Ten Minutes in Your Phone's Settings

You don't need a new phone, a special app, or a paranoid mindset to get a lot more privacy out of the device you already carry. Most of it is sitting in Settings, defaulted to whatever was most convenient for app makers. Here's what I'd change, roughly in order of payoff. Menu names shift a bit between iPhone and Android versions (and between Android brands), so if something isn't exactly where I say, the search bar at the top of Settings will find it.

Location access, app by app

This is the big one. Go to the location permissions list (Privacy & Security > Location Services on iPhone, Location > App location permissions on Android) and walk through every app.

Most apps only need location "While using the app," if they need it at all. Weather can work fine with a city. A shopping app has no business knowing where you are at 2 a.m. Very few things truly need "Always": maybe your maps app for commute alerts, a family-sharing app if you use one.

Both systems also let you turn off precise location per app, so the app gets a rough area instead of your exact spot. That's a nice middle ground for weather, news and local deals.

Photo access

When an app asks for your photos, you can give it a limited selection instead of your whole library. Do that. Your camera roll is a detailed diary of where you've been, who you know and what your home looks like. A social app only needs the pictures you're actually posting.

While you're near the camera, check whether location is being embedded in your photos. It's handy for your own albums, but that data can travel with the file when you share it. Many apps strip it, not all do. On iPhone the share sheet has an "Options" button where you can drop location for a single share.

Microphone, camera, contacts, Bluetooth

Same drill. Open the permission manager and look at who has what. Contacts is the sneaky one, because giving an app your contacts hands over information about other people who never agreed to anything. Bluetooth access can be used to figure out where you are in a store, so if a retail app is asking for it, I'd say no.

Both platforms now show a little indicator when the mic or camera is active. Get used to glancing for it.

App tracking and ad ID

Your phone has an advertising identifier that apps can use to connect what you do across different apps. On iPhone, go to Privacy & Security > Tracking and turn off "Allow Apps to Request to Track." That auto-denies everyone. On Android, look for Ads under Privacy (or under Google settings) and delete the advertising ID.

This doesn't stop all tracking. It does remove the easiest, most standardized way of doing it.

Lock screen

What can someone see or do with your phone without getting past the passcode? Notification previews can show message contents, two-factor codes and email subjects to anyone who picks it up. I'd set previews to show only when the phone is unlocked (iPhone does this under Notifications > Show Previews, Android has a similar lock screen notification setting).

Also look at what's allowed from the lock screen: replying to messages, Control Center or Quick Settings, wallet. Turning off Quick Settings access on the lock screen means a thief can't just flip on airplane mode.

A real passcode

Six digits minimum. Longer or alphanumeric if you can stand it. Biometrics are fine for daily use, but the passcode is what actually protects the encryption on the device, so it's worth not making it 123456 or a birthday.

While you're in there, turn on whatever theft protection your phone offers. Recent iPhones have Stolen Device Protection and Android has theft detection features. They add extra checks when someone tries to change important settings away from familiar places.

Find My and remote erase

Make sure Find My (iPhone) or Find My Device (Android) is on, and that you know how to use it from a browser. Being able to erase a lost phone remotely matters more than tracking it down.

Keyboard and voice

Third-party keyboards can, if you grant them "full access," send what you type off the device. If you use one, make sure it's from a company you trust, or skip full access. Also check your voice assistant's history settings and whether recordings are kept or reviewed. You can usually delete the history and opt out of review.

The ongoing part

None of this is one-and-done. Every new app asks for things, and the answer you give in the first five seconds is usually the one that sticks. My rule is to say no by default and wait until the app actually breaks. You'd be surprised how rarely it does.