Signing in with Google or Apple can avoid creating another password, but the connected app may retain access long after you stop using it. A quarterly permission review keeps old experiments from becoming permanent trust.
Remove old OAuth grants and sign-in connections that no longer have a clear job. Read scopes, not just app names. Calendar read access, mailbox access, profile identity, and cloud-file access carry very different consequences.
Set aside enough time to identify unfamiliar grants rather than deleting everything reflexively. Essential backup, calendar, or sign-in integrations can break when revoked.
Read permissions, not app logos
Review third-party connections from the account’s security page. Open the primary account’s third-party connections page. An app’s logo or familiar name does not reveal what data it can still read.
Remove access that has lost its purpose
Open details to see data scopes and last use
Read scopes for mail, files, calendar, contacts, and profile identity. Remove grants that have no current, specific purpose.
Remove abandoned apps and duplicate integrations
Check last-used dates and duplicate integrations. A tool tested once years ago should not retain permanent access.
Reauthenticate essential tools only from their official sites
Revoke from the main account, then sign in again only from the essential app’s official site. This forces a fresh, visible consent decision.
Repeat the review after a job, school, or device change
Remember that revocation stops future access but may not delete copied data. Use the developer’s deletion process when retained data matters.
A calendar tool may need calendar access but not mailbox, contacts, and cloud-drive control. When requested scopes exceed the app’s obvious function, decline and look for a narrower integration.
Revocation does not erase copied data
- Removing access may not delete data already copied by the app.
- An app name can change after acquisition.
- Do not approve broad access merely to test a service.
Secure the main account before reviewing permissions if an unknown app appears alongside unfamiliar sessions or changed recovery information.
Repeat the review after life changes
Menus, limits, and recovery options change. Confirm the current steps in “Manage connections between your Google Account and third parties” and “Manage your apps with Sign in with Apple” before acting.
Google lets users review and remove connections between a Google Account and third-party apps or services.
Apple lets users inspect apps using Sign in with Apple and stop using that sign-in connection.
