What your phone can tell you about a casino app’s permissions

A permission list is not an activity log

Your phone can answer several questions about a casino app, but the answers come from different places. A store disclosure describes declared data practices. A permission setting tells you what access has been allowed.

An activity report records certain access that occurred within its reporting window. None of those is a complete substitute for the other two.

Start an inspection by giving each layer its own column. If a casino app has camera permission, that does not establish that it used the camera during your visit. If a report shows access, that alone does not establish what was retained by a remote service.

Google’s documentation expressly distinguishes technical permissions from developer-declared Data safety information.

This is a method based on Apple and Google documentation, checked on 19 September 2026. We did not install a casino app, inspect an account or measure a real device. The worked case below is invented and labelled as such.

It shows what a careful observation note would contain, without providing a privacy score.

Sources: Understand app privacy and security practices with Google Play's Data safety section - Android - Google Play Help; About App Privacy Report – Apple Support (UK).

Read the store disclosure as a declaration

Apple asks developers to describe their app’s privacy practices, including those of third-party partners whose code they integrate. Developers are responsible for keeping the answers accurate and current. The label is useful documentary evidence, but reading it is not the same as independently tracing the app’s behaviour.

Apple also defines collection for its label in terms of data transmitted off the device and accessible beyond the time needed to service a request in real time. Do not casually replace that defined term with “anything the app touches”. A local operation and a declared collection category can describe different things.

Google similarly explains that its Data safety section is based on developer declarations. Its permissions list is based on technical information. The two may differ because data is processed on the device without being collected, or collected through a route not controlled by a permission.

Record the exact disclosure and platform instead of translating every difference into an accusation of dishonesty.

Sources: App Privacy Details - App Store - Apple Developer; Understand app privacy and security practices with Google Play's Data safety section - Android - Google Play Help.

Inspect Android’s current decision, not a remembered prompt

Google’s Android help describes finding an app in Settings, opening its permissions and changing the relevant permission. It also describes reviewing apps by permission type. Menu details can vary by device and version; the help page flags version limits for some instructions.

Record the device and Android version rather than presenting one tap sequence as universal.

For location, camera and microphone, the available choices may distinguish access while using an app, asking each time or refusing access. Google notes that an all-the-time option applies to location. Copy the actual choice shown for the app you are inspecting.

Do not simplify a conditional setting to a permanent yes.

Before changing anything, decide what your inspection needs to establish. Merely recording a setting can be enough. If you choose to refuse access, note the change and whether the task remains possible, but do not grant new access solely to complete a review.

No inspection requires sharing contacts, photographs or location just to populate a table.

Sources: Change app permissions on your Android phone - Android Help.

Start the iPhone report before the observation window

Apple’s App Privacy Report is available from iOS 15.2 and iPadOS 15.2. Its documentation explains that collection begins when the report is enabled. An empty report immediately after switching it on is therefore not evidence of an app’s earlier behaviour.

The report includes data and sensor access over the previous seven days, together with network-activity information. Apple says the report is encrypted and stored on the device; turning the report off clears its data. Those boundaries should be recorded before anyone interprets an absence or saves a follow-up observation.

For a repeatable note, record when the report was enabled, the short task undertaken and when the report was read. A note such as “no camera entry in the available observation window” is narrower and more useful than “the app never uses the camera”.

This proposed method does not require keeping the app open, gambling or generating a longer session to make the report look more complete.

Sources: About App Privacy Report – Apple Support (UK).

Treat a contacted domain as a clue with limits

Apple’s report distinguishes app network activity from website activity within apps. A contacted domain may relate to content inside an app rather than only a direct request from its core code. Apple also excludes private browsing sessions in browser apps from the report’s network activity, while noting a different treatment for private modes in non-browser apps.

Record the report category as well as the domain. A bare list of addresses loses that distinction. Do not publish a claim that personal data was sold, that a named company received an identity document, or that an unfamiliar domain is malicious based only on its appearance in the list.

The next documentary step is to compare the app’s privacy policy and disclosure with the observation, or ask the developer to explain the purpose. This is a boundary on the method, not a finding about any casino. Determining the content of a transmission or a server’s retention practice would require evidence that this worksheet does not collect.

Sources: About App Privacy Report – Apple Support (UK); App Privacy Details - App Store - Apple Developer.

A browser adds a site-level permission record

For Chrome on Android, Google documents site settings for permissions such as location, camera and microphone. It also describes reviewing individual sites and resetting their permissions. The website’s permission is a distinct item to record when comparing browser access with an installed casino app.

Name the browser, its version and the exact website. Keep a native app’s settings on a different row. If you only inspected Chrome’s site setting, write that; do not claim to have checked every permission layer on the phone.

Conversely, seeing a permission assigned to the browser does not identify which casino website requested or used it.

Use the same bounded reading task for both routes if you choose to compare them. For example, locate the privacy policy and identify the contact route without signing in. Record where a permission request interrupted that task, if one actually occurred.

We have not performed that comparison here and cannot infer that an app or a website is safer from its format alone.

Sources: Change site settings permissions - Android - Google Chrome Help.

Work through a synthetic camera-access record

Suppose an invented casino app’s store disclosure describes a data practice, Android shows camera access allowed only while the app is in use, and a supported device report later records camera access during a chosen task. The three records concern declaration, permission and observation. They should not be collapsed into one field called “camera data collected”.

The table shows the conclusion each item permits. Nothing in this example proves that a photograph left the phone or was retained on a server. Equally, refusing camera permission would not by itself prove that the service collects no other information.

Those would be additional questions, requiring different evidence.

Add the task and time window to every actual record. “Opened help at 10:00” and “uploaded an identity photograph at 10:00” describe materially different observations. These times are illustrative labels, not test timestamps.

There is no reason to upload a document for this inspection; if a task asks for one, record the boundary and stop.

Sources: Understand app privacy and security practices with Google Play's Data safety section - Android - Google Play Help; Change app permissions on your Android phone - Android Help; About App Privacy Report – Apple Support (UK).

Publish an observation note that someone can repeat

A useful inspection note identifies the app or domain, device, operating system, app or browser version, task, permission state and reporting window. Give the observation its own wording before adding any interpretation. Mark a screen that could not be reached as uninspected rather than assigning it a failing privacy score.

The result might be a practical usability finding: the explanation for a permission request was hard to find, the refusal route interrupted a nonessential task, or the settings could not be located using the published help. Each finding still requires an actual observation. None is asserted about a real casino by this article.

Keep personal information out of shared notes and retain only the evidence needed to explain the issue. A device log can expose unrelated browsing or app activity, so a whole-phone report is not necessary for a single permission question. This worksheet supports careful inspection; it does not certify security, licensing or freedom from gambling harm.

Sources: Change app permissions on your Android phone - Android Help; About App Privacy Report – Apple Support (UK); Change site settings permissions - Android - Google Chrome Help.