You have been trained to think about app privacy in terms of permissions. Can this app see my location? My camera? My contacts? You dutifully tap “deny,” and you feel like you have done the work.

That is half the picture, and it is the less important half. Permissions control what an app is allowed to reach on your device. They say almost nothing about what it sends off your device, or who it quietly talks to while you are not looking. And right now, as you read this, the apps on your phone are chattering away to a crowd of servers you have never heard of.

The missing half of phone privacy is not what apps can access. It is what they can send. And you can take control of it.

The traffic you never see

Install a tool like Exodus Privacy and let it scan your apps, and the result tends to alarm people. Ordinary, popular apps come stuffed with tracker libraries, often dozens in a single app: analytics kits, advertising networks, profiling SDKs, most of which have nothing to do with what the app actually does for you. Not every tracker is sinister; some just report crashes to the developer. But many exist to identify you, build a profile, and feed the advertising and data-broker machine.

Here is the part that breaks the permission model entirely. A tracker does not need a scary permission to do its job. It phones home over an ordinary network connection, the same connection the app uses for everything else. So an app you carefully denied location, contacts, and storage can still ship out your IP address, which maps to your rough location, a device fingerprint that identifies you across apps, and a stream of behavioral data, all without touching a single permission you thought you controlled. The permission screen was watching the wrong door.

And it is not only the apps you chose to install. In early 2025, Google silently pushed a system component onto Pixel, Samsung, and other Android phones with no icon and no consent prompt, one that performs on-device scanning and does not appear in your normal app list at all. Whatever you make of its stated purpose, you did not approve it, and you cannot see what it does without going digging. Your phone is running, and connecting, things you never agreed to.

Permissions are inbound. The leak is outbound.

This is the reframe that changes everything. Permissions are about ingress, what an app is allowed to touch. The privacy leak is about egress, what leaves your device and where it goes. To actually control your privacy, you have to control egress, and that means controlling the network.

There are two layers to it, and together they flip the default from “every app can talk to anyone” to “an app talks only to what you allow.”

Cut the line entirely wherever you can. A startling number of apps have no legitimate reason to touch the internet at all. A calculator. A file manager. An offline notepad. A document viewer. A local scanner. These do their entire job on-device, yet many of them happily reach out to the network anyway. Deny them internet access and they simply cannot phone home, cannot upload, cannot leak, because most surveillance requires sending the data to a server, and you have cut the wire. On a properly built phone, this is a first-class control: a network permission you can revoke per app, exactly the way you revoke the camera or location, rather than a hidden hack. The best-behaved app cannot betray you if it cannot reach the network, and the worst-behaved one is defanged.

Filter what the rest are allowed to reach. For the apps that genuinely need the internet, “needs the internet” does not mean “may talk to everyone.” Network-level DNS filtering blocks known tracker and advertising domains across the whole device at once, so even a chatty app cannot reach the trackers baked into it. And a per-app, per-domain firewall lets you go further, allowing an app to reach its own servers, the ones it needs to function, while blocking the third-party trackers riding along inside it. The app works. The surveillance does not.

Underneath both layers, it helps to actually see what is happening. Pairing this with a traffic inspector, so you can watch which apps are connecting where, turns it from guesswork into evidence. You are not blindly blocking; you are looking at the outgoing connections and deciding, from what you see, what has any business being there. It is the same watch-it-then-control-it discipline we wrote about with network monitoring tools.

Guilty until proven necessary

The mental shift is simple and powerful. Instead of assuming every app should be able to talk to the entire internet and occasionally clawing back a permission, you flip the default: an app gets network access when it needs it and you allow it, and not otherwise. Guilty until proven necessary. Most of your apps will keep working perfectly with far fewer connections than they were making, because most of those connections were never for you.

This is exactly the checkpoint idea done right, a gate on what leaves your device, with you holding the keys, rather than a black box that decides for you. On the phones we build, egress is something you control: a per-app internet permission you can revoke like any other, straightforward network-level tracker filtering, and the tools to inspect the traffic and see the truth for yourself, including the connections from things that were installed without asking you.

The honest limits

A few caveats, because we do not sell magic. Some apps genuinely need the internet and will break without it, so the skill is cutting the line only for the ones that do not need it, which is more of them than you would guess, not all of them. Aggressive tracker blocking can occasionally break a feature, in which case you whitelist the specific thing and move on. And egress control reduces exposure rather than eliminating it: an app with a legitimate connection can still carry some data out along that allowed path, so this works alongside a minimal app loadout and good permissions, not instead of them. It is a major layer, not a force field.

But it is the layer almost everyone is missing. You can spend all day tuning permissions and still have a phone quietly narrating your life to a hundred servers, because permissions were never watching the outbound door. Watch that door, cut the lines that should not exist, and filter the ones that should, and your phone stops working for everyone else and starts working for you.

If you want a phone where you decide what is allowed to phone home, all of it, that is what we build. Email hello@spicycorp.com, or book a call.