Loading page
About this tool
Trim the location, contacts, SMS and notification permissions a shopping app collects without needing them.
The Shopping App Permission Audit scores an e-commerce app against the three things it has to do — browse, take payment, deliver — and flags everything collected beyond that. Seventeen permissions and settings are weighted by sensitivity, including the ones shopping apps most often ask for without needing: SMS access (OTP autofill works through the SMS Retriever API with no permission), call logs, calendar and background location. The result is a 0-100 score, a ranked revoke list and the exact Android manifest name for each item.
Open Shopping App Permission Audit on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
If a grant does not help you browse, pay or receive an order, it scores as full exposure.
SMS access is scored as unnecessary because Android's SMS Retriever API autofills a code without any permission.
Biometric checkout locking counts as a core, risk-reducing control rather than another permission to strip.
Usually to autofill the login OTP — but it does not need the permission to do that. Google's SMS Retriever and SMS User Consent APIs hand the app one matching message with no READ_SMS grant, so full SMS access exposes bank alerts and private messages for no functional gain.
Approximate location is enough for delivery estimates and serviceability checks, and precise location only helps when you are dropping a pin on a new address. Background or 'all the time' location has no shopping use — nothing about an order happens while the app is closed.
No. Revoking stops future collection only. To remove what has already been sent, use the app's data-download and account-deletion options; under India's DPDP Act 2023 you can also ask a company to erase personal data it no longer needs for the stated purpose.
Almost always for a referral feature, which works just as well from a share link. Granting it uploads the names and numbers of people who never installed the app, so it is one of the first things to revoke.