How apps get access
When you click a button such as “Continue with” a social network, or when a game or tool asks to connect to your profile, you are usually granting that outside service a limited form of access. You normally do this without sharing your password. Instead, the platform issues the app a permission, sometimes described as a token, that lets it see certain information or perform certain actions on your behalf.
That is convenient and often safer than creating yet another password. The catch is that the permission can last long after you stop using the app. Most people accumulate a long list of connections over the years: games, quiz sites, scheduling tools, photo printers, analytics dashboards, and apps that no longer exist.
What access can include
The exact options differ by platform, but permissions often fall into categories like these:
- Basic profile information, such as your name and profile picture.
- Email address or phone number.
- Friends or follower lists.
- Posts, photos and videos, in some cases including private ones.
- The ability to post on your behalf.
- Messages or contacts, which is less common and more sensitive.
- Ongoing access even when you are not using the app.
A connected app only gets what you approve at the time, but it may keep it until you remove it. An app that was fine when you installed it might later be sold, changed or taken over by a different owner, or it might be poorly secured. If that app is breached, whatever it can access may be exposed too.
Why it is worth reviewing
Reasons to look at your list include:
- Reducing the amount of personal data held by outside companies.
- Removing access for services you have forgotten, which is one of the easiest ways to shrink your digital footprint.
- Spotting apps you do not recognize, which can be a sign that something is wrong. Unrecognized posts, or messages sent in your name, are listed among the account takeover signs.
- Cutting off access when a service you used has had a data problem.
How to review the list
Menu names change, so look in your platform’s settings for sections called something like “apps and websites,” “connected apps,” “security,” “authorized apps” or “linked accounts.” Some platforms also place a list in the privacy or password area.
For each entry, ask:
- Do I still use this? If not, remove it.
- Do I recognize it? If not, remove it and consider changing your password.
- What can it access? If the permissions seem to go beyond what the app needs, such as a calculator wanting your contacts, this is a reason to revoke access. The same reasoning applies to app permissions on your phone.
- When did I last use it? Some platforms show the date of last activity.
- Is it from an official source? Be wary of apps whose names resemble well-known brands. Look-alike tools are one form of fake mobile apps.
Removing an app from the list usually stops its access going forward. It may not delete information the app already collected. To ask for that, you generally have to contact the app’s developer or use any privacy request option on its own site. Keep that in mind if the app was one you did not trust.
What happens when you remove one
If you used a social account to sign in to a service, removing the connection may lock you out of that service, and you could lose saved progress or purchases. Before you cut the link:
- Check whether the service lets you add a separate email and password, or another sign-in method, to the same account.
- Export anything you need from the service.
- If you are not sure, leave the connection for now and revisit it after you have set up an alternative.
This is a good time to confirm that your recovery options are set up, since people sometimes find they depended on a social login to get into other accounts.
Habits that help going forward
- Connect sparingly. Before choosing “continue with,” consider whether creating a separate login with a unique password and a password manager would be better for a service you do not fully trust. Using separate accounts also helps avoid password reuse.
- Read the permission screen. The few seconds it takes can show if an app wants more than it should. If a request is surprising, decline.
- Prefer apps from known sources. Install from official stores and check developer details.
- Turn on two-step sign-in on the main social account, so that an outside breach does not by itself open the profile.
- Schedule a review. Once or twice a year, or after you try a series of new apps, go through the list.
- Be wary of requests that arrive by message. A link claiming you must authorize an app to avoid losing your account is a common trick. Genuine platforms are unlikely to ask you to approve unknown apps through a message. See phishing messages for related warning signs.
When something looks wrong
If you see an app you never approved, remove it immediately, change your password, sign out of other sessions, and check recent activity. If your account has been used to post or message without your knowledge, follow the steps in hacked account response, and consider warning friends. Results vary by platform, and not every case can be reversed, but removing unneeded access is a low-effort step that reduces your exposure.