Mobile Privacy: Permissions, Location and Official App Stores — Cybersecurity Basics: Protect Yourself and Understand the Threats

Your smartphone knows where you sleep, who you talk to, what you buy and sometimes how you feel. It is the most personal computer you own, and its apps are constantly asking for access to it. In this lesson you will learn to read permission requests like a security professional, take back control of your location, and choose where to download apps safely.

We have secured the lock screen and the backups. Now we look at what happens inside the phone: the apps you install, and what they can see.

What a phone knows about you

Over the course of a normal day a phone collects a remarkable amount of data: your location history, contacts, calendar, photos, microphone and camera access, browsing, health and activity data, and a list of the apps you use and how long you use them. Some of this is necessary for the app to work. A lot of it is not.

A good question to ask about any app is: "Does it really need this to do its job?" A flashlight app does not need your contacts. A map app needs your location, but only when you are using it for navigation.

Permissions: how to decide

Modern mobile systems use a permission system. When an app first wants to use a sensitive feature, you get a pop-up. You will usually see choices such as "Allow while using the app", "Allow this time", "Always allow" and "Don't allow". Here is a practical approach:

Location: choose "while using the app" or "this time". Choose "always" only for something that genuinely requires background tracking, such as a family safety feature you set up deliberately. If the system offers an "approximate location" option, use it for apps like weather or news.
Camera and microphone: grant them only to apps that clearly need them, such as messaging or video calls, and only while in use. Watch the indicator that most modern systems display when they are active.
Contacts: be careful. Giving an app your address book also gives away the data of every person in it, who did not consent.
Photos: choose "selected photos" instead of the whole library when it is offered.
Notifications: harmless in themselves, but a way for apps to push you into returning, and a channel for scam messages. Allow them selectively.
Special access such as "accessibility services", "device administrator", "display over other apps" or "install unknown apps": these are powerful. Malicious apps use them to read your screen, capture codes or hide. Grant them only to well-known apps for which you understand the purpose.

Tip: an app that refuses to work without a permission that makes no sense for its purpose is a red flag. You can often find a better alternative.

Your permission checkup

Both main mobile systems have a "privacy" section in their settings, with a view by permission (for example "which apps can use the microphone?") and a view by app. Spend fifteen minutes with it:

Go through location, microphone, camera, contacts and photos, one at a time.
Switch off anything that does not make sense.
Review apps with "always" access to location, and change them to "while using".
Look at the list of apps with special access, and remove any you do not recognize.
Uninstall apps you have not used in months. Many systems offer to revoke the permissions of unused apps automatically; turn this on.

Location: your movements are a profile

Location history reveals your home, workplace, habits, health appointments and relationships. Attackers and stalkers can use it, as can advertisers and data brokers. Beyond permissions:

Check the location history feature in your account settings, and decide whether you want it on. You can often limit it or delete it automatically after a period.
Be careful with photo location metadata. Photos can carry GPS coordinates, and some apps remove them while others do not. Before posting a photo taken at home, consider whether the exact location is revealed.
Look at what your shared locations are: some apps let friends or family see your position live. Share deliberately and review who can see it.
Switch off Wi-Fi and Bluetooth scanning when not needed, if your phone offers this, since they can contribute to tracking.

Warning: if you are in a relationship or situation where someone else may monitor you, for example through shared accounts, a partner's access to your phone or stalkerware, check the list of installed apps, the device administrators and the location sharing. Support organizations and the platform cybermalveillance.gouv.fr can help. If you fear for your safety, contact the competent local authorities or support services first.

Official app stores: why they matter

The main mobile systems each operate an official store that reviews apps, scans them for known malware and can remove dangerous ones. This is not perfect, as malicious apps occasionally pass the checks, but it is much safer than the alternatives.

Install apps only from the official store of your system. Avoid downloading installation files from websites, links in messages or alternative stores.
Be wary of "install unknown apps" settings. Keep this setting off, and if you ever need it for one particular app, switch it off again immediately.
Check the publisher: the name of the developer should match the company you expect. Lookalike apps with names almost identical to popular ones exist.
Read the reviews, the number of downloads and the permissions list before installing. Many new apps with few reviews and a long list of permissions deserve suspicion.
For banking and other sensitive services, use the link from the organization's official website to reach the genuine app.

Beware also of free apps paid for with your data. When a service is free, check how it earns money. Advertising and data collection are often the answer, and a privacy label in the store gives you a summary of what the app collects.

Other good habits for your phone

Do not jailbreak or "root" your phone: it removes built-in protections.
Keep the system and the apps updated, as in lesson 3.1.
Be careful with public USB charging ports and cables of unknown origin. A charge-only cable or your own charger is safer.
Review your accounts' connected apps: services you gave access to through a "sign in with..." button can keep that access long after you stopped using them.
Protect your SIM with a PIN, and ask your operator about extra protection against number transfer, which is the SIM swapping attack mentioned in lesson 2.3.

Your turn

Exercise. Do a permission cleanup. List the five apps you use most, then for each decide which permissions they truly need. Compare with their current settings and fix the differences.

See a solution

An example of reasonable choices:

Messaging app: contacts (to find friends), notifications, camera and microphone (while in use). Not location, unless you share it on purpose.
Maps app: location while in use. Background location only if you actively use a feature such as timeline.
Social network: photos (selected), notifications. Question the need for location, contacts, microphone.
Shopping or delivery app: location while using (for delivery); notifications selectively; nothing else.
A game: usually nothing at all. If it asks for contacts or microphone, uninstall it.

Anything granted that you cannot justify should be switched off. Check that the app still works. If it breaks without a permission it should not need, consider replacing it.

Add to your Security Notebook

Under "3. Devices", add "Mobile": the permission rules you adopt (for example: location only while in use; never grant accessibility access), the date of your next checkup, and a note to keep "install unknown apps" off.

Key takeaways

For every permission, ask whether the app really needs it for its job; prefer "while using" for location and "selected photos" for pictures.
Special accesses such as accessibility or device administrator are powerful and should be rare.
Your location history reveals your habits, so review it and be careful with photo metadata and shared locations.
Install apps from the official store only, check the publisher, and keep "unknown apps" disabled.

Your devices are now protected. The next chapter follows your traffic out onto the internet: browsing, Wi-Fi, email and social media.