Which apps can see your photos? A five minute phone check for business owners

October 28, 2026

Your camera roll is a filing cabinet you never meant to share

For most business owners, the phone in their pocket holds far more than holiday snaps. Think about what is in yours right now:

a photo of a client's driver licence taken "just to have it"
a whiteboard from a staff meeting with names and pay figures
screenshots of invoices and bank transfers
job site, clinic or classroom photos with other people's faces in them
your kids, in their school uniform, out the front of your house

Most of that is not yours to share. It belongs to your clients, your staff and your children. Yet every time you tap "Allow access to all photos", an app can see all of it.

The apps most likely to ask

None of these apps are bad. They just tend to ask for more than they need, and most of us tap yes without thinking.

Type of app	Common examples	What to watch for
Social media	Facebook, Instagram, TikTok, Snapchat	Usually only need the photo you are posting. Facebook has offered an opt in feature that processes your camera roll in Meta's cloud to suggest edits.
Messaging	WhatsApp, Messenger	Photos customers send you can save straight into your camera roll, mixing work and family.
AI chat apps	ChatGPT, Gemini, Copilot, Meta AI	Anything you upload leaves your phone. Check whether it is a work or personal account and whether chats are used to train the AI.
Photo editing and design	Canva, CapCut, filter and collage apps	Often ask for every photo when they only need one.
Cloud backup	Google Photos, iCloud, OneDrive	Copies every photo, including client documents, into a cloud account, often a personal one.

App features and settings change often, so check each app on your own phone rather than relying on this list.

Check an iPhone in two minutes

Open Settings, then Privacy & Security, then Photos.
You will see every app that has asked for your photos, with its access level beside it: Full Access, Limited Access or None.
Tap any app showing Full Access and change it to Limited Access (you pick which photos it can see) or None.
For apps you only use to post the odd photo, Limited Access is usually all they need.

Menu names can shift slightly between iOS versions, but the path has been the same for several years.

Check a Samsung or other Android phone

Open Settings, then Security and privacy (on older phones, Privacy).
Tap Permission manager, then Photos and videos (on older phones, Files and media or Storage).
You will see which apps are allowed all photos, limited access or none.
Tap an app and choose Allow limited access (select the photos it can see) or Don't allow.

Can't find it? Go to Settings, then Apps, tap the app, then Permissions. That works on almost every Android phone. Menu names vary by model and software version, so expect small differences.

What the Australian rules say right now

If your business turns over more than $3 million a year, the Privacy Act already applies to you, and that includes photos of clients and staff sitting on work phones. Some smaller businesses are covered too, such as health service providers. Here is where things stand as at late October 2026.

Rule	Who it affects	Where it is up to
Privacy Act 1988 and the Australian Privacy Principles	Businesses over $3 million turnover, plus some smaller ones (for example health service providers)	In force now
AML/CTF Tranche 2 reforms	Real estate agents, lawyers, accountants and other newly captured services, whatever their size, for the information they collect for AML checks	In force from 1 July 2026
Privacy Act tranche 2 exposure draft	Revisits the small business exemption and adds new obligations	Draft only. Released 31 August 2026, submissions closed 18 September 2026. Not law yet
Children's Online Privacy Code	Apps, games and websites covered by the Privacy Act that children are likely to use	Due to be registered by 10 December 2026; start date not yet confirmed

The short version: a photo of a client's ID or a child's face is personal information. If the Act covers your business, you need a reason to collect it, you need to protect it, and you need to be careful about sending it to a third party, which is exactly what an app with full photo access can do.

Make it a team rule, not a one off

You do not need to ban apps. You do need everyone using a phone for work to ask the same four questions.

Whose phone is it? A work phone with client photos needs tighter settings than a personal phone that never touches client data.
Does this app need all my photos? If it only posts or edits one at a time, choose limited access.
Where do the photos go? Backup and AI apps send photos to the cloud. Know which account, work or personal.
Is it written down? One page in your staff AI and privacy policy listing what never goes into an app (IDs, health details, bank details, children's photos) does more than any setting.

The takeaway

Five minutes in your phone settings is one of the cheapest privacy wins your business will get this year. Do your own phone today, then ask your team to do theirs.

Not sure what AI your team is already using? Start with the free AI Exposure Check.

Structure, not AI noise.

Sources

Ashley Ruperto

Founder of Limitless Digital Co, a reference hub on the Australian AI and privacy rules that apply to a small to medium business. Business analyst with twelve years in regulated NSW public sector operations.

Back to Blog