Product

Permission audit: what every Android permission really lets an app do

Android permissions are the honest part of any app. This page explains what each one really allows, which combinations spell monitoring, and how to check them yourself.

20 min readUpdated November 2, 2026Evidence-first
01 · Reference

Why permissions are where you start

An app can lie about its name. It can use a Google-looking icon. It can call itself "System Update". The one thing it cannot do is read your text messages without asking the operating system for READ_SMS, and that request is written into the app’s manifest where anyone with the right tool can read it.

That is what the GuestSpy permission audit does. For an APK you scan, or for the list of installed apps the GuestSpy Android app reads from the device, it takes every permission the app declares, sorts it into a risk tier, explains in one sentence what it really lets the app do, and then looks at the combinations. Because a single permission is rarely the story. The story is an app that can read your messages and your location and your call log and starts itself at boot and has no icon.

9:41
‹Permission audit
3apps with Critical tier
27Critical grants
1hidden app
C
Accessibility serviceReads every screen and keystroke
Sync Services
C
Device adminBlocks uninstall, can wipe
Sync Services
C
Background locationTracks 24/7
Sync Services, Maps
C
Read SMSAll text messages
Sync Services, Messages
H
Usage accessWhich apps you use
FamiSafe
H
Draw over appsFake screens, overlays
Sync Services
M
CameraPhotos and video
Camera, Instagram, WhatsApp
The permission audit view. Permissions grouped by tier, each with a plain-English line and the ATT&CK technique it enables. Combination rules appear beneath.
This page is the reference behind that screen. It is long because there are a lot of permissions. Skip to the table if you have a specific one in mind.

02

How the tiers work

GuestSpy groups permissions into four tiers. The tier reflects what the permission can do in the hands of someone who wants to watch you, not whether a given app is misusing it.

01

Critical

– gives direct access to your communications, your location over time, your microphone, or control over the device itself. One of these, in an app whose purpose does not obviously need it, is enough on its own to look closely.

02

High

– gives access to personal data or the ability to deceive you on screen. Often legitimate, often abused.

03

Medium

– mostly about persistence and context: starting at boot, staying alive, knowing which accounts and apps exist. Harmless alone, important in combination.

04

Low

– needed by nearly every app, or so limited that it tells you very little.

A few things in the table are not technically "permissions" in the uses-permission sense. BIND_ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN and BIND_NOTIFICATION_LISTENER_SERVICE are declared on a service or receiver, and the user has to switch them on in a special settings screen. We include them because, in practice, they are the three most powerful things an app can ask you for, and stalkerware installers walk the victim’s phone through enabling them.

03 · Reference

The permission reference

Critical

Permission Plain English ATT&CK
READ_SMS Read every text message stored on the phone, including one-time login codes and bank alerts. T1636.004 SMS Messages
RECEIVE_SMS See each text the moment it arrives, before (or instead of) your messaging app. With a high-priority receiver, the app can hide a message from you entirely. T1636.004 SMS Messages, T1582 SMS Control
READ_CALL_LOG See who you called, who called you, when and for how long. T1636.002 Call Log
PROCESS_OUTGOING_CALLS Be told the number every time you place a call, and optionally redirect or cancel it. Deprecated but still honoured on many devices. T1636.002 Call Log, T1616 Call Control
RECORD_AUDIO Turn on the microphone. Combined with a background service, this is ambient listening and call recording. T1429 Audio Capture
CAMERA Take photos and video. With SYSTEM_ALERT_WINDOW or a background service it can do so without a visible preview. T1512 Video Capture
ACCESS_FINE_LOCATION Your GPS position to within a few metres. T1430 Location Tracking
ACCESS_BACKGROUND_LOCATION Keep getting your position when the app is not open and not on screen. This is the difference between "a map app" and "a tracker". T1430 Location Tracking
BIND_ACCESSIBILITY_SERVICE Read the text of everything on screen in every app, see every tap and keystroke, and perform taps itself. Designed for screen readers. Used by stalkerware to log messages in encrypted apps and to capture passwords. T1417.001 Keylogging, T1513 Screen Capture
BIND_DEVICE_ADMIN Become a device administrator: block its own uninstall, lock the screen, wipe the phone, enforce password rules. T1626.001 Device Administrator Permissions
BIND_NOTIFICATION_LISTENER_SERVICE Read the content of every notification from every app, which on a modern phone means every incoming message, email and alert. Can also dismiss notifications so you never see them. T1517 Access Notifications

High

Permission Plain English ATT&CK
SYSTEM_ALERT_WINDOW Draw over other apps. Used for chat heads and screen filters. Also used to paint a fake login screen over a real one, or to hide a permission prompt behind a harmless-looking button. T1417.002 GUI Input Capture, T1628.003 (overlay abuse)
REQUEST_INSTALL_PACKAGES Install other apps from outside the Play Store. A dropper’s core permission: install a small app, then have it install the real payload. T1404 (exploitation) / T1577 Compromise Application Executable
READ_CONTACTS Your whole address book, with names, numbers, emails and the notes field. T1636.003 Contact List
READ_CALENDAR Every event, attendee and location in your calendar. A quiet way to know where you’ll be on Thursday. T1636.001 Calendar Entries
READ_EXTERNAL_STORAGE / READ_MEDIA_IMAGES / READ_MEDIA_VIDEO Your photos, videos and downloads. On older Android, everything on shared storage. T1533 Data from Local System
MANAGE_EXTERNAL_STORAGE "All files access". Read and write everything on shared storage, including other apps’ exported files, backups and WhatsApp media. Google restricts this heavily on the Play Store; sideloaded apps ask freely. T1533 Data from Local System
QUERY_ALL_PACKAGES See the full list of installed apps. Used by stalkerware to detect security apps and to report what you use. Restricted on Play Store since Android 11. T1418 Software Discovery
PACKAGE_USAGE_STATS Know which app is in the foreground and for how long. Enables "she opened Tinder at 11:42pm for 14 minutes" style reports. Requires a special settings toggle. T1418 Software Discovery, T1420 File and Directory Discovery
ANSWER_PHONE_CALLS Answer (or reject) incoming calls programmatically. With RECORD_AUDIO, the phone can be made to silently answer a call from the attacker and become a live microphone. T1616 Call Control
CALL_PHONE Place calls without showing the dialer. Used for premium-number fraud and for the silent call-back trick above. T1616 Call Control
WRITE_SETTINGS Change system settings: screen timeout, brightness, ringer, mobile data. Used to keep the screen off while recording and to turn data back on if you disable it. T1623 (Defense Evasion, config changes)

Medium

Permission Plain English ATT&CK
RECEIVE_BOOT_COMPLETED Start itself every time the phone turns on. Essential for anything that must survive a restart without being reopened. T1624.001 Broadcast Receivers, T1398 Boot or Logon Initialization Scripts
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS Ask to be exempt from Doze and app standby so it is never put to sleep. Legitimate for messaging and health apps; essential for a tracker that must report every few minutes. T1541 Foreground Persistence
FOREGROUND_SERVICE (+ typed variants) Run a persistent service that the system will not kill. Since Android 14 the type must be declared (location, microphone, camera, dataSync…), which tells you exactly what the service does in the background. T1541 Foreground Persistence
GET_ACCOUNTS See which accounts are on the device: your Google address, your work email, your Samsung account. Useful for identifying the victim and for targeting account takeover. T1426 System Information Discovery
READ_PHONE_STATE Phone number (on older versions), IMEI/serial (older versions), whether a call is in progress, which network you are on. Used to tag reports with a device identifier and to trigger call recording when a call starts. T1422 System Network Configuration Discovery
WAKE_LOCK Keep the CPU awake while the screen is off. Needed by anything doing work in the background, good or bad. T1541 Foreground Persistence
CHANGE_WIFI_STATE Turn Wi-Fi on or off and connect to networks. Used to force a connection for uploads. T1623 (config changes)
NEARBY_WIFI_DEVICES Scan nearby Wi-Fi networks (Android 13+). Even without GPS, a list of nearby SSIDs is a location. T1430 Location Tracking
BLUETOOTH_CONNECT / BLUETOOTH_SCAN Connect to and scan for Bluetooth devices. Nearby device lists are another location proxy and reveal who you are with. T1430 Location Tracking (indirect)
ACCESS_COARSE_LOCATION Position to within roughly a city block, from cell towers and Wi-Fi. T1430 Location Tracking

Low

Permission Plain English ATT&CK
INTERNET Talk to the network. Nearly every app has it. Without it, nothing collected could leave the phone, which is why the scanner cares about which domains it talks to rather than the permission itself. T1437.001 Web Protocols
ACCESS_NETWORK_STATE Know whether you are on Wi-Fi or mobile data. Used by trackers to wait for Wi-Fi before uploading large recordings. T1422
VIBRATE, SET_WALLPAPER, FLASHLIGHT, NFC Device features with no meaningful privacy impact on their own. –
POST_NOTIFICATIONS Show notifications (Android 13+). Notably, stalkerware tends to not want this, because it doesn’t want to be seen. –
Permissions that no longer mean what they used to

Android has tightened many of these over the years. READ_PHONE_STATE no longer reveals your IMEI on Android 10+. Background location requires a separate prompt from Android 10. SMS and call log permissions are restricted for Play Store apps unless the app is the default handler. These restrictions apply to apps from the Play Store and to prompts shown by the system. A sideloaded app on a phone where someone tapped "Allow" for everything during a five-minute setup has all of it. That is the scenario stalkerware is built for.

04

Three kinds of "allowed"

Android does not treat all permissions the same way, and knowing which kind you are looking at tells you how it got granted and how to take it back.

Install-time (normal) permissions. INTERNET, WAKE_LOCK, RECEIVE_BOOT_COMPLETED, FOREGROUND_SERVICE, VIBRATE and similar are granted automatically the moment the app is installed. Nobody tapped "Allow". That is why the Medium and Low tiers are mostly install-time: the app simply has them. You cannot revoke most of them from Settings; the only way to remove them is to remove the app.

Runtime (dangerous) permissions.

SMS, call log, contacts, calendar, location, microphone, camera, storage, phone, nearby devices, body sensors, notifications. Since Android 6, these need a prompt, and the user has to tap Allow. On recent versions, location, camera and microphone can be granted "only while using the app", and location can be approximate rather than precise. A monitoring app wants "all the time" and "precise", and the setup instructions stalkerware vendors give their customers walk through exactly those prompts on the victim’s phone. These can be revoked in Permission manager, and Android will also auto-revoke them from apps you haven’t opened in months (which, incidentally, is one reason stalkerware fakes activity).

Special app access.

Accessibility, device admin, notification access, usage access, display over other apps, install unknown apps, all-files access, battery optimisation exemption, modify system settings. Each has its own screen, its own warning text, and in some cases a deliberately awkward path (accessibility services on Android 13+ are blocked for sideloaded apps until you go through "restricted settings" on the app’s info page). These are the ones that matter most and the ones a quick glance at Permission manager will not show you. The audit lists them in their own group for that reason.

One practical consequence: if an app has BIND_ACCESSIBILITY_SERVICE granted on a phone running Android 13 or later and it was sideloaded, someone had to open its App info page, tap the three-dot menu, choose "Allow restricted settings", and then go to Accessibility and switch it on. That is not an accident. That is a procedure, and it was done by someone holding your phone.

05

A scenario, start to finish

Here is how the audit plays out in a real situation, with the kind of app that turns up.

You notice your phone is warm in your pocket and the battery is draining faster than it used to. Your partner has mentioned, twice, things you only said in messages. You open Settings > Battery and see an app called "Device Health Services" near the top of the usage list. You don’t remember installing it. There is no icon for it in the app drawer.

You scan it. The audit section shows:

Critical: READ_SMS, RECEIVE_SMS, READ_CALL_LOG, RECORD_AUDIO, ACCESS_FINE_LOCATION, ACCESS_BACKGROUND_LOCATION, plus an accessibility service and a notification listener, both granted.

High: READ_CONTACTS, SYSTEM_ALERT_WINDOW, PACKAGE_USAGE_STATS (granted), QUERY_ALL_PACKAGES.

Medium: RECEIVE_BOOT_COMPLETED, REQUEST_IGNORE_BATTERY_OPTIMIZATIONS (granted), FOREGROUND_SERVICE, GET_ACCOUNTS, READ_PHONE_STATE, WAKE_LOCK.

Combination rules: GS-R-030, GS-R-031, GS-R-033, GS-R-034, GS-R-039. Component rules: GS-R-014 hidden icon, GS-R-021 accessibility can read screen content, GS-R-023 notification listener, GS-R-011 boot start.

Grant status (from the GuestSpy app): every runtime permission allowed, location set to "All the time" and "Precise". Install source: Chrome. Install date: a Sunday six weeks ago, which you remember as the weekend your partner "fixed your phone’s storage".

Nothing in that list is ambiguous. A real "device health" service from Google would be a system app, would not be installed from Chrome, would not read SMS, and would not hide its icon. The audit tells you what the app can do (everything), how sure the scanner is (the certificate also matched a known family, so: very), and what to do about it (deactivate device admin and accessibility, then uninstall), with the safety note at the top.

What the audit does not do is tell you how to feel about it or what to do about the person. That is what the safety page and the organisations it links to are for.

06 · Safety first

Dangerous combinations: the GS-R rules

A single permission rarely tells you much. RECORD_AUDIO is in every voice-memo app. ACCESS_FINE_LOCATION is in every map and every weather app. What the scanner weighs heavily is the combinations that only make sense if the app’s purpose is to watch someone.

These are expressed as evidence rules with IDs in the format GS-R-0xx. Each one that fires appears in the report with the exact permissions and components that triggered it. Here are the main combination rules the permission audit applies.

Rule Name Triggers when
GS-R-030 Reads SMS + call log + location together READ_SMS or RECEIVE_SMS, plus READ_CALL_LOG, plus ACCESS_FINE_LOCATION or ACCESS_BACKGROUND_LOCATION. No normal app category needs all three.
GS-R-031 Records audio with background location and boot start RECORD_AUDIO + ACCESS_BACKGROUND_LOCATION + RECEIVE_BOOT_COMPLETED. A device that listens, knows where it is, and restarts itself.
GS-R-032 Silent call answer ANSWER_PHONE_CALLS + RECORD_AUDIO + READ_PHONE_STATE, without the app being a dialer. The "hot mic" pattern.
GS-R-033 Double message capture Notification listener + accessibility service. Messages are captured both from notifications and from screen text, covering apps that hide content in notifications.
GS-R-034 Persistence stack RECEIVE_BOOT_COMPLETED + REQUEST_IGNORE_BATTERY_OPTIMIZATIONS + FOREGROUND_SERVICE + WAKE_LOCK. Legitimate in messaging apps; in anything else, it means "never let me die".
GS-R-035 Install and hide REQUEST_INSTALL_PACKAGES + hidden launcher icon (GS-R-014). A dropper.
GS-R-036 High-priority SMS or call interception SMS or outgoing-call receiver with priority at or near the maximum integer. The app wants to see the message or call before anything else does, and can abort the broadcast.
GS-R-037 Overlay plus accessibility SYSTEM_ALERT_WINDOW + accessibility service. Can draw a fake screen and then tap through it on its own.
GS-R-038 Discovers security software QUERY_ALL_PACKAGES or PACKAGE_USAGE_STATS + strings naming antivirus or anti-stalkerware package names.
GS-R-039 Full-surveillance profile Five or more Critical-tier items in a single app.

Separate component rules feed into these. GS-R-014 (Hides launcher icon), GS-R-018 (Device administrator receiver), GS-R-021 (Accessibility service can read screen content), GS-R-023 (Notification listener) and GS-R-011 (Starts at boot) are all documented on the app scanner page.

The scoring is deliberately non-linear. GS-R-030 adds more severity than READ_SMS, READ_CALL_LOG and ACCESS_FINE_LOCATION would add on their own, because the combination is far more specific than any of its parts.

07

How legitimate apps differ

The same permission means different things depending on who is asking. This is the judgement the audit asks you to make, and here is how to make it.

Ask whether the permission is the product.

A messaging app’s product is messages, so READ_SMS and RECEIVE_SMS are the product. A navigation app’s product is your position, so ACCESS_FINE_LOCATION is the product and background location is defensible for turn-by-turn directions. A flashlight’s product is the LED. A flashlight that wants your SMS and your location has a second product, and you are it.

Ask whether it is visible.

Legitimate apps want to be seen. They have an icon, they post notifications, they appear in Recents. An app that hides its icon, suppresses its notifications, and names itself after a system component is optimising for not being found. The audit shows a hidden launcher icon right next to the permissions for this reason.

Ask who is on the Play Store. Google requires a declaration form and a specific use case for SMS, call log, accessibility, QUERY_ALL_PACKAGES and MANAGE_EXTERNAL_STORAGE. Many of the combinations above are simply not allowed in Play Store apps any more. If an app has them and was sideloaded, the sideloading is itself the tell. The audit shows the installer source when the GuestSpy Android app provides it.

Ask whether it needs the whole stack. A legitimate call recorder has RECORD_AUDIO, READ_PHONE_STATE and maybe an accessibility service (a common workaround for call-recording restrictions). It does not need READ_SMS, your location, a device admin receiver and a boot receiver. The stack is the signal.

Some concrete comparisons:

App type Expected Unexpected
Messaging (SMS) app READ_SMS, RECEIVE_SMS, SEND_SMS, READ_CONTACTS, notifications Location in background, RECORD_AUDIO without a voice-note feature, device admin
Navigation / maps Fine and background location, FOREGROUND_SERVICE typed location SMS, call log, accessibility service
Password manager Accessibility service (autofill on older Android), SYSTEM_ALERT_WINDOW on some SMS, location, boot start plus battery exemption
Corporate MDM agent Device admin or device owner, QUERY_ALL_PACKAGES, Wi-Fi config Hidden icon, personal SMS reading, C2 domains outside the vendor
Parental / family app (watchware) Location, usage stats, sometimes notification listener; visible icon and a clear notification Hidden icon, accessibility keylogging, silent call answer
Keyboard INTERNET for cloud suggestions (debatable), VIBRATE, READ_USER_DICTIONARY Location, SMS, accessibility service (a keyboard already sees your keystrokes; an accessibility service means it wants everything else too)
Flashlight, wallpaper, QR scanner CAMERA (QR), FLASHLIGHT Anything in the Critical tier

Watchware is a special case. Apps in the WCH class – family locators, parental controls, employee monitoring with a visible agent – are built to monitor and say so. GuestSpy labels them in purple rather than red because the technical facts are the same as stalkerware and the difference is consent. If you are an adult and did not agree to being tracked by that app, or you did agree and now want to stop, the label does not change what you should do next. Our safety page covers that.

08 · Reference

Reviewing permissions on your own phone

You do not need the scanner to see most of this. Android shows it, though the paths have moved around between versions and manufacturers. Names vary; the structure below is Pixel first, with Samsung differences noted.

Android 12 and newer: Privacy dashboard

Settings > Security & privacy > Privacy > Privacy dashboard (on Samsung: Settings > Security and privacy > Privacy > Permissions used in last 24 hours, or Permission manager).

The dashboard shows which apps used location, camera and microphone in the last 24 hours, as a timeline. This is the single most useful screen for catching a tracker, because it shows use, not just grant. An app you have never opened appearing in the location timeline at 3am is a finding.

Tap any permission to see the full list of apps that hold it. Tap an app to revoke it.

Permission manager (Android 10 and newer)

Settings > Security & privacy > Privacy > Permission manager (Samsung: Settings > Apps > three-dot menu > Permission manager; or Settings > Security and privacy > Permission manager).

This lists permissions by type: Body sensors, Calendar, Call logs, Camera, Contacts, Files, Location, Microphone, Nearby devices, Notifications, Phone, Physical activity, SMS. Open each Critical-tier one and read the "Allowed" list. Anything you don’t recognise, or that you recognise and can’t explain, is worth noting.

Per-app view

Settings > Apps > See all apps > (choose app) > Permissions. This is also where you can see "Unused app settings" and the install source ("Installed from Play Store" / "Installed from Chrome" / "Installed from Files"). The install source matters: see the previous section.

The three special-access screens

These are not in Permission manager. They have their own screens because they are powerful enough that Android makes you go and find them.

  • Accessibility: Settings > Accessibility. Scroll to Downloaded apps or Installed apps (the wording varies). Anything listed here that is not a screen reader, a password manager or an app you deliberately set up should be investigated. Tap it to see whether it is On.
  • Device admin apps: Settings > Security & privacy > More security settings (or More security & privacy) > Device admin apps. Samsung: Settings > Security and privacy > Other security settings > Device admin apps. Find My Device is normally here. Your employer’s MDM may be. "System Service" should not be.
  • Notification access: Settings > Notifications > Device & app notifications (Android 13+), or Settings > Apps > Special app access > Notification access. Samsung: Settings > Notifications > Advanced settings > Notification access. Wearable companions and some automation apps belong here. Anything else, question it.

Two more special-access screens are worth a look: Display over other apps and Install unknown apps (both under Settings > Apps > Special app access). The second one shows which apps have been allowed to sideload. If Chrome, a file manager and a messaging app are all enabled, someone used them to install something.

Usage access

Settings > Apps > Special app access > Usage access (Samsung: Settings > Security and privacy > Other security settings > Usage data access, on some versions). This is PACKAGE_USAGE_STATS. Digital Wellbeing and launchers use it. Monitoring apps use it to report what you open.

Older Android (9 and below)

Settings > Apps & notifications > App permissions (Pixel) or Settings > Apps > Permissions (Samsung). No dashboard, no timeline. Background location is not a separate grant, which means any app with location can use it in the background. The special-access screens exist but are harder to find; search Settings for "accessibility", "device admin" and "notification access".

Take screenshots as you go

If you find something, screenshot the permission screen, the accessibility screen and the app info page before you change anything. Dates and app names on those screenshots are evidence. The GuestSpy PDF report does the same job for a scanned APK.

09 · Background

What the audit screen shows, and why

When you scan an APK, the permission audit section of the deep report shows:

  1. 1

    Tier groups

    Critical at the top, each permission with its one-sentence meaning and ATT&CK technique.
  2. 2

    Combination rules

    that fired, with the exact permissions they are built from highlighted.
  3. 3

    Special-access components

    (accessibility, device admin, notification listener) pulled up from the Components section, because they belong in the same mental model.
  4. 4

    Comparison to the declared purpose

    where the app’s category can be inferred from its label and Play Store listing. This is advisory, not a verdict.
  5. 5

    Grant status

    when the scan came from the GuestSpy Android app rather than a loose APK: whether each permission is actually allowed on this device right now, not just declared. A declared-but-denied READ_SMS is a request; a granted one is a capability.
🔒 guestspy.com/scanner#report-GSR-M3K2
Known stalkerware Signing-certificate match

Sync Services v2.4.1

com.guest · APK · 4.2 MB · SHA-256 7f3a9c…e21b
96/ 100
Identity
Package
com.guest
Label
Sync Services
SDK
API 19 → API 22
Launcher icon
none
Signer
CN=Unknown, O=Unknown · RSA 2048
Valid
2015-03-02 → 2042-07-19
Permissions by tier
Critical 9High 6Medium 7Low 5
  • CREAD_SMS
  • CREAD_CALL_LOG
  • CACCESS_BACKGROUND_LOCATION
  • CRECORD_AUDIO
  • CBIND_ACCESSIBILITY_SERVICE
  • CBIND_DEVICE_ADMIN
Network indicators
  • guestspy.com known infrastructure
  • media-sync-a.thetruthspy.com known infrastructure
  • api.github.com
  • 69.64.81.166 known C2 IP
ATT&CK techniques
T1430Location TrackingT1636.004SMS MessagesT1417.001KeyloggingT1628.001Suppress App IconT1626.001Device Administrator
A flagged app's deep report, with the permission audit expanded and <code>GS-R-030</code> highlighted.
Each line can be expanded to show the raw manifest entry, so if you want to verify what the scanner is saying, the source is one tap away.

10 · Step by step

Removing a permission versus removing an app

If you find an app with a bad permission, the fastest fix is to revoke it. Android lets you do that for runtime permissions on Android 6 and above. But there are three reasons that is often not enough:

  • Special-access grants (accessibility, device admin, notification listener) are separate and must be switched off on their own screens. Device admin in particular must be deactivated before the app can be uninstalled.
  • An app with REQUEST_INSTALL_PACKAGES or dynamic code loading may re-acquire capability after you revoke it, or may have already installed a second component.
  • Revoking permissions on a monitoring app tells the person watching that something changed. The dashboard they use will show the device as "not reporting".
Removal can alert the installer

If the person who installed this is someone you are afraid of, revoking permissions or uninstalling can be noticed within minutes. Make a safety plan first. The Coalition Against Stalkerware (stopstalkerware.org) lists local support organisations. In the US, the National Domestic Violence Hotline is 1-800-799-7233. The safety page explains how to document first and remove second, and the Android removal guide walks through the actual steps.

11 · Questions

Frequently asked questions

Does an app need to be open to use a permission?

No. Once a permission is granted, an app with a background service, a boot receiver or a scheduled job can use it when the screen is off and the app is not in Recents. This is why the Medium tier matters: it is the set of permissions that let an app be alive when you are not looking at it.

My partner’s family-tracking app asks for a lot of these. Is it stalkerware?

The technical answer is that it is probably watchware (class WCH) if it is a visible, Play Store app with a clear notification. The human answer is that monitoring between adults without ongoing, freely given consent is a problem regardless of the app’s class. If you want it gone and are worried about the reaction, see the safety page first.

Can I trust the "Installed from" line?

Mostly. Android records which app performed the install. A sideloaded app will say Chrome, Files, a messaging app or "Unknown". A device-admin app or a factory-installed app can show as "System". It is good evidence but not proof on its own.

Why does the scanner list permissions the app doesn’t actually use?

The audit reads what is declared in the manifest. Developers sometimes declare permissions they no longer use, and some libraries pull in permissions the app never calls. Declared permissions are still a capability, and still appear in the system’s grant screens. Combination rules are designed to be resistant to this noise; a stray WAKE_LOCK does not make an app suspicious.

Can an app read my WhatsApp or Signal messages?

Not through SMS permissions. But an accessibility service can read the message text as it appears on screen, and a notification listener can read the message text in the notification. Both are explained above, and both are listed in the Critical tier for exactly this reason.

Run a free scan right now

Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.

Open the Web ScannerGet the app