Decision sheet — Android & iPhone
Audit a tracking app on your phone
Audit in three lists, not one. First, which apps hold location and other sensitive permissions — Android's Permission manager and iPhone's Privacy & Security show that. Second, which apps actually used those permissions recently — Android's privacy dashboard and iPhone's App Privacy Report show that. Third, who can see the output and what is stored — that lives inside each service and in its privacy policy, not in the phone's settings. Finish by removing anything you no longer need.
- Read8–10 min read
- You needThe phone in your hand, unlocked, and 20 minutes
- Works onAndroid 12 and later (privacy dashboard) · iOS 15.2 and later (App Privacy Report) · iOS 16 and later (Safety Check)
Verified: October 2026 against Google Android Help, Google Play Help, Apple Support and the FTC.
A useful audit joins three questions: which app has access, what data it collects, and who can see the output. The phone's settings answer the first fully and the second partly; the third is answered only by the service itself.
The audit, step by step
- List apps by permission. On Android: Settings › Security & Privacy › Privacy › Permission manager, then tap Location, Microphone, Camera, Contacts, SMS and Call logs in turn. On iPhone: Settings › Privacy & Security, then tap Location Services, Microphone, Camera, Contacts and the other categories. Note every app you do not recognise or no longer use.
- Check recent use, not just permission. Android's privacy dashboard shows which apps accessed a permission and when — 7 days on Android 13, 24 hours on Android 12. On iPhone, turn on App Privacy Report; it shows 7 days of data and sensor access plus the web domains each app contacted, but only from the moment you enable it.
- Read what the developer says it collects. On Google Play, open the app's listing and look at Data safety; on iPhone, read the app's privacy label and policy. These are the developer's own statements, so treat them as claims to compare with what you saw in step 2.
- Check the people list inside each service. A system permission is not a list of viewers. Open each location-sharing or family app and see who can view your location. On iPhone with iOS 16 or later, Safety Check › Manage Sharing & Access reviews people and apps in one pass.
- Check devices linked to your account. In Find My on iPhone, the Devices tab lists everything tied to your Apple Account; Apple's checklist explains how to remove a device you don't recognise.
- Remove what you do not need, then write the date. Lower or revoke each permission that is broader than the task, delete apps you no longer use, and note the date of the audit so the next one is a quick comparison.
What did the audit turn up?
Pick the result that matches what you found.
A clean audit.
Each app holding location or other sensitive permissions is one you installed for a reason you can still name.
Do this: Lower anything broader than its task, write the date, and repeat in a few months.
Old access, still live.
Permissions stay until changed. On Android, “Pause app activity if unused” can revoke them automatically; Apple's help does not describe automatic removal for unused apps, so change them in Settings or delete the app.
Do this: Revoke or delete; there is no reason to keep access for an app you do not use.
The report shows access you did not expect.
Apple's guidance says that if an app appears to access data in a way or at a time you didn't expect, you can update your privacy settings or revoke permission.
Do this: Revoke the permission, then read the app's policy or contact its developer.
Treat it carefully.
The FTC lists signs worth noticing: battery draining faster than usual, unexpected data use, overheating, or the phone turning off and on. It also warns that removing monitoring software could alert the person who installed it.
Do this: If your safety may be at risk, read the next guide and plan with an advocate before removing anything.
This is a sharing problem, not a permission problem.
Location sharing lists live inside each service. On iPhone, Safety Check lets you review who has access to your information, including your location.
Do this: Stop sharing with that person in the service itself.
Edge cases — what an audit cannot see
- The report starts when you turn it on
- App Privacy Report gathers information only after you enable it and keeps 7 days. It cannot show what an app did last month.
- Android has no domain report
- Android's privacy dashboard shows permission use and timing. Google's help does not describe an equivalent of Apple's per-app list of contacted web domains.
- Labels are the developer's word
- Google says individual developers are responsible for the accuracy of their stated data-sharing practices, and that a missing notice does not mean an app doesn't share location data.
- Data safety covers Google Play only
- The Data safety section applies only to apps distributed on Google Play. Apps from other stores, or preloaded by the maker, may not have it.
- Devices and accessories, not just apps
- Apple's checklist points out that Find My lists the devices and accessories available to anyone who has access to your Apple Account. A clean app list does not cover that; review Find My › Devices as a separate step.
- Deleting an app is not deleting the data
- On iPhone, deleting an app removes it and its data from the phone, but data the app stored in iCloud isn't deleted. Data held on the provider's servers needs a separate request.
Where each list lives
| Android | iPhone | Inside the service | |
|---|---|---|---|
| Which apps hold a permission | Permission manager | Settings › Privacy & Security | — |
| Which apps used it recently | Privacy dashboard (7 days on Android 13) | App Privacy Report (7 days, after you enable it) | — |
| Which web domains apps contacted | The official help does not describe this | App Privacy Report › Network Activity | — |
| What the app says it collects | Google Play › Data safety | App privacy label and policy | Privacy policy |
| Who can see your location | — | Safety Check (iOS 16+) | The service's sharing or family list |
| How to delete stored data | — | — | In-app deletion path or the developer |
Keep three lists, not one
Apps with access
Record which app can use location and whether it has background access, plus microphone, camera, contacts and SMS.
People and links
Inspect the service's recipient list; a system permission is not a list of viewers.
Stored data
Check retention and deletion separately from stopping the next update. Google Play requires apps that let you create an account to offer an in-app path and a web link to delete it.
An audit only works on a phone you hold and can unlock — nobody can audit a phone's permissions from outside it. One of the FTC's warning signs is someone having had access to your phone unsupervised; Apple's and Google's help describes no way to put an app on a phone from a phone number or a link to a lookup site.
Official sources (checked October 2026)
Questions people ask
What is the fastest way to see every app with location access?
On Android, Settings › Location › App location permissions, or Permission manager › Location. On iPhone, Settings › Privacy & Security › Location Services.
How often should I repeat the audit?
Neither Apple nor Google sets a schedule. A practical rhythm is to repeat it when you install a new location app, when a sharing arrangement changes, or after a major system update, and compare against the dated notes from last time.
Why does App Privacy Report look empty?
It gathers information only after you enable it, so details appear as you keep using your apps. Earlier activity is not recorded.
Is the Google Play Data safety section reliable?
It is the developer's own description. Google says developers are responsible for its accuracy and may update it at any time, so compare it with what the privacy dashboard shows.
A location app shows people I don't know. What now?
That is a sharing list inside the service, not a phone permission. Stop sharing with them in the app; on iPhone with iOS 16 or later, Safety Check can review people and apps for you.
Which FTC warning signs should I note down during an audit?
The FTC lists battery draining faster than usual, unexpectedly using more data, overheating, and the phone turning off and on unexpectedly, plus whether someone had access to your phone without your supervision. Note them with dates; if any apply and your safety may be at risk, read the next guide before removing anything.
What does Google Play's Data deletion section tell me?
For apps that let you create an account, Google Play requires an in-app path to delete the account and its data, and a web link where you can request deletion. The section tells you where to find those routes; the request itself happens in the app or on that page.