How to tell if an app is harvesting your data

By Steamboat Software · Updated September 29, 2026

The short answer. Check how the app makes money, read the store’s privacy label, question every permission it asks for, notice what it demands at sign-up, skim the privacy policy for words like “sell” and “advertising partners,” and, after installing, use your phone’s privacy report to see what it actually does.

Most apps don’t announce what they do with your information, but you can find out in a few minutes, before you install and after. Here is a practical checklist, from the quickest checks to the deeper ones.

1. Start with how the app makes money

This is the fastest signal. If an app is free and funded by advertising, the business usually depends on knowing things about you, because targeted ads pay more than untargeted ones. That doesn’t make every free app a problem, but it tells you where to look harder. Apps that earn from a paid upgrade, a subscription or an in-app purchase have less reason to profile you.

2. Read the store’s privacy label before you install

Both major app stores now show a privacy summary on the app’s listing.

Apple App Store: the “App Privacy” section lists the data an app collects and groups it under headings such as data used to track you, data linked to you, and data not linked to you. “Data Not Collected” is the one you’re hoping for.
Google Play: the “Data safety” section lists what is collected and shared, whether data is encrypted in transit, and whether you can ask for it to be deleted.

One caution: developers fill these labels in themselves. Treat them as a claim to check against the next steps, not as a guarantee.

3. Check the permissions it asks for

Ask a simple question of each permission: does the app need this to do its job? A map app needs your location. A notes app does not need your contacts. When location is requested, prefer “while using the app” over “always”, and approximate over precise if the app allows it. You can say no to a permission and see whether the app still works; a well-built app usually does.

4. Notice what it wants to sign you up

Be wary of apps that require a phone number, ask to upload your contacts, or demand more personal details than the service needs. The best sign-up asks for the least: sometimes just an email address, or only a name.

5. Skim the privacy policy for a few key phrases

You don’t have to read every word. Search the policy for these and see what surrounds them:

“sell” or “sale” of personal information
“advertising partners,” “affiliates” or “third parties” that receive your data for marketing
How long your data is kept
How to delete your account and data

A clear, short, plain-language policy is itself a good sign. Long, vague ones that leave room for almost any use are a warning.

6. After you install, check what it actually does

iPhone: in Settings, under Privacy & Security, turn on App Privacy Report. It shows which apps used your location, microphone or camera, and which web domains each app contacted.
Android: on recent versions, the Privacy dashboard in Settings shows when apps accessed your location, camera and microphone.
Tracking: when an iPhone app asks to “track your activity across other companies’ apps and websites,” you can decline, and you can turn off those requests entirely under Privacy & Security > Tracking.

Menu names change between versions, so search your phone’s settings for “privacy” if you can’t find them.

7. Make sure you can leave

An app you can’t leave is one that keeps your data. In general, both Apple and Google now require apps that let you create an account to offer a way to delete it. Look in the app’s settings for account deletion, and if there isn’t one, use the contact address in the privacy policy to request it.

Red flags at a glance

Free, ad-supported, and vague about what it collects
Permissions unrelated to what the app does
Requires your phone number or contacts to get started
“Data used to track you” on the store label
A privacy policy that mentions selling or sharing your data with advertisers
No obvious way to delete your account

What good looks like

A privacy-respecting app asks only for permissions it needs, when it needs them; has no advertising; asks for little to sign up; explains itself in plain language; and lets you delete your account. That is the standard we hold our own apps to at Steamboat Software, which we call Ultra-Private: no ads, no data harvesting, and your information is never sold.

Quick answers

Are the privacy labels on the App Store and Google Play reliable?

They’re a good starting point, but developers complete them themselves. Treat a label as a claim to check, not a guarantee.

Does a free app always collect data?

No. But many free apps are funded by advertising, which typically depends on data about their users. A free app with no ads, or one funded by paid upgrades, has less reason to.

How can I delete the data an app holds about me?

Look for an account deletion option in the app’s settings. If there isn’t one, use the contact in the privacy policy to request deletion. Apple and Google now generally require apps that let you create an account to offer a way to delete it.