App Permissions and Tracking

Build the mental model

Every app requests permissions on install: camera, microphone, photos, contacts, location, files, Bluetooth, notifications. A permission should map to the app's actual stated purpose.

A maps app asking for location makes sense. A flashlight app asking for location, contacts, or microphone does not — that mismatch is worth questioning, not assuming malice.

Tracking technologies — cookies, device identifiers, analytics, advertising identifiers — let a company understand how their product is used.

• Account visibility settings
• Ad and privacy controls
• Each installed app's actual permissions
• Location sharing still turned on for apps that no longer need it
• Connected third-party applications
• Devices and sessions still logged in

This doesn't need to happen daily. A calm, occasional pass — every few months, or after installing something new — catches what quietly outlived its purpose.

PERMISSION VS STATED PURPOSE
----------------------------
App: Flashlight          Requests: camera, location, contacts
Stated purpose: light the camera flash
  camera    -> MATCH    (needed to control the flash)
  location  -> MISMATCH (not needed for a flashlight)
  contacts  -> MISMATCH (not needed for a flashlight)

App: Maps                Requests: location
Stated purpose: show maps and directions
  location  -> MATCH    (core to the app's purpose)

Connect it to a real scenario

The function below runs the "does this permission match the purpose" check across a whole list of apps at once, using a small lookup table of expected permissions per category.

For each app, anything requested that doesn't belong to its category's expected list is collected into mismatchedPermissions, and the app is flagged REVIEW with exactly what triggered it.

Running a check like this across every installed app turns a vague sense of "I should review permissions sometime" into a specific list of what to check first.

• A permission should map to the app's actual stated purpose — mismatches are worth questioning, not automatically assuming malice.
• Not all tracking or analytics is malicious — legitimate product analytics can genuinely benefit users too; the goal is awareness, not blanket rejection.
• Review privacy settings periodically: permissions, connected apps, account visibility, active sessions, and location sharing.

Privacy Settings Review

• App permissions reviewed against the app's actual stated purpose.
• Unused connected apps/integrations removed from the main account.
• Account visibility settings reviewed.
• Active login sessions reviewed periodically and unfamiliar ones revoked.
• Location sharing reviewed and turned off where it's no longer needed.

Try the working example

function reviewAppPermissions(apps) {
  const purposeToExpectedPermissions = {
    flashlight: ["camera"],
    maps: ["location"],
    messaging: ["contacts", "notifications", "microphone", "camera"],
    photoEditor: ["photos", "camera"],
  };

  return apps.map((app) => {
    const expected = purposeToExpectedPermissions[app.purposeCategory] || [];
    const mismatches = app.requestedPermissions.filter((p) => !expected.includes(p));
    return {
      name: app.name,
      requestedPermissions: app.requestedPermissions,
      mismatchedPermissions: mismatches,
      flag: mismatches.length > 0 ? "REVIEW — permission does not match stated purpose" : "OK",
    };
  });
}

const apps = [
  { name: "BrightTorch", purposeCategory: "flashlight", requestedPermissions: ["camera", "location", "contacts"] },
  { name: "TrailMaps", purposeCategory: "maps", requestedPermissions: ["location"] },
];

console.log(JSON.stringify(reviewAppPermissions(apps), null, 2));

[
  {
    "name": "BrightTorch",
    "requestedPermissions": [
      "camera",
      "location",
      "contacts"
    ],
    "mismatchedPermissions": [
      "location",
      "contacts"
    ],
    "flag": "REVIEW — permission does not match stated purpose"
  },
  {
    "name": "TrailMaps",
    "requestedPermissions": [
      "location"
    ],
    "mismatchedPermissions": [],
    "flag": "OK"
  }
]

EFF Surveillance Self-Defense — Digital Privacy & Modern Security