Is this app safe? The risks of giving apps your data, and how to check

How to check if an app is safe, in 5 minutes

You don't need to know how to code. You need to look at 5 things, ideally before you install.

1. The privacy labelOn the app's page, scroll down to the privacy section. In the App Store, read "Data Used to Track You" first: if it's empty, all the better. In Google Play, the section is called "Data safety".
2. The permissions it asks forA flashlight doesn't need your contacts. If the request has nothing to do with what the app does, say no.
3. The privacy policyLook for who is responsible, what they use the data for, who they pass it to and which countries it ends up in. Swiss law requires them to say this.
4. Where the data is keptOn your device, in your cloud or on the company's servers? Encrypted? And who has the key?
5. After you install, the reportYour iPhone shows what the app used in the last 7 days and which domains it talked to. On Android, the Privacy dashboard shows when it used your location, camera and microphone. Compare it with the label.

The label is filled in by the developer, in the App Store and in Google Play. It's a good start, but it isn't proof. The report in step 5 is what shows what the app actually does.

What apps collect

Some of these things are needed for the app to work. Others aren't. The question to ask is always the same: does the app need this to do what I'm asking it to do?

• Your locationYour precise location tells where you live and where you work. For the weather or a shop near you, the approximate one is enough.
• Your contactsThis is other people's data, and they gave no permission at all.
• Your photosAnd what's inside them: if the Camera has access to your location, each photo stores the place where it was taken. Whoever receives the photo can see it.
• The advertising identifierA number on your phone that lets what you do in different apps and websites be linked together.
• What you type and sayMessages, notes, recordings, searches. If they go to a server, someone there can read them.
• Your healthUnder Swiss law, this is sensitive data (Art. 5). When the law requires your consent for it, the consent has to be explicit (Art. 6).

Where your data goes

In an app that keeps everything on the device, the data stays with you. In others, it travels further:

1. Your phoneWhere the data is created
2. The app's serversSometimes in another country
3. PartnersAdvertising and usage statistics
4. Data brokersCompanies that buy and sell profiles

If the data leaves Switzerland, the privacy policy has to say to which country and with what safeguards (Art. 19). It can only go to a country that protects data adequately, or with safeguards of its own (Art. 16).

The risks, in concrete terms

1. Scams tailored to youWith your name, your bank or your last purchase, a fake message looks real.
2. Data leaksA poorly protected server can be attacked. If the leak puts you at high risk, the company has to notify the FDPIC as soon as possible, and you too, when that protects you (Art. 24).
3. Profiles that stayDeleting the app doesn't delete what's on the servers. The law says data is deleted once it's no longer needed (Art. 6), but you're the one who has to ask, to be sure.
4. Someone pretending to be youWith enough data, another person can open accounts or reset passwords in your name.

Encryption: the question is who has the key

Encrypting means scrambling the data so that only someone with the key can read it. "Encrypted" doesn't always mean the same thing:

1. In transitThe data travels scrambled over the internet (the "https" and the padlock in your browser). It reaches the server and the server reads it.
2. At restThe data stays scrambled on the server's disk. Whoever has the key can read it; often that's the company itself.
3. End-to-endThe key only exists on your devices. The company stores the data but can't read it.

An example: iCloud. With standard protection, the data is encrypted, but Apple holds the keys for much of it. With Advanced Data Protection turned on, most of it becomes end-to-end encrypted, and Apple no longer has those keys.

6 iPhone settings that protect you

1. Read the label before installingIn the App Store, the privacy section is split into "Data Used to Track You", "Data Linked to You" and "Data Not Linked to You".
2. Review the permissionsSettings > Privacy & Security. For each type of data (photos, contacts, microphone…), you see which apps have access, and you remove what isn't needed.
3. Say no to trackingWhen an app asks, tap "Ask App Not to Track". For all apps at once: Settings > Privacy & Security > Tracking, and turn off "Allow Apps to Request to Track".
4. Give only your approximate locationSettings > Privacy & Security > Location Services > the app, and turn off "Precise Location". For the Camera, choose "Never" if you don't want the place in your photos.
5. Turn on the reportSettings > Privacy & Security > App Privacy Report > Turn On App Privacy Report. It shows the last 7 days. The report is encrypted and stays only on your iPhone.
6. Protect your iCloudSettings > your name > iCloud > Advanced Data Protection. First, Apple asks for a recovery contact or a recovery key: keep it safe, because Apple can't help you recover your data.

6 Android settings that protect you

The names below are those of Google's Android, in English. On phones from other brands (Samsung, Xiaomi…), the path may differ: if you can't find it, type the name into the search in Settings.

1. Read "Data safety" before installingOn the app's page in Google Play, scroll down to "Data safety". It says what data the app collects, whether it shares it with other companies, whether it's encrypted and whether you can ask for it to be deleted. As in the App Store, it's filled in by the developer.
2. Review the permissionsSettings > Security & privacy > Permission manager (in some versions, inside "Privacy controls"). For each type of data, you see which apps have access, and you choose "Don't allow" for what isn't needed. And in Settings > Apps > each app, leave "Pause app activity if unused" on: an app you forget about for a few months loses its permissions on its own.
3. Delete the advertising IDSettings > Privacy > Ads (on some phones, inside "Security & privacy"), then delete the advertising ID. Apps that try to read it only get zeros.
4. Give only your approximate locationSettings > Apps > the app > Permissions > Location, and turn off "Use precise location". The app knows the area, not the street. In the camera app, turn off location in its own settings if you don't want the place in your photos.
5. Check the Privacy dashboardSettings > Security & privacy > Privacy dashboard. It shows which apps used your location, camera and microphone, and at what time. In recent versions, the ⋮ menu has "Show 7 days".
6. Protect your backupUse a PIN, a pattern or a password to unlock your phone, not just a swipe. Google's backup uses that code to encrypt part of your data end-to-end. Photos in Google Photos and MMS aren't protected by it.

What Swiss law gives you

The new Federal Act on Data Protection (FADP) has been in force since 1 September 2023. It also applies to companies outside Switzerland, when the processing of the data has an effect in Switzerland (Art. 3).

• Know what they do with your dataWho is responsible, for what purpose, who they pass it to and to which countries (Art. 19).
• Ask for your dataFree of charge and, as a rule, within 30 days: the data, what it's used for, how long it's kept, where it came from and who it went to (Art. 25).
• Take it with youIn a common electronic format, when the app processes it automatically with your consent or under a contract (Art. 28).
• Correct it and have it deletedWrong data gets corrected. And you can object to it being processed: if the company doesn't comply, a court can ban the processing, ban passing it on to others or order it deleted (Art. 30 and Art. 32).
• Protected dataThe company has to protect the data according to the risk (Art. 8). Anyone who wilfully fails to meet the minimum protection rules risks a fine of up to CHF 250,000 (Art. 61).
• Be told about a leakWhen that's needed for you to protect yourself (Art. 24).

Frequently asked questions