Review app permissions in two directions: by permission type first, then per app. On Android the fast route is Settings, Security and Privacy, Privacy, Permission manager; on iPhone it is Settings, then Privacy and Security, where each data category lists the apps that asked for it. Keep a permission only if the app’s main feature breaks without it, and give location “while using the app” rather than “all the time” unless there is a clear reason.
Why the permission type screen comes first
Most people only look at permissions when an app asks for one, at the moment of install or first launch, and then approve it to get past the prompt. That is how a photo editor ends up with microphone access and a shopping app keeps reading contacts for years. Sorting by permission type shows you every app that holds a sensitive capability at once, which makes the odd ones obvious. Google’s own help pages describe both routes: a per app list under Settings, Apps, and a Permission manager that groups apps by the permission they hold. Apple’s guide does the same through Settings, Privacy and Security, where each category such as Contacts, Photos, Microphone or Motion and Fitness shows the apps with access and lets you switch any of them off.
What each permission actually gives away
The names are vague, so here is what the common ones cover on a modern phone.
| Permission | What the app gets | Reasonable default |
|---|---|---|
| Location | Device position from GPS, Wi-Fi and mobile networks | While using the app; “all the time” only for maps, fitness tracking or find-my-device tools |
| Microphone | Recording audio whenever the permission is active | Allow only for calls, voice notes and recording apps |
| Camera | Taking photos and video | Allow for apps where you actually capture something |
| Contacts | Reading and often uploading your address book | Deny unless the app is a messenger or dialler |
| Photos and files | Access to images, or to all files on the device | Prefer selected photos over full library access |
| Calendar, call logs, health data | Reading schedules, call history or step and vitals data | Deny by default; almost no mainstream app needs these |
Android separates install-time permissions, which are granted when the app is installed, from runtime permissions, which the app must request while it is running, as the platform documentation explains. The runtime ones are the interesting ones, because those are the prompts you can refuse.
On Android: use both review screens
Open Settings, tap Apps, pick the app, then Permissions. Everything you allowed or denied sits there, and each entry can be flipped. For location, camera and microphone you can usually choose “All the time” for location only, “Allow only while using the app”, “Ask every time”, or “Don’t allow”. The second screen, Permission manager, answers a different question: which apps can read my calendar, my call log, my contacts. Step through it once and revoke anything that does not match the app’s purpose. Google documents both paths, including the permission types and what each one does, at support.google.com.
On iPhone: categories plus the App Privacy Report
Go to Settings, Privacy and Security, then open a category such as Location, Contacts, Photos or Microphone. Each shows the apps that requested access and the level you granted, and you can change or remove it per app. Two features are worth knowing. App Tracking Transparency requires apps to ask before tracking you across other companies’ apps and websites, and turning off “Allow Apps to Request to Track” treats every request as a refusal. App Privacy Report, once switched on, records how often apps used the permissions you granted and shows their network activity for the past week. Apple’s step by step is at support.apple.com, and the underlying permission model is described at developer.android.com for the Android side.
A five minute routine that keeps it tidy
- List the apps you have not opened in a month and remove the ones you do not need. Permission you never granted cannot leak.
- For every remaining app, ask one question: which feature breaks if I deny this? If the answer is vague, deny it.
- Set location to “while using” everywhere except navigation and workout apps.
- Turn off contact, calendar, call log and health access unless the app’s core job depends on it.
- Repeat after every major app update, because new features often arrive with new permission requests.
The goal is not a phone with every permission denied. It is a phone where each permission you granted has a reason you can state in one sentence. Anything you cannot justify is worth switching off, and both platforms let you turn it back on the moment something stops working.