Your phone knows where you sleep, work, shop and pray, and it shares hints of that map with more apps than you remember installing. The good news: a single focused pass through the settings — twenty minutes, once — closes most of the leaks. Here is the audit, in the order that matters.
Start with location. Open the location permissions list and set every app that does not strictly need your position to “never” or “only while using”. Weather needs your city, not your street; social apps need nothing at all. Precise-location toggles should be off for anything that merely wants a region.
The quiet trackers
Next, advertising and tracking settings. Both major platforms bury an advertising identifier and cross-app tracking controls; deny tracking requests globally where the option exists, and review which apps have accessed your photos, microphone and contacts in the past week — the permission dashboards now show this, and they are routinely surprising. Guidance from the Electronic Frontier Foundation walks through each platform’s current menus, and our how-to coverage keeps a screenshot-by-screenshot version updated.
Then the account level: review third-party apps connected to your main cloud account and revoke the ones from phones you no longer own and services you no longer use.
Make it a habit, not a project
Finish by turning on automatic security updates and checking that your photo backup is encrypted or at least account-protected by a strong password and two-factor authentication. Set a yearly reminder; permissions creep back as apps update.
Two settings most people miss
Buried in most phones are two controls worth the whole audit. The first limits ad tracking across the device’s browser as well as its apps — the web side of the profile advertisers build is often the larger half. The second is the sensor log: a record of which apps have used your camera and microphone, with timestamps, that converts suspicion into evidence in about ten seconds of reading. Owners who review it regularly describe the same experience — one app, no good reason, access revoked on the spot.
Finally, the nuclear options deserve a mention for completeness: both platforms now offer a full advertising reset and, for people facing targeted threats, lockdown modes that trade convenience for serious protection. Most of us need the twenty minutes, not the bunker — but it is good to know the bunker exists.
One more group should do this audit today rather than someday: anyone whose work makes them interesting — journalists, officials, executives, activists, and the people who love them. Targeted intrusion rarely begins with exotic hacking; it begins with a forgotten app permission, a stale connected account, a location history shared by default. Twenty minutes closes the doors that professionals actually walk through. The bunker modes exist for the exceptional cases; the audit is how ordinary people stop being the easy ones.
Privacy advice often fails by demanding a lifestyle. This asks for twenty minutes and pays out every day after — the rarest bargain in consumer technology.
