This guide brings together and replaces our early-2025 series of quick tips on privacy settings and app permissions, rewritten and expanded in October 2026 with current steps for iPhone, Android, Windows and Mac.
Every app you install asks for something: your location, your photos, your microphone, your contacts. Most of those requests are reasonable when you first tap Allow, but permissions pile up over months and years, and few people ever go back to check them. The good news is that every major platform now ships free, built-in tools that show you exactly what each app can reach and how often it actually uses that access.
Most people feel they have lost track. In a 2023 Pew Research Center survey, 73% of U.S. adults said they have little or no control over the data companies collect about them, and 67% said they understand little or nothing about what companies do with it. This guide walks through the settings that give some of that control back, one practical step at a time.
In this guide
- Audit app permissions on every device
- Use built-in privacy dashboards to see who is tracking you
- Read your phone's app privacy report to spot overreach
- Check what your smart speakers have recorded
- Turn on encrypted messaging in apps you already use
- Lock and encrypt sensitive notes for free
- Delete sensitive files so they stay deleted
- Where to find each setting: cross-platform table
- Quick-start checklist
- FAQ
Audit app permissions on every device
A permission is a door an app is allowed to open: the camera, the microphone, precise location, your photo library, your contacts, Bluetooth, or nearby devices. Apps need some of these to work. A video-calling app needs the camera; a map needs location. The problem is permissions that outlive their purpose, such as a flashlight app with contact access, a game that can see your precise location, or a shopping app you used once two years ago that can still read your entire photo library.
An audit takes about 15 minutes per device. The goal is not to switch everything off. It is to make each remaining permission something you would agree to again today.
iPhone
- Open Settings and tap Privacy & Security.
- Work through the list one category at a time: Location Services, Contacts, Photos, Camera, Microphone, Bluetooth and Local Network are the ones that matter most.
- Tap a category to see which apps have asked for it, then switch off any you do not recognize or no longer need.
- In Location Services, tap individual apps and prefer While Using the App or Ask Next Time over Always. Turn off Precise Location for apps that only need your general area, such as weather.
- In Photos, choose Limited Access for apps that only need to see a few pictures you pick.
Android
- Open Settings, then Security & privacy, then Privacy, then Permission manager. (Menu names vary by manufacturer. If you do not see this path, search Settings for "Permission manager".)
- Tap a permission type, such as Location, Camera or Microphone, to see which apps are allowed all the time, only while in use, or not at all.
- Change apps to Allow only while using the app or Ask every time where that makes sense.
- To review one app instead, go to Settings > Apps, pick the app (tap See all apps if needed), then open Permissions.
- On the same app screen, turn on Pause app activity if unused. Android will then remove permissions from apps you have not opened in a while.
Android also has system-wide switches. Under Settings > Security & privacy > Privacy > Privacy controls you can turn off camera access or microphone access for every app at once, which is handy before a sensitive conversation.
Windows 11
- Open Start > Settings > Privacy & security.
- Scroll to App permissions and open Location, Camera and Microphone in turn.
- Switch off access for apps that do not need it. You can also turn off the master switch for each permission if you never use it.
Microsoft notes that traditional desktop programs often do not appear in these lists. For those, check the program's own settings or uninstall what you no longer use.
Mac
- Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
- Click each category, such as Location Services, Camera, Microphone, Screen & System Audio Recording, Files & Folders and Full Disk Access, and switch off apps that do not need access.
- Pay special attention to Full Disk Access and Accessibility. Apps there can read or control far more than an ordinary app.
Common pitfalls
- Breaking an app you need. If something stops working after an audit, the app will usually ask again. Grant the narrowest option offered.
- Forgetting browser permissions. Websites can also hold camera, microphone and location access. Check your browser's site settings too.
- Doing it once. New apps and updates add new requests. Put a reminder in your calendar to repeat the audit every few months.
Use built-in privacy dashboards to see who is tracking you
Permission lists show what apps may do. Privacy dashboards show what they did, and some go further by showing what the companies behind your accounts have stored about you. There are two layers to check: the device and the account.
On the device
- Android: Open Settings, tap Security & privacy (or Privacy), and then Privacy dashboard. You may need to tap Privacy again on some phones. It shows which apps used location, camera, microphone and other permissions recently. Google's help page notes the history covers the last 7 days on Android 13 and later. Tap an app to change its access right there.
- iPhone: The equivalent is the App Privacy Report, covered in the next section. iPhone also has Safety Check at Settings > Privacy & Security > Safety Check, which lets you review everything you share with other people and apps in one place. Its Manage Sharing & Access option walks you through it person by person and app by app, and Emergency Reset stops all sharing at once if you ever feel unsafe.
- Windows 11: In Settings > Privacy & security, the Location, Camera and Microphone pages list the apps that have access. On recent Windows 11 versions, these pages also show recent activity, meaning which apps used the permission and when.
- Mac: macOS shows a colored indicator in the menu bar whenever the camera or microphone is on. Click Control Center to see which app is using it. For the full list of who has access, use System Settings > Privacy & Security as described above.
On your accounts
- Google: Run the free Privacy Checkup at myaccount.google.com/privacycheckup. It walks you through Web & App Activity, Location History settings, YouTube history and ad personalization. You can also set activity to delete automatically.
- Apple: At privacy.apple.com, you can request a copy of the data Apple holds about your Apple Account.
- Microsoft: The privacy dashboard at account.microsoft.com/privacy shows browsing, search and location activity linked to your Microsoft account and lets you clear it.
Limit ad tracking
Advertising identifiers let ad networks link your activity across different apps. Both phone platforms let you cut that link:
- iPhone: Go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. Apps then cannot ask, and they are treated as if you said no.
- Android: Search Settings for Ads and choose Delete advertising ID. According to Google, apps that then try to read the ID get a string of zeros instead.
Read your phone's app privacy report to spot overreach
The single most revealing privacy tool on an iPhone is one most people have never switched on. The App Privacy Report keeps a rolling seven-day log of which apps touched sensitive data and which internet domains they contacted. It often reveals apps checking your location far more often than you expected, or connecting to analytics and advertising companies you have never heard of.
Turn it on (iPhone)
- Open Settings and tap Privacy & Security.
- Scroll to the bottom and tap App Privacy Report.
- Tap Turn On App Privacy Report.
The report starts empty and fills in as you use your phone, so come back after a few days of normal use. Turning it off later also clears the collected data.
What to look for
- Data & Sensor Access: how often each app used location, photos, camera, microphone or contacts. An app that reads your location dozens of times a day while you barely open it is worth a closer look.
- App Network Activity: the domains each app contacted, including content embedded inside it.
- Website Network Activity: domains contacted by websites you visited inside apps.
- Most Contacted Domains: a quick way to spot tracking and analytics services that appear across many apps.
Apple notes that private browsing sessions are not included. If an app accesses data at a time or in a way you did not expect, change its permission in Settings, or check its privacy policy and the Privacy Nutrition Label on its App Store page to learn why it asks.
Android, Windows and Mac equivalents
Android does not have a domain-level report, but the Privacy dashboard described above covers the permission-usage half of the job. Both iPhone and Android also show a small green or orange indicator near the top of the screen when the camera or microphone is in use, so you can catch unexpected access as it happens. On Windows 11 and Mac, rely on the camera and microphone indicators and the recent-activity lists in privacy settings.
Pitfall: do not panic over every domain. Many are ordinary services such as content delivery networks, so focus first on apps with surprising sensor access.
Check what your smart speakers have recorded
Smart speakers listen locally for a wake word such as "Alexa" or "Hey Google," then send what follows to the company's servers. Accidental activations happen when the device mishears a TV show or a conversation, and those snippets can end up stored with everything else. Every major assistant lets you review, delete and limit these recordings. It is worth doing, especially for a speaker in a bedroom or a shared family space.
Amazon Alexa
- Open the Alexa app and find Settings, then Alexa Privacy. (The app layout changes often. If you cannot find it, search the app's settings for "privacy".)
- Open Review Voice History. Filter by date or device, play recordings back, and delete individual items or everything in a date range.
- Under Manage Your Alexa Data, choose how long voice recordings are kept. The most private choice is to not save recordings at all.
- Under the option to help improve Alexa, switch off use of your voice recordings for development if you prefer.
One 2025 change is worth knowing. As of March 28, 2025, Amazon stopped supporting an option called "Do Not Send Voice Recordings," which had let a few Echo models process requests on the device. Amazon said fewer than 0.03% of customers used it. Your voice requests now go to Amazon's cloud, but Amazon said you can still choose not to have them saved, and customers who had used the old option were moved to the "Don't save recordings" setting automatically.
Google Home and Nest (Gemini for Home)
- In the Google Home app, tap your profile picture, then Home settings. Under Home features, tap Privacy and then Home History. You can also go to myactivity.google.com/product/home in a browser.
- To delete, click Delete above your activity and choose a range, from a single item to all time.
- To set auto-delete, click the current auto-delete setting near the top and choose 3, 18 or 36 months. Google says activity older than 18 months is deleted by default.
Google's help page also says that saving your voice and audio recordings to improve Google services is off by default for Gemini for Home. Check that the "Improve Google services with your voice, audio, and Gemini Live recordings" box is unchecked if you do not want that. These options appear once your devices have been upgraded to Gemini for Home, which is rolling out gradually. Older Google Assistant activity is managed in the same My Activity area.
Apple Siri (iPhone, HomePod and Mac)
- Stop sharing audio with Apple: On iPhone, go to Settings > Privacy & Security > Analytics & Improvements and switch off Improve Siri & Dictation. On a Mac, the same switch is in System Settings > Privacy & Security > Analytics & Improvements.
- Delete history on a Mac: In System Settings, click Apple Intelligence & Siri (or Siri on older versions), then Delete Siri & Dictation History.
- Delete history on iPhone: In Settings, open the Siri section (labeled Apple Intelligence & Siri on supported models) and look for Siri & Dictation History. Apple notes that deleting history does not change your choice about sharing audio recordings, so do both.
Common pitfalls
- Forgetting the mute button. Most speakers have a physical microphone switch. Use it in rooms where you have private conversations.
Turn on encrypted messaging in apps you already use
End-to-end encryption means a message is locked on your device and can only be unlocked on the recipient's device. The company carrying it cannot read it in transit or on its servers. Ordinary SMS text messages have no such protection. The encouraging news for 2026 is that most popular messaging apps now encrypt by default, so the job is mostly checking that you are actually getting it.
Where encryption stands in 2026
| App | End-to-end encrypted by default? | What to check |
|---|---|---|
| Apple Messages (iPhone to iPhone) | Yes, for iMessage (blue bubbles) | Green bubbles were SMS or RCS. See RCS below. |
| RCS between iPhone and Android | Yes, rolling out from iOS 26.5 and current Google Messages | Look for the lock icon; depends on carrier support |
| Google Messages (Android to Android) | Yes, for RCS chats | Lock icon on the send button and next to timestamps |
| Yes, for all chats and calls | Turn on end-to-end encrypted backup separately | |
| Signal | Yes, always | Nothing to turn on |
| Facebook Messenger | Yes, for personal chats and calls since late 2023 | Group chats and business chats may differ |
| Telegram | No; only "Secret Chats" are end-to-end encrypted | Start a Secret Chat for sensitive conversations |
| SMS / MMS | No | Avoid for anything sensitive |
Sources: Google, Apple via MacRumors, Meta and Telegram documentation, checked October 2026.
iPhone
iMessage conversations between Apple devices are end-to-end encrypted automatically. For chats with Android users, Apple added end-to-end encryption for RCS in iOS 26.5, released in May 2026. According to Google and Apple, it is on by default but still labeled beta, and both people need a carrier that supports the latest RCS version. Encrypted messages show a small lock symbol. A setting for it lives in the Messages section of the Settings app. Keep your iPhone updated so you get the latest carrier support.
Android
In Google Messages, encrypted chats need both people on RCS with data or Wi-Fi. Google says you can tell a chat is encrypted when you see a lock icon on the send button while you type and next to each message timestamp. If the lock disappears, encryption has stopped, usually because one of you lost RCS and the chat fell back to SMS. Encrypted RCS with iPhone users began rolling out on May 11, 2026, and it switches on automatically over time for new and existing conversations.
WhatsApp, Signal and Messenger
- WhatsApp encrypts chats by default, but chat backups stored in iCloud or Google Drive are only end-to-end encrypted if you turn that on. Go to Settings > Chats > Chat backup > End-to-end encrypted backup and protect it with a password or a 64-digit key. Store that key somewhere safe, because you need it to restore.
- Signal is encrypted for every message and call with nothing to configure. It is a good choice when you want certainty.
- Messenger: personal chats and calls became end-to-end encrypted by default from December 2023.
Windows and Mac
Desktop apps for Signal, WhatsApp and Messages on Mac use the same encryption as the phone apps. The weak point is the computer itself, so turn on disk encryption (see the file deletion section) and unlink desktop sessions you no longer use.
Common pitfalls
- Unencrypted backups. A perfectly encrypted chat can be exposed by an unencrypted cloud backup. On iPhone, Advanced Data Protection (Settings > [your name] > iCloud > Advanced Data Protection) extends end-to-end encryption to iCloud Backup, Photos, Notes and more. It requires two-factor authentication and a recovery method you must not lose, and it is not offered in every country.
Lock and encrypt sensitive notes for free
Notes apps tend to collect things that should not sit in plain text: door codes, Wi-Fi passwords, ID numbers, medical details, private journal entries. You do not need a paid app to protect them. The best free option is usually a password manager's secure notes feature, since many password managers include one. Built-in notes locks are a good second choice.
iPhone and iPad (Apple Notes)
- Go to Settings > Apps > Notes > Password.
- Choose Use Device Passcode (this requires iCloud Keychain), or create a separate Notes password with a hint. Turn on Face ID or Touch ID for convenience.
- Open a note, tap the More button, and tap Lock.
Locked notes reopen with Face ID, Touch ID or your password, and they lock again when you close Notes or the phone sleeps. Know the limits before you rely on this. According to Apple, you cannot lock notes with tags, PDFs, audio, video or iWork documents, notes synced via Gmail or other IMAP accounts, or shared notes. And if you forget a separate Notes password, Apple cannot recover those notes.
Mac (Apple Notes)
- Open Notes and select the note.
- Click the More button near the search field and choose Lock Note.
- Enter your password, or use Touch ID if it is turned on for Notes. You are asked to create a password the first time.
Android
Google Keep has no lock for individual notes, so Android users have three practical options:
- Private space (Android 15 and later): go to Settings > Security & privacy > Private space, tap Set up, and choose Use separate lock. Install a notes app inside it. Its contents stay hidden and locked behind a separate PIN, pattern or fingerprint.
- Manufacturer tools: Samsung phones include Secure Folder, and Samsung Notes can lock notes. Look in the app's note menu.
- A password manager's secure notes, which also sync to your other devices.
Windows
Sticky Notes and plain text files are not encrypted. OneNote for Windows can password-protect a whole section: right-click the section tab and choose the password protection option, then set a password. Treat that password as unrecoverable and store it in your password manager. For anything critical, a password manager's secure notes are the simpler choice.
Pitfall: copies of the same details in email drafts or screenshots defeat the purpose, so delete them once the locked version exists.
Delete sensitive files so they stay deleted
Deleting a file and emptying the Trash or Recycle Bin usually just tells the system that the space can be reused. On an old spinning hard drive, recovery tools can often bring that data back until something overwrites it. Modern devices are better: SSDs clean up freed space automatically, and phones encrypt storage by default. Even so, the reliable way to make deleted data unreadable is full-disk encryption plus a proper reset before a device leaves your hands. Third-party "file shredder" tools are rarely needed on modern hardware.
Step 1: Make sure your storage is encrypted
- iPhone: Encrypted automatically whenever a passcode is set. Make sure you have one.
- Android: Current Android phones encrypt storage by default. Set a screen lock so the encryption is tied to your PIN, pattern or password.
- Windows 11: Go to Settings > Privacy & security > Device encryption and turn it on. If that page is missing, your device may not support it. On Pro, Enterprise or Education editions, use BitLocker instead. Microsoft notes Device Encryption turns on automatically during setup only when you sign in with a Microsoft account, which also stores the recovery key there. Know where that key is.
- Mac: Go to System Settings > Privacy & Security and confirm FileVault is on.
Step 2: Automate the trash
- Windows 11: Go to Start > Settings > System > Storage, turn on Storage Sense, open it, and set "Delete files in my recycle bin if they have been there for over" to a period you are comfortable with.
- Mac: In Finder settings, under Advanced, you can turn on the option to remove items from the Trash after 30 days.
- Phones: Photos apps keep a "Recently Deleted" or "Trash" album for about 30 days. Empty it manually after deleting something sensitive.
Step 3: Wipe properly before selling, donating or passing on a device
- iPhone: Back up first. Then go to Settings > [your name] > Sign Out, return to Settings > General > Transfer or Reset iPhone, and tap Erase All Content and Settings.
- Android: Back up, note your Google Account and its password, and know your screen lock. Then use the factory reset option in Settings. Google suggests checking your manufacturer's instructions for the exact location. Charge to at least 70% first.
- Windows 11: Go to Settings > System > Recovery > Reset this PC, choose Remove everything, and in the additional settings turn on the option to clean the drive. It takes longer, but it makes recovery far harder.
- Mac (Apple silicon or T2 chip): Go to System Settings > General > Transfer or Reset > Erase All Content and Settings.
Common pitfalls
- Forgetting the cloud. Erasing a device does not delete its iCloud, Google or OneDrive copies. Delete sensitive files there too, and empty the cloud trash.
- Old USB drives and SD cards. These are often not encrypted. Reformat them, or physically destroy cheap ones that held sensitive data.
Where to find each setting: cross-platform table
Menu names shift slightly between versions and manufacturers. If a path does not match your device, type the setting name into the search box at the top of Settings.
| Task | iPhone | Android | Windows 11 | Mac |
|---|---|---|---|---|
| Review permissions | Settings > Privacy & Security | Settings > Security & privacy > Privacy > Permission manager | Settings > Privacy & security > App permissions | System Settings > Privacy & Security |
| See recent access | Privacy & Security > App Privacy Report | Security & privacy > Privacy dashboard | Location, Camera or Microphone pages in Privacy & security | Menu bar camera and mic indicator |
| Limit ad tracking | Privacy & Security > Tracking | Search Settings for "Ads" | Privacy & security > General | System Settings > Privacy & Security > Apple Advertising |
| Lock notes | Settings > Apps > Notes > Password | Private space or a password manager | OneNote section password | Notes > More > Lock Note |
| Encrypt storage | On with a passcode | On by default with a screen lock | Privacy & security > Device encryption | FileVault in Privacy & Security |
| Wipe device | General > Transfer or Reset iPhone | Factory reset in Settings | System > Recovery > Reset this PC | General > Transfer or Reset |
Paths checked against Apple, Google and Microsoft help pages for iOS 26, Android 16, Windows 11 and macOS 26 in October 2026.
Quick-start checklist
If you only have a weekend, do these in order. The first three give the biggest privacy gain for the least effort.
| Priority | Task | Time needed | Impact |
|---|---|---|---|
| 1 | Run a permission audit on your phone (location, microphone, camera, photos) | 15 min | High |
| 2 | Turn on the App Privacy Report (iPhone) or open the Privacy dashboard (Android) | 2 min, then check back in a few days | High |
| 3 | Confirm disk encryption on your computer and save the recovery key | 10 min | High |
| 4 | Turn off app tracking requests or delete your Android advertising ID | 1 min | Medium |
| 5 | Review and delete smart speaker recordings; set auto-delete | 10 min | Medium |
| 6 | Turn on WhatsApp encrypted backup and check for lock icons in Messages | 5 min | Medium |
| 7 | Move sensitive notes into a locked note or a password manager | 20 min | Medium |
| 8 | Turn on Storage Sense or automatic Trash emptying | 3 min | Low |
| 9 | Run Google Privacy Checkup and review your Microsoft privacy dashboard | 15 min | Medium |
FAQ
Is my phone listening to my conversations to show me ads?
Both Apple and Android show an indicator whenever an app uses the microphone, and the privacy dashboards and reports in this guide log that access. Most "creepy" ad matches come from location, browsing, purchase and contact data rather than from audio. If you are worried, check which apps have microphone permission and remove it from any that do not need it.
Will turning off permissions break my apps?
Sometimes a feature stops working, such as photo upload without photo access. The app will usually ask again when it needs the permission, so you can grant it then, ideally with the narrowest option such as "While using the app" or limited photo access.
Are green-bubble texts between iPhone and Android private now?
Increasingly, yes. Since May 2026, RCS chats between iOS 26.5 and current Google Messages can be end-to-end encrypted by default, as long as both carriers support it. Look for the lock icon. If you do not see it, treat the chat as unencrypted and use Signal or WhatsApp for sensitive topics.
Do I need a file shredder app?
For most people, no. On a modern SSD or phone with encryption turned on, a factory reset or a cleaning reset makes old data practically unrecoverable. Shredder tools were designed for spinning hard drives and are much less effective on SSDs.
How often should I repeat these checks?
A quick permission and dashboard review every three months is a good habit, plus a check after installing new apps or a major system update.
Sources
- Pew Research Center: How Americans View Data Privacy (2023)
- Apple: About App Privacy Report
- Apple: How Safety Check works
- Apple: If an app asks to track your activity
- Apple: Turn Improve Siri & Dictation on or off
- Apple: Delete Siri and Dictation history on Mac
- Apple: Control access to the camera on Mac
- Apple: Lock or unlock notes on iPhone or iPad
- Apple: Lock your notes on Mac
- Apple: Turn on Advanced Data Protection for iCloud
- Apple: Erase your Mac
- Apple: What to do before you sell or give away your iPhone
- Google: Change app permissions on your Android phone
- Google: Manage permissions from the privacy dashboard
- Google Play: Advertising ID
- Android: How to set up Private space
- Google: Manage and delete your Gemini for Home activity
- Google: End-to-end encryption in Google Messages
- Google: End-to-end encrypted RCS messaging for Android and iPhone
- Google: Reset your Android device to factory settings
- MacRumors: iOS 26.5 brings end-to-end encryption to iPhone-Android RCS
- Microsoft: App permissions in Windows
- Microsoft: Device encryption in Windows
- Microsoft: Manage drive space with Storage Sense
- Meta: Launching default end-to-end encryption on Messenger
- WhatsApp: About end-to-end encrypted backup
- Telegram FAQ: encryption and Secret Chats
- TechCrunch: Amazon Echo to send voice recordings to the cloud (March 2025)
- AP via NY1: Amazon ends Echo privacy feature
Top image: "CGI webcam cover, Oude Pekela (2020) 06" by Donald Trung Quoc Don, CC BY-SA 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
){kind=link}
0 Comments