exception — the app you opened once three months ago that used your microphone yesterday, or the game with "Always" location access.
The 10-minute app permissions audit
Set a timer. Work the permissions, not the apps:
- Pick the big three. In the privacy dashboard or App Privacy Report, open Location, Camera, and Microphone in turn. These three are the most sensitive sensors on your phone, and five minutes here catches 90% of the problem. (5 min)
- Open the offenders. For any app that doesn't need the permission to do its job, open its permission page: Android, Settings > Apps > [app] > Permissions; iPhone, Settings > Privacy & Security > the category, then find the app in the list. (2 min)
- Downgrade instead of deny. Location: switch "Always" to "While using the app," and turn off Precise Location when an approximate one is enough — your weather app needs your city, not your doorstep. Camera and Microphone: "Ask every time" or off entirely. (2 min)
- Sweep with the Permission manager. On Android, Settings > Security and Privacy > Permission manager sorts everything by permission type, so you can catch anything the dashboard missed. On iPhone, check Settings > Privacy & Security > Tracking and kill ad tracking while you are in there. (1 min)
What you can safely revoke (without breaking anything)
- "Always" location for anything that isn't navigation, ride-hailing, or family tracking.
- Contacts for games and shopping apps that don't need to find your friends.
- Microphone for any app without a voice feature. If you can't name the voice feature, it doesn't need the mic.
- Camera for anything that doesn't take photos or scan codes.
- Full photo library access — both platforms now offer limited photo access; use it for every app except your actual photo editor.
And remember the safety net: revoking a permission doesn't break an app permanently. If the app genuinely needs it, it will ask again when you use that feature. Revoke first, see what complains.
Make it a habit, not a one-off
Permissions drift. Updates add features, features add requests, and your careful audit slowly rots. Put a quarterly reminder in your calendar — pair it with something you already do.
While you are in security mode, it is also worth checking whether your accounts have already been exposed somewhere — here is how to check if your data was leaked. And if you use WhatsApp, tightening restricted chats is the next five minutes well spent.
