A note from the workshop
Uninstalling an app is not an access review.
You used a tool once, approved its account access, and moved on. The useful cleanup starts in the account’s connected-app settings, not just the application list on your computer. Review one service at a time so you can understand what will stop working.
Three useful checks
- Open the account directly: Use the provider’s known site and find linked apps or third-party access.
- Read the permission scope: Match access to a feature you still use and recognize the publisher.
- Remove one stale connection: Keep a note of the change and test the features you need.
Put it into practice
Start with a personal account you control. Google’s account documentation explains that linked tools can receive different levels of access. A photo editor and a calendar assistant may need different information. A familiar logo is not a description of the actual scope.
Record the application name, the reason you originally connected it, and whether it still earns that access. Do not paste tokens, account identifiers, or private data into a public checklist. For work-managed accounts, ask the administrator before changing a dependency used by a team.
Revoke one connection you no longer need through the account’s own controls. Test the relevant task afterward. If you reconnect it later, read the new permission request instead of clicking through from habit. Save any needed exports before closing a linked service entirely.
Installation and authorization are separate inventories
Removing an application from a device and removing its account access answer different questions. The first concerns software on that device. The second concerns what a service has been authorized to do with an online account. Start the review from the account’s own settings so you can see the connections the account recognizes.
Google distinguishes basic account information from permissions to view or manage data. That distinction matters more than whether you recognize the logo. A tool that once imported calendar events may still be useful; a forgotten experiment with broad access deserves a closer look. Age alone does not establish misuse, but it can reveal a permission nobody is actively owning.
Review one connection without breaking five workflows
Choose a personal account and one app you believe is no longer needed. Write down what it was meant to do, what access is listed, and which device or workflow still uses it. If you cannot identify the purpose, investigate before making assumptions about shared or business-critical services.
For an invented example, a trip-planning app was allowed to read a calendar to suggest meeting times. You have stopped using it. Confirm that no current booking process depends on it, then remove the relevant account connection using the provider’s controls. Do not interpret a successful removal as proof that historical copies have been deleted by the app’s operator.
- Open the correct account directly and confirm which signed-in identity you are reviewing.
- Inspect the app name, permission description, and any separate connection types.
- Check whether a current workflow depends on that access.
- Remove one unnecessary connection and save a note of the time and purpose.
- Check your normal workflow before changing another connection.
When the app is still needed
Look for a narrower supported permission choice or a way to disconnect the part you no longer use. Do not assume every service provides fine-grained controls. If reconnecting is necessary, read the new authorization screen rather than reflexively approving the previous access again.
Keep the deletion question separate. If you want the app operator to remove information already held, inspect its account and deletion process. If you suspect misuse rather than ordinary clutter, follow the account provider’s security guidance and report the concern through its real support route. An access cleanup is not an investigation that can certify what happened in the past.
Give each remaining connection an owner and a purpose
A useful inventory can be short: app label, job it performs, data it can access, why you kept it, and when to review it again. Exclude tokens and private account contents. Check the inventory when you stop using a tool or change how it works. The result is not an empty permissions page for its own sake; it is an account where each retained connection has a current reason to exist.
Know the limits
Revoking future account access does not guarantee that a third party deletes data it already copied. Review its separate deletion process when that matters.
Remove one unused grant or document why it should remain.
Print the private field sheet. Record actions and observations, not passwords, recovery codes, or private documents.
Keep exploring: the offline AI experiment, lost-phone recovery, or the Recovery Drill.
About this field note
Original CRYPT1K editorial guidance. Sources reviewed October 21, 2026. Procedures are reader exercises; no unperformed hardware, account, or AI test results are claimed. Character and artwork are fictional and AI-assisted.