Loading page
About this tool
Score the sensor, location and health-data permissions a fitness tracker holds and see which ones to revoke.
The Fitness App Permission Audit scores the permissions a workout or step-tracking app holds against the data-minimisation rule: a permission passes only when a core feature cannot work without it. Sixteen Android and iOS permissions — physical activity, body sensors, Health Connect, precise and background location, nearby devices, camera, contacts and the advertising ID — are weighted by sensitivity, with Google Play restricted permissions such as ACCESS_BACKGROUND_LOCATION and BODY_SENSORS_BACKGROUND carrying the heaviest weight. You get a 0-100 privacy score, a ranked revoke list and the exact manifest name to look for in Settings.
Open Fitness App Permission Audit on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Restricted permissions score five times a normal one, so a single background-location grant outweighs several harmless ones.
Every row shows the Android manifest constant and the matching iOS prompt so you can find it in Settings.
One unnecessary grant holds the verdict at 'Low exposure' even when the raw score looks good.
No, not for tracking a workout you start yourself — 'While using the app' is enough, because the app is in the foreground with an active workout notification. ACCESS_BACKGROUND_LOCATION is only justified for automatic workout detection, and Google Play classes it as a restricted permission requiring a core-functionality declaration.
ACTIVITY_RECOGNITION (Motion & Fitness on iOS) is what lets the app read the phone's hardware step counter and motion classifier. Denying it stops step, floor and automatic activity logging, so it is the one permission a step tracker genuinely cannot do without.
Granting Contacts uploads names and numbers of people who never installed the app or agreed to anything, and no core tracking feature needs it — friend features work from a username or invite link. Revoke it and share a link instead.
Body sensors (BODY_SENSORS) reads live readings from a sensor right now, such as heart rate from a band or phone. Health Connect, or HealthKit on iOS, is a shared store that hands over history written by every other app, so grant its record types individually rather than using 'Allow all'.