An app you have not opened in two years makes no noise: it has probably ended up in a folder you never look at. Yet it can keep working — using a little battery, using data, sending the odd notification, and holding on to the permissions you gave it on the day you installed it.
This post brings together the signs that there are unused or unfamiliar apps still active on your phone: what they mean, where you can see them, and what to do when you find one. In technical circles they are called indicators of compromise, or IOCs (Indicators of Compromise): observable traces suggesting that something is not working the way it should. Here “unfamiliar” has a precise meaning: apps you do not remember installing, or whose purpose you no longer recognise — almost always put there by you, some time ago, or preinstalled on the phone when you bought it.
It is the diagnostic deep dive on the recommendation on removing apps you no longer use: a regular clear-out is the prevention; recognising the signs helps you see where to start.
What indicators mean in this case
An indicator is a trace you can observe on your phone or around it: an entry in the battery statistics, an unexpected notification, an update date that is a long way back.
It is not proof that your phone has been compromised. It is a signal that deserves a check. In the great majority of cases, an unused app that works in the background — that is, while it is not open on the screen — is not a malicious app: it is an ordinary app that nobody is keeping an eye on any more. That is exactly the point.
The value of indicators lies in timing: noticing a forgotten app early means removing it before an unfixed vulnerability, a permission left open or a linked account turns into a problem.
One important distinction. If you find an app that you are sure you never installed, perhaps with wide-ranging privileges, it may be unwanted software: that is the subject of a dedicated recommendation, R30, on unknown apps installed by malware. This post deals with the far more common case: apps that you yourself have forgotten about.
Why they matter more when an app is forgotten
An app you use every day is under observation, even if you never think about it: if it behaves strangely, you notice.
A forgotten app, on the other hand, is watched by nobody. And it carries three things that stay active even when you have stopped thinking about it:
- the permissions it was given — access to your location, contacts, camera, microphone or files that you authorised when you installed it;
- the linked account — the profile you created to use it, often with your email address, phone number or payment details;
- the code itself — which, if the developer has stopped updating it, keeps every flaw discovered since then, with nobody fixing it.
That is why the signs should be read with one question in mind: do I still need this app? If the answer is no, any clue is enough to decide. You do not need to prove that an unused app is dangerous in order to remove it: it is enough that you do not need it.
Technical indicators
These are the ones your phone and the official app stores record and show in their settings: battery and data statistics, the privacy dashboard, the full list of apps, the app’s page in the store. The names of the menu items vary from one operating system to another, but the information is almost always there.
| Indicator | What it means | Why it matters | Where you see it | What to do |
|---|---|---|---|---|
| Battery use by an app you never open | The app wakes up on its own, in the background | An app that works without being used is doing something you did not ask for | Battery settings, usage by app | If you do not need it, uninstall it; if you do, restrict its background activity |
| Background data traffic | The app exchanges data with its servers even when it is closed | It may be sending information about you for reasons that have nothing to do with you | Data usage statistics, per-app breakdown | Check whether you really use it; if not, remove it |
| Last update a long time ago | The app’s page in the store shows a date several years back | Vulnerabilities discovered after that date remain unfixed | The app’s page in the official store, “About” section | Look for a maintained alternative or uninstall it; see vulnerabilities in outdated apps |
| App no longer in the store | When you search for it you cannot find it, or its page shows as unavailable | The developer has withdrawn it or the store has removed it: either way it will receive no more updates | Store search, list of apps installed from your account | Uninstall it; if it held your data, check the developer’s website for how to close the account |
| Recent use of sensitive permissions | An unused app has accessed your location, microphone or camera | A permission granted years ago is still in use | Privacy dashboard, permission usage history | Revoke the permission straight away, then decide whether to keep the app |
| Still-active access to one of your accounts | The app appears among those authorised to access your email or a social network | It can read account data even after you have uninstalled it | The account’s security section, “Connected apps” or “Apps with access” | Revoke the access from the account, not just from the phone |
| Active subscription for an app you do not use | The store shows a renewal being charged | You are paying for something you do not use; uninstalling does not cancel it | Subscriptions section of your store account | Cancel from the subscriptions area, then uninstall |
| Special privileges you do not remember granting | The app is listed as a device administrator or uses accessibility services — features designed to control the screen and settings | These are the broadest permissions an app can have | Security settings, “Device admin apps” or “Accessibility” | If it is one of your own forgotten apps, remove the privilege and uninstall; if you do not recognise it at all, that is the case covered by R30 |
On updates, there is no single threshold that applies to every app: the closer an app is to your data — accounts, payments, messages — the more a distant date matters.
Signs you can observe yourself
These do not require you to open any menu: you notice them simply by using your phone as you normally would.
| Signal | What it means | Why it matters | How you notice | What to do |
|---|---|---|---|---|
| Notifications from a forgotten app | An app you never open is still messaging you | It is active and keeps a channel open to you | A notification with a name or icon you do not link to anything recent | Open it once to remember what it was, then decide; if you do not need it, remove it |
| Emails from services you no longer use | The account you created for the app is still open | Your data remains on that service’s servers | Newsletters, reminders or security alerts from a forgotten service | Close the account with the service, then uninstall the app |
| Icons you do not recognise | The list contains an app whose purpose you cannot remember | It may be an app from a past event, a preinstalled one, or one installed by someone else | Scrolling through the full list of apps, not just the home screen | Look at the developer’s name and the installation date; if it remains a mystery and has wide-ranging privileges, see R30 |
| Unused app alert | The system tells you an app has not been used for months, or has already removed its permissions | Your phone has done the first half of the job for you | System notification, “Unused apps” section | Treat it as a reminder: if the system has noticed it, it is a strong candidate for removal |
| “No longer supported” message | The app says its service has closed or it is not compatible with your system | It will receive no more fixes | Screen shown when you open it, notice from the store | Save any data you need and uninstall it |
| Charges you cannot explain | A renewal appears on your statement or in your receipts | A subscription stayed active after you stopped using the app | Receipt emails from the store, card transactions | Check the store’s subscriptions area and cancel |
| Slow phone or storage always full | Too many apps are taking up space and resources | It is a weak clue, but it often hides forgotten apps | “Storage full” warnings, updates that will not install | Sort your apps by size and by last use: the candidates stand out on their own |
A concrete example
Helen notices that her phone no longer lasts until the evening. She opens the battery statistics, expecting to find the maps app or videos at the top. Instead, at the top is a parking app for a city she visited for work two years ago.
Curious, she scrolls through the full list of apps. She finds the app for a conference she attended, a game she downloaded for her nephew, and the loyalty card for a supermarket in another town. In the privacy dashboard she discovers that the parking app still has location access set to “always”, and used it the previous week. In the store, the app’s page shows it was last updated three years ago.
None of these apps was “bad”. They were ordinary apps, installed for a specific reason, left behind when that reason was over. The battery signal was simply the most visible one: read together with the others, it led Helen to do in twenty minutes a clear-out she had been putting off for years. First she closed the parking account, which still had a payment card linked to it; then she uninstalled the app.
What to check right away
In the full list of apps
- apps whose purpose you cannot remember;
- apps tied to events, trips, jobs or periods of your life that are over;
- duplicates: two apps that do the same thing.
In the battery and data statistics
- apps that use power even though you do not open them;
- apps that use data in the background for no obvious reason.
In the privacy dashboard
- unused apps with access to your location, microphone, camera or contacts;
- permissions set to “always” where “only while using the app” would do.
In your accounts and subscriptions
- apps connected to your email or social networks;
- active store subscriptions for apps you never open.
If you find a suspicious indicator
- Revoke sensitive permissions first. It takes a moment and immediately cuts the app off from your most sensitive data.
- Close the linked account, if there is one, from the app or the service’s website: uninstalling does not delete the data held on its servers.
- Cancel any subscriptions from the store’s subscriptions area: uninstalling does not do that either.
- Save anything you need, such as photos, documents or receipts, before removing the app.
- Uninstall it and, where you granted it, revoke the app’s access to your accounts.
The full procedure, with criteria for deciding what to keep and a routine to repeat, is in the post on how to clean up your apps. To take a calm look at the permissions of the apps you do keep, see the recommendation on checking what your apps can do.
What is not an indicator
Telling the difference helps you avoid two opposite mistakes: getting alarmed over nothing, and getting used to ignoring the real signals.
| Situation | Why it is usually not a signal |
|---|---|
| System services with technical names in the battery statistics | They are part of the operating system and keep the phone working: they should not be removed |
| Preinstalled apps that cannot be uninstalled | They came with the phone; they do not indicate a problem, and they can often be disabled |
| Background activity from apps you genuinely use | Messaging, maps or backup apps work with the screen off in order to do their job |
| A simple app that is rarely updated | An app that handles no accounts or personal data can stay stable for a long time without particular risk |
| A spike in usage after an update | Many apps reorganise their data after an update; it only matters if usage stays high in the following days |
| An app you can no longer find by searching for its name | It may have been renamed or merged into another app from the same developer: check before drawing conclusions |
The rule of thumb: an app you use that behaves strangely deserves a check; an app you do not use needs no proof. If you do not need it, removing it is always a good choice, whatever the signal that made you notice it.
How often to check
You do not need a demanding routine. You just need one to exist.
| Frequency | What to check |
|---|---|
| Whenever a system alert arrives | Unused apps flagged or permissions removed automatically: it is the easiest moment to decide |
| Every 3 months | The full list of apps, battery and data statistics, apps with sensitive permissions |
| Every 6 months | Active store subscriptions; apps connected to your email and social networks |
| After a trip, an event or a job ends | The apps you installed for that occasion |
| When you change phones | Before transferring everything: take with you only the apps you really use |
Setting a quarterly reminder works better than any good intention. And if you would rather reduce the work at source, keeping your software up to date with automatic updates means the apps you keep receive their fixes without you having to think about it.
Two important warnings
An indicator is not proof. An app that drains the battery may simply be badly designed; a notification from a forgotten app may just be a promotion. Check before you get alarmed — but always check: it only takes a few minutes.
No indicators is not a guarantee. An app that uses no power, sends no notifications and uses no permissions can still contain unfixed vulnerabilities, or be linked to an account holding your data. That is why protection does not rest on watching for signals, but on a regular clear-out: keeping only the apps you need, and keeping them up to date. Indicators help you decide where to start, not whether to start.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read battery and data statistics, the privacy dashboard and an app’s page in the store |
| Awareness | Understanding that a forgotten app keeps its permissions, account and vulnerabilities even when you do not use it |
| Secure Behaviour | Reviewing your apps at regular intervals, without waiting for the phone to slow down or a charge to appear |
Reference level: FL2 — Beginner. This is the level at which you learn to observe your phone methodically: knowing where to look and what you are seeing, even before you can fix everything on your own.
Conclusion
Recognising unused apps is not about viewing your phone with suspicion. It is about knowing where to look, so that a vague annoyance — a battery that runs down sooner, an odd notification — becomes a simple decision.
What to do right now. Open your battery statistics and look at the top five apps on the list. If there is one you have not opened in months, you have found your first candidate for a clear-out. If they are all apps you use, you now know that this check takes a minute and you can repeat it in a few months. To see where you stand on the other aspects of your digital security, you can take the digital resilience self-assessment.
Related resources
Short guides from the Resources section, for anyone who wants to focus on a single aspect:
- Review Installed Apps: The Twenty-Minute Clear-Out
- App Permissions: Deciding What Each App Can Reach
- Fleeceware: Apps That Charge You for Almost Nothing
Related content
- Removing apps you no longer use — the recommendation this belongs to
- Vulnerabilities in outdated apps — the mechanisms that make these signals risky
- How to clean up your apps — what to do, in the right order
- Risks of abandoned apps — what gets hit when a signal is confirmed
- Consequences of forgotten apps — what can happen, in practice, if nobody steps in
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
