Android Auto-Revoke: Why Unused Apps Lose Permissions

We all have those apps. You downloaded a "Park Finder" for a road trip three months ago, or a "QR Scanner" before Android built that feature into the camera. These apps sit on your phone, gathering dust—and often gathering data. Google introduced a feature called "Auto-revoke" (or "Unused app settings") to save us from our own digital clutter. It's one of my favorite "set it and forget it" privacy features, but it doesn't always work the way you'd expect.

How auto-revoke decides

The logic behind auto-revoke is pretty straightforward: if you haven't opened an app in a long time (usually about 90 days), Android assumes you've forgotten about it. To protect you, the system "hibernates" the app. This means it strips away all the sensitive permissions you granted—like access to your location, contacts, or microphone—and stops the app from running in the background.

I find this incredibly helpful because it acts as a safety net. If a developer sells their app to a shady company three months after you stop using it, that app won't be able to start tracking you because Android has already "locked the doors" by revoking its permissions. You'll get a notification saying "Permissions removed for unused apps," which is your cue to either delete them or go in and see what's changed. It’s a great way to limit your "privacy debt."

Apps that opt out and why

Here is the "this is annoying" part: developers can actually ask the system not to hibernate their app. They do this by prompting you to turn off "Remove permissions if app is unused" in the settings. Apps like Dashlane or 1Password often do this because if their permissions were revoked, they might not be able to fill your passwords properly when you finally do need them six months later.

However, some apps abuse this. I've seen basic games and shopping apps ask users to disable auto-revoke during the setup process, claiming it's "necessary for a better experience." It almost never is. Whenever an app asks me to disable this protection, I treat it with extreme suspicion. Unless it's a core utility that must work in the background (like a backup tool or a security app), I never opt out. Most apps work just fine after you re-grant the permissions the next time you open them.

App hibernation explained

Hibernation is like a "soft uninstall." When Android hibernates an app, it doesn't just take away permissions; it also clears temporary files (cache) to free up space and stops the app from sending you notifications. It's still there on your phone, and all your login data is usually saved, but it's essentially in a coma.

On my Pixel, I noticed this saved me about 2GB of storage last month alone just by clearing the cache of "dormant" apps. This is particularly useful if you have a phone with 128GB of storage or less. It's a dual-win: you get better privacy because the app isn't "talking" to its servers anymore, and you get a faster phone because there's more free space and fewer background processes competing for your RAM. It’s one of the few times a privacy feature also makes your phone perform better.

Samsung and Xiaomi behaviour

Samsung and Xiaomi have their own versions of this. On a Samsung Galaxy, this is often bundled under "Device Care." Samsung is actually a bit more aggressive; they will sometimes "put apps to sleep" or "deep sleep" even faster than the standard 90-day Google window. If you notice an app you use once a month is constantly asking for permissions again, it's likely Samsung's optimization at work.

Xiaomi’s HyperOS has a "Hidden apps" and "App lock" feature that plays into this as well. On those devices, I’ve found that if you move an app to the "Private Space" or "Second Space," the auto-revoke rules can sometimes get a bit wonky. If you're on a Xiaomi, I recommend manually checking your "highly sensitive" apps in the Security app to make sure they haven't bypassed the standard Android hibernation rules. Each manufacturer wants to be the "smartest" at managing your battery, which sometimes leads to them overriding the standard Android behavior.

Manually managing it

You don't have to wait 90 days for this to happen. You can actually see which apps are currently eligible for hibernation and manually trigger it if you want. This is a great "spring cleaning" task for a Sunday afternoon.

1. Go to Settings > Apps.
2. Tap Unused apps (it might be under "Special app access" on some versions).
3. Here you’ll see a list of apps that have already had their permissions revoked.
4. You can also toggle the "Remove permissions and free up space" switch for any individual app by going to its App info page.

I recently looked at my list and found an app for a museum I visited in another state last summer. It still had access to my "precise location." Android hadn't auto-revoked it yet because it had only been 70 days, but I was able to toggle it off manually right then and there. It's about being proactive rather than waiting for the timer to run out.

Verifying it worked

The easiest way to tell if auto-revoke is working is to watch your notifications. Google is pretty good about sending a summary: "3 apps were hibernated." When you see that, tap it. It will take you to a list where you can see exactly which permissions were taken away. For example, it might say "Spotify: Microphone removed" or "Uber: Location removed."

One caveat to keep in mind: if you use an app through a "Web View" (like a shortcut to a website on your home screen), auto-revoke doesn't really apply to the browser itself, only to the standalone apps. Also, apps installed via side-loading (APKs) are sometimes less responsive to these system-level commands. My final piece of advice? Don't rely on auto-revoke as your only privacy strategy. It's a great safety net, but the best way to keep your data private is still to delete the apps you don't use. If you haven't opened it in six months, do you really need it taking up space and breathing on your data? Just hit uninstall.