Your flashlight app doesn’t need your microphone.

The prompt is only the starting point

A useful app can still request access it does not need for the feature you want. A permission request tells you what access an app is asking for. It does not prove why that access is necessary, or what the app will do with it.

Start with a simple question: what feature am I using right now? A voice recorder needs the microphone to record your voice. A basic flashlight usually does not. Some apps combine several features, so investigate the explanation rather than judging by the app name alone.

Make a small, visible experiment

On your own Android device, open the app’s permission settings and record the current choices. Deny one optional permission, reopen the app and test the feature you actually use. Keep notes about what changes. Do not grant access to real messages, contacts or files just to make a demonstration more dramatic.

Menu names vary by device and Android version. Search Settings for the app name or Permission manager if you cannot find the expected screen.

Ordinary permissions are not the whole picture

Notification access, accessibility services, device administration, VPN access and permission to install unknown apps are separate forms of access. Review them individually. Notification access may expose the contents of notifications, including sensitive previews. Accessibility access can be powerful; grant it only when you understand the feature and trust its provider.

Reduce the access, then test again

Choose the narrowest permission that supports your task. Where available, consider access only while using an app, a one-time grant, approximate location, or selected photos. Remove access you no longer need, and uninstall apps you do not recognise.

Permission review is one layer of protection. It cannot prove that a device is free of malware. Keep the operating system and apps updated and investigate unfamiliar behaviour using evidence rather than guesswork.