How to Audit Your Android App Permissions (and Which Apps to Delete)

A few weeks ago, I read a detailed account from someone who spent an entire weekend reviewing the app permissions on his Android phone. By the end of it, he had deleted five apps he’d been using for years without a second thought. A flashlight app was requesting location data. A keyboard app had access to SMS and contacts. A weather app wanted the microphone.

This is not an isolated case, and it doesn’t require any special technical skill to check what your own apps are doing. You can do the same review in less than an hour, and it’s worth doing.

What happened

The author of the original piece on Android Police opened the system settings on his Pixel phone and navigated to the main permission manager. What he found was an alarmingly long list of apps that had been granted access to sensitive data—camera, microphone, precise location, SMS, call logs—often for reasons that had nothing to do with the app’s core function. A time-tracking app had full SMS access. A rarely used QR scanner could turn on the camera at any time, even when the app was closed.

After spending the weekend going through each app’s permissions one by one and revoking or denying what wasn’t needed, he ended up uninstalling five apps entirely because their data collection practices couldn’t be justified or controlled.

Why it matters

Android’s permission system has improved significantly in recent years. You can now grant “While in use” access to location or allow a permission only once. But many apps still request permissions they don’t need, and many users accept those prompts without thinking. Over time, small permissions accumulate, and the combined picture can reveal more about your habits than you might want.

There is also a broader context worth noting. In August 2024, Google ended its Play Security Reward Program, which had paid researchers to find vulnerabilities in popular Android apps. That program was one of the few independent incentives for developers to keep their apps honest. Without it, users have to be more proactive about checking what their apps are doing.

What you can do

Here is a practical, step-by-step way to audit your own app permissions on Android. It works on most phones running Android 10 or later, and the general path is similar across manufacturers.

Step 1: Open the permission manager.
Go to Settings > Apps > Permission manager. This screen lists all permissions (Camera, Microphone, Location, SMS, Contacts, etc.) and shows how many apps have access to each one.

Step 2: Review permissions one category at a time.
Start with the most sensitive ones: Camera, Microphone, Location (especially precise location), SMS, and Call Logs. Tap a category, and you’ll see every app that can use it. For each app, ask: Does this app genuinely need this permission to work? A photo editing app needs camera access. A calculator app does not.

Step 3: Change permission usage to a safer mode.
For permissions that are legitimate but not always needed, tap the app name and change its setting. Android offers “While using the app,” “Ask every time,” or “Deny.” For location, “While in use” is usually enough. “Ask every time” adds a small inconvenience but prevents background access.

Step 4: Check individual apps’ full permission lists.
Some apps request permissions that don’t fall into the categories shown in the permission manager (e.g., storage, phone). Go to Settings > Apps > [app name] > Permissions to see the complete list. This is also where you can see which permissions have been denied or granted.

Step 5: Decide what to do with problem apps.
If an app asks for a permission that genuinely makes no sense for its function, you have three options:

  • Revoke the permission and see if the app still works. Many apps will complain but continue to function without the excess access.
  • Restrict background usage or switch to “Ask every time” if you need the permission occasionally.
  • Delete the app entirely if it refuses to work without access to data it shouldn’t need.

Five types of apps that commonly overreach:

  1. Flashlight apps – They need no permissions beyond the flashlight lamp. If one asks for location or internet, uninstall it. The system flashlight toggle in the quick settings works better.
  2. QR code scanners – Many third-party scanners request camera (understandable) but also SMS or contacts. Google Lens or the built-in scanner in your camera app is a safer choice.
  3. Keyboard apps – Third-party keyboards often request full network access, contacts, and SMS. If you don’t want your typing data or contact list sent to a remote server, consider the default keyboard or a privacy-focused replacement like AnySoftKeyboard or OpenBoard.
  4. Weather apps – They typically need location for local forecasts. But many also request camera, microphone, or storage with no clear purpose. Check if you can set a manual location instead.
  5. Social media apps – These are the heaviest data consumers by design. You can often limit background location and microphone access without breaking core functionality. Use the web version for casual browsing.

Where to find alternatives:
The F-Droid app store indexes open-source apps that are usually more transparent about data access. For popular categories like keyboards, calculators, and note-taking, you can find versions that don’t require internet access at all.

Make it a habit

A one-time audit is a good start. But apps update, permissions reset after OS updates, and new apps get installed. Set a reminder every three to six months to repeat this process. It takes thirty minutes and gives you a clearer picture of what your phone is actually doing with the data you trust it with.

Sources:

  • Android Police article “I spent a weekend reviewing Android app permissions and deleted 5 apps I thought I could trust” (June 2026)
  • Google’s discontinuation of the Play Security Reward Program (August 2024) – confirmed via Android Police report.