A new phone is at its most private in the minutes before you sign in. Everything after that is a negotiation: which app gets your location, who can read your messages on a locked screen, and how much of your behaviour gets quietly logged and passed along to advertisers.
You can settle most of those questions in about half an hour, before the everyday apps arrive and start asking for things. Here's an order that works on both iPhone and Android.
Before you sign in, take the slow path
The setup wizard will offer to copy everything from your old phone in one tap. It's convenient, and it also drags along years of permission decisions you never made on purpose. If your old device had forty apps you rarely opened, restore photos, messages and notes only, then add apps back one at a time as you actually need them. It takes longer. It also means every app on the new phone was a deliberate choice.
A few choices are worth making during setup itself:
- Don't sign into everything. Your email, cloud drive and social accounts can wait until you need them. Each one you add during setup becomes another service the phone syncs with in the background.
- Turn off diagnostics sharing. On iPhone: Settings > Privacy & Security > Analytics & Improvements. On Android: Settings > Privacy > Usage & diagnostics. These send technical reports and, depending on the build, some usage data.
- Set a real screen lock now. Six digits minimum, or a passphrase. A four-digit PIN can be guessed by someone watching you unlock the phone once.
Lock the lock screen, because that's where leaks start
A locked phone that shows full message previews is a phone that tells anyone who picks it up who you've been texting and what about. Fix this before anything else, since it's also the setting most likely to save you embarrassment in a café or on a train.
On iPhone, go to Settings > Notifications > Show Previews and choose When Unlocked. On Android, open Settings > Notifications > Lock screen notifications and pick the option that hides sensitive content, or turn lock screen notifications off entirely for messaging apps.
Then tighten the rest of the lock screen:
- Set auto-lock to 30 seconds or one minute. Shorter is better; the battery difference is trivial.
- On iPhone, open Settings > Face ID & Passcode and scroll to Allow Access When Locked. Switch off anything you don't need from a locked screen — Control Center, reply with message, wallet, accessories.
- On Android, check the lock screen settings for shortcuts and smart features, and disable anything that reveals content or lets someone toggle Wi-Fi, Bluetooth or airplane mode without unlocking.
Switch off the tracking you'd never find on your own
Both major mobile systems collect data for advertising and product improvement, and both bury the controls a few menus deep. These toggles are not a cure for being tracked online, but they cut the ambient collection that happens whether or not you open an app.
On iPhone:
- Settings > Privacy & Security > Tracking: turn off Allow Apps to Request to Track. Existing permissions stay as they are, but new apps can't ask.
- Settings > Privacy & Security > Apple Advertising: turn off personalised ads.
- Settings > Privacy & Security > Location Services > System Services: review the list, and turn off Significant Locations, iPhone Analytics and anything else you don't use.
On Android:
- Settings > Privacy > Ads: delete the advertising ID on versions that support it.
- Settings > Location > Location services: turn off Wi-Fi scanning and Bluetooth scanning. Names vary by manufacturer, so look for anything that keeps scanning when those radios are off.
- In your Google account, open Data & privacy and review Web & App Activity and Location History. Pause what you don't want recorded, or set the data to delete automatically.
Treat permissions like a budget
Every permission you grant is a small ongoing cost. When an app asks for something, ask yourself what breaks if you say no. A shopping app that wants your contacts is asking for something it has no use for, and matching your address book against a marketing database is usually the reason.
Two rules cover most situations. Grant location as while using the app, never always, unless it's a navigation or fitness app that genuinely needs it in the background. And when an app asks for photo access, choose selected photos rather than the whole library — most apps only ever need the one image you're uploading.
Be stingy with the microphone, camera and contacts. Deny them first; you can always grant access later when a feature stops working, and the app will ask again.
Networks, browsers, and the first apps you install
Before you install anything fun, install a password manager and an authenticator app. That way, every account you add afterwards can have a long, unique password and two-factor authentication from day one, rather than being retrofitted later. Turn on encrypted backups too: on iPhone that means ticking Encrypt local backup in Finder; on Android, check that your backup is tied to an account you control.
For browsing, open your browser's privacy settings and block third-party cookies, then check whether it has a tracking protection mode worth enabling. On Android you can also set a Private DNS provider under Network & internet, which encrypts your domain lookups. On public Wi-Fi, turn off auto-join for open networks so your phone doesn't connect silently as you walk past a shop. And be sceptical of free VPN apps — some of the worst offenders in the app stores are the ones promising anonymity.
A short audit you repeat every few months
Privacy settings drift. Apps get updated, new permissions get requested, and old ones quietly stay granted long after you stopped using the app. Once every few months, spend five minutes in your phone's privacy dashboard — Settings > Privacy & Security on iPhone, the Privacy dashboard on Android — and look at what accessed your location, camera and microphone recently. Anything that surprises you deserves a revoked permission. Anything you haven't opened in three months deserves deletion.
Then confirm two things: that your operating system is up to date, and that two-factor authentication is on for your email account especially. That one account can reset almost everything else you own, and it is the single most valuable thing on the phone.
Photo: El Jundi / Pexels
