The short answer
Permission prompts describe categories, not scope. “Allow access to photos” and “allow access to contacts” sound like comparable, bounded requests. One of them hands over a social graph including names, phone numbers, email addresses, employers and relationships for every person you know — most of whom never consented to anything.
Meanwhile, a large amount of what an app learns about you requires no permission at all, is never surfaced in a prompt, and cannot be revoked in settings.
The useful mental model: the prompts govern a specific list of sensitive resources. Everything not on that list is available by default.
What requires no permission
Both platforms allow any installed app to read, without asking:
- Device model, OS version, screen dimensions, locale, timezone and system language
- Battery level and charging state
- Network type, carrier, and whether you are on Wi-Fi or cellular
- Installed-font enumeration and other rendering characteristics
- Accelerometer, gyroscope and magnetometer readings
- Available storage and memory
- Your IP address, on every request
Individually these are innocuous. Combined, they are a device fingerprint — stable enough to recognise the same device across app installs, across resets of advertising identifiers, and often across different apps from unrelated publishers using the same analytics SDK.
The motion sensors deserve a specific mention. Accelerometer and gyroscope streams are unrestricted on both platforms and are sampled at high frequency. Published research has demonstrated gait identification, keystroke inference on soft keyboards, and device-manufacturing-imperfection fingerprinting from these streams. There is no toggle for this.
Your IP address is a location signal that survives every location permission being denied. It is typically accurate to city level, and to a much narrower area on fixed broadband.
The grants that are broader than they sound
Contacts. The most asymmetric permission on either platform. It grants the full address book: names, numbers, emails, physical addresses, birthdays, company names, relationship labels and notes. The people in it did not agree. Once uploaded, that graph is used for friend-matching, for growth features that message your contacts, and — for a financial app — for network-based risk scoring. Granting it is a decision you make on other people’s behalf.
Photos, when granted in full. Both platforms now support selecting individual photos instead, and this is the single highest-value setting change available to most people. Full library access grants every image and its metadata: GPS coordinates, capture timestamps, and device identifiers embedded in EXIF. A photo library is a location history with pictures attached. If an app needs one image for identity verification, it needs one image.
Local network, on iOS. Presented as a technical nicety about discovering devices. In practice it permits enumerating other devices on your network — useful for casting, and useful for profiling your home, employer or the café you are sitting in.
Accessibility services, on Android. Designed for genuine assistive technology, and correspondingly powerful: an accessibility service can read screen contents across all apps and inject input events. This is the single most dangerous grant on the platform and it is the standard mechanism for Android banking trojans. Legitimate uses exist, but a money app or a utility asking for accessibility access when it plainly does not need assistive functionality is a serious signal.
Notification access. Reads the content of notifications from every other app, which for banking apps frequently includes one-time codes and transaction alerts.
“Precise” versus “approximate” location. Both platforms let you downgrade this. Most apps that ask for precise location do not need it. Approximate is enough for currency selection, regional pricing and fraud signals, and it is a one-tap change.
Where the data actually goes
Most apps do not collect telemetry with code the developer wrote. They include SDKs — analytics, crash reporting, attribution, advertising, support chat — and those SDKs collect on behalf of third parties, inheriting whatever permissions the host app holds.
This matters for two reasons. The permission you granted to a bank was granted to every SDK inside it. And the privacy policy you read describes the bank’s practices, while the actual data flows are partly determined by vendors named only in a sub-processor list, if one is published at all.
Both platforms now require developers to declare data collection in the store listing — Apple’s privacy labels and Google’s Data safety section. These are self-declared and not audited. Independent analyses have repeatedly found listings that understate collection, sometimes because the developer genuinely did not know what a bundled SDK was doing. Treat them as a statement of intent. An app declaring extensive collection is being honest; one declaring none is making a claim you cannot verify from the listing alone.
A practical audit, about ten minutes
Sort permissions by app, then by permission. iOS: Settings → Privacy & Security. Android: Settings → Security & privacy → Privacy → Permission manager. The second view is the valuable one — it shows you every app holding location, or microphone, or contacts, as a single list. Most people find at least one app they had forgotten.
Revoke contacts everywhere it is not the core feature. This is usually the biggest single reduction available.
Move photo access to selected photos. Everywhere. There is almost no consumer app that legitimately needs the whole library.
Downgrade location to approximate, and to while-using. Background precise location is the highest-cost grant most people carry.
Check accessibility and notification-access lists on Android specifically. Settings → Accessibility → Downloaded apps, and the notification access list. Anything there that is not deliberately assistive should be removed today.
Use the platform activity indicators. Both systems show a dot when the camera or microphone is active, and iOS reports recent sensor and data access. If an app is reaching for something at times that make no sense, that is the evidence.
Delete rather than revoke where you can. An uninstalled app has no permissions. Revoking is a compromise for apps you still want.
What this does not fix
Permissions govern what an app reads from the device. They say nothing about what it does with data you hand over deliberately — the account you connected, the documents you uploaded, the transactions it can already see.
For a money app, that server-side question is the larger one, and it is governed by the consent you gave and the terms you accepted rather than by any toggle in settings. What you actually agree to when an app connects to your bank covers that side, and how to read a privacy policy in fifteen minutes covers finding out where it goes next.