Android Phone Privacy Settings: A Practical Checklist for India

A loan app you never applied for calls you by name. A "courier" knows your area. A stranger adds you to a WhatsApp group about "work from home tasks". None of that needs a hacker. It needs data, and a lot of it leaks from ordinary phones through permissions we tapped "Allow" on years ago, contacts we let apps upload, and settings that were never changed from the default.

This is a practical clean-up for an Android phone in India, with a short iPhone section at the end. The checklist takes about ten minutes and costs nothing.

Why phone privacy matters for scams

Scammers work with lists. Numbers with names, cities and the bank a person uses make every call sound more believable. That data comes from leaked app databases, contact-upload apps, and apps given far more permissions than they needed.

The second, more direct risk is an app on your phone reading your OTPs. With your OTPs, nobody needs your password. So the settings below focus on two things: what apps can see, and what can get installed.

If you think something is already wrong with your phone, start with our is my phone hacked check and come back here afterwards.

First: menu names differ on every brand

Samsung, Xiaomi/Redmi, Vivo, Oppo, Realme and OnePlus all rename and move things; "Privacy" may sit under "Security and privacy" or "Privacy protection". Instead of hunting, use the search bar at the top of Settings: type "permission manager", "unknown apps", "lock screen" or "privacy dashboard". The paths below are standard Android; your phone will have something close.

App permissions: the core of phone privacy

Open Settings → Privacy → Permission manager. Tap each permission type and look at which apps are allowed.

A simple test: would this app break without the permission? A torch app does not need contacts. A photo editor does not need location. A loan app has no good reason to read your SMS or contact list, and some predatory loan apps have used exactly that access to harass borrowers' contacts.

"Allow only while using the app"

Since Android 10, location (and later microphone and camera) can be limited to while the app is on screen. For almost every app, that is the right choice. "Allow all the time" should be rare, such as a family location-sharing app you chose on purpose.

Auto-reset for apps you don't use

Newer Android versions remove permissions from apps you haven't opened in a few months. On any app's page under Settings → Apps, look for "Remove permissions if app is unused" or "Pause app activity if unused". It is usually on by default; some apps ask you to switch it off. Leave it on.

The privacy dashboard

On Android 12 and later, most phones have a Privacy dashboard (search for it). It shows which apps used your location, camera and microphone in the last 24 hours, and when. A shopping app using your microphone at 2 am deserves a closer look. A small green dot in the screen corner also appears while the camera or microphone is in use.

Google account settings

Your Google account keeps its own record, separate from the phone. On the phone, go to Settings → Google → Manage your Google Account → Data & privacy, or open myaccount.google.com in a browser.

• Web & App Activity: what you search and do in Google apps. You can keep it on for better suggestions but set auto-delete to 3 months, or pause it.
• Timeline / Location History: where your phone has been. Google has been moving this to the device itself and renamed it Timeline, and the exact options differ by account. If you never use it, keep it off; if it's on, set auto-delete.
• YouTube History: watch and search history. Auto-delete or pause it, especially on a phone others borrow.
• Ad personalisation: in My Ad Center you can switch off personalised ads. You will still see ads, just less targeted ones.

While you're there, run Privacy Checkup and Security Checkup, which also flag unfamiliar signed-in devices.

Lock screen and screen lock

A phone without a proper screen lock gives everything away to whoever picks it up. Use a PIN of at least six digits, plus fingerprint or face unlock for convenience.

Then fix notifications. Under Settings → Notifications → Notifications on lock screen (or search "lock screen"), choose to hide sensitive content, or show notifications only when unlocked. Otherwise anyone holding your locked phone can read the OTP that just arrived, along with the first lines of your messages.

Play Protect, unknown apps and the APK trap

Two settings matter more than any security app you could buy:

1. Play Protect on. Play Store → your profile photo → Play Protect → settings (gear icon) → "Scan apps with Play Protect" switched on.
2. "Install unknown apps" off. Settings → Apps → Special app access → Install unknown apps. Every entry, especially WhatsApp, Chrome, Telegram and your file manager, should say "Not allowed".

Why a WhatsApp APK is so dangerous

An APK is an Android app file. One of the most common scams in India is an APK sent on WhatsApp disguised as something urgent: a bank KYC update, an instant loan, a wedding invitation, an RTO e-challan, a gas or electricity bill. It often comes from a contact whose phone is already infected.

Here is why it works. Once you install it, the app asks for SMS permission, notification access or Accessibility. Each one lets it see your OTPs: SMS permission reads the messages directly, notification access reads them as they pop up, and Accessibility lets it read whatever is on your screen and tap buttons for you. With your OTPs, a scammer can log into your bank, approve payments or take over WhatsApp. Newer Android versions add a "restricted setting" warning for sideloaded apps asking for these powers, but scammers often send step-by-step instructions to get past it.

The rule is short: a real bank, lender, police department or wedding invite never sends you an app file. If you want a bank's app, search for it in the Play Store yourself. Our guide to UPI, OTP and SIM-swap scams covers what to do in the first minutes if you've already tapped install.

Play Protect and the two settings above do most of the work. A reputable security app adds a second check, most useful on a phone where someone sometimes installs from links.

Caller ID and contact-upload apps

Many caller ID, "who called me" and contact-backup apps ask to upload your contact list. Some use uploaded contacts to build the directory that shows a caller's name to other users. That means the people in your phone, and the names you saved them under, can end up in a database you don't control.

Before allowing contact access, ask what the app does with that list. If it works without contacts, deny it. If you no longer use such an app, uninstall it; some services let you request removal of your own number from their directory, so check the app's privacy page.

WhatsApp privacy settings

Open WhatsApp → Settings → Privacy (WhatsApp also has a "Privacy checkup" that walks through the same items).

• Last seen and online: My contacts, or Nobody.
• Profile photo and About: My contacts. A public profile photo makes it easy for scammers to copy it for a fake account.
• Groups: My contacts, or "My contacts except…". This stops strangers adding you to investment and task-scam groups.
• Calls → Silence unknown callers: on. Calls from unknown numbers go silent and appear in your call list.
• Two-step verification: Settings → Account → Two-step verification. Set a 6-digit PIN. Even if someone tricks you out of the SMS code, they also need this PIN.
• Disappearing messages: optional. Useful for sensitive chats, but it doesn't stop screenshots or someone photographing the screen.

Also check Settings → Linked devices now and then and log out anything you don't recognise.

Instagram basics

• Private account: Settings → Account privacy. Only approved followers see your posts and stories.
• Messages: under message controls, send requests from people you don't follow to the requests folder, or don't receive them at all.
• Tags and mentions: allow from people you follow, or nobody, and turn on manual approval of tags.

Many sextortion attempts start with a friend request or DM from a stranger. If something like that has already happened, our sextortion guide explains exactly what to do.

Passwords tie it all together

Privacy settings protect the phone. Your accounts also need different passwords, because a leak on one site gets tried on every other. A password manager makes that realistic; add 2-step verification on Google, email and Instagram too.

A short iPhone section

iPhones largely avoid the APK problem, since apps normally come from the App Store, but the privacy settings still matter:

• App Privacy Report: Settings → Privacy & Security → App Privacy Report. Turn it on and it shows which apps accessed location, camera, microphone and contacts, and which domains they contacted.
• Location Services: Settings → Privacy & Security → Location Services. Set most apps to "While Using the App" or "Never", and switch off "Precise Location" for apps that don't need it.
• Tracking: Settings → Privacy & Security → Tracking. Switch off "Allow Apps to Request to Track" and apps are told no automatically.
• Lock screen: Settings → Notifications → Show Previews → When Unlocked.

The WhatsApp and Instagram settings above are the same on iPhone.

The 10-minute checklist

Use the Settings search bar for each item.

1. Screen lock: a 6-digit PIN or better, plus fingerprint or face.
2. Lock-screen notifications: hide sensitive content.
3. Permission manager: SMS and call logs only for your messaging and phone apps; location, camera and microphone on "Allow only while using the app".
4. Contacts permission: remove it from every app that doesn't need it.
5. Unused apps: auto-reset on; uninstall apps you haven't opened in months.
6. Install unknown apps: "Not allowed" for every app.
7. Play Protect: scanning on; run a scan.
8. Google account: auto-delete on for Web & App Activity, Timeline and YouTube history; review ad settings; run Privacy Checkup.
9. WhatsApp: two-step PIN, Groups = My contacts, Silence unknown callers on, Last seen and Profile photo = My contacts, check Linked devices.
10. Instagram: private account, message requests filtered, tag approval on.

Repeat it every few months. And if you find yourself opening the phone for "just a minute" and losing an hour, the settings that help with that are in our guide to stopping endless scrolling.