Can apps see my browsing history? The 5 ways they can

Short answer: on an iPhone or a current Android phone, an ordinary app cannot read your browser's history, because each app runs in its own sandbox. Apps learn what you browse in other ways: their own in-app browsers, trackers on websites, a keyboard with full access, an Android accessibility permission, or a VPN or filtering app.

That is why an ad can seem to know what you were just reading without any app having looked at Safari or Chrome. Here is how each route works and how to close it.

Why apps cannot read your browser directly

Both phone platforms are built on the idea that one app cannot reach into another.

Apple's platform security guide says "All third-party apps are sandboxed," and that sandboxing "is designed to prevent apps from gathering or modifying information stored by other apps." An app that needs anything outside its own space can get it "only by using services explicitly provided by iOS" (Apple Platform Security). There is no iOS service that hands Safari history to another app.

Android gives each app its own user ID and builds a kernel-level sandbox around it (Android Open Source Project). Android used to have a shared browser history that apps could request, but Android 6.0 removed it: the READ_HISTORY_BOOKMARKS and WRITE_HISTORY_BOOKMARKS permissions "are removed" and apps were told to store bookmarks internally (Android Developers). Old forum answers that say "any app can read your history" date from before that change.

Computers are different. On Windows, macOS and Linux, a program you install usually runs as you. Google's Chromium security FAQ puts it plainly: "The attacker's code, when it runs as your user account on your machine, can do anything you can do" (Chromium). On a computer, be as careful about what you install as you would be about who uses it.

1. In-app browsers: the app is the browser

Tap a link inside Instagram, Facebook, TikTok or many other apps, and the page often opens inside the app instead of in Safari or Chrome. Whether the app can see what you do there depends on which kind of in-app browser it uses.

The kind that cannot see. On iPhone, apps can use Apple's SFSafariViewController. Apple's documentation says "Interactions with the web interface aren't visible to your app, and you can't access AutoFill data, browsing history, or website data" (Apple Developer). On Android, the equivalent is Chrome Custom Tabs, which run in your own browser and share its state.

The kind that can. Apps can also build their own browser on a web view. Google's Custom Tabs guide notes that a WebView is the right tool "if you need to inject javascript directly from your app" (Chrome for Developers). An app that injects JavaScript into the pages you open can, technically, observe them.

In August 2022, the security researcher Felix Krause tested this on iOS. He reported that TikTok's in-app browser subscribed to every keystroke and every tap on third-party websites opened inside it, and that Instagram and Facebook injected their own code into pages. TikTok told Forbes the code existed but was used for debugging and performance monitoring. Krause's page now carries his own caveat: it is dated, and it "does not claim that any data logging or transmission is actively occurring," only that the capability was there (Felix Krause).

Test an app yourself. Send yourself a link to inappbrowser.com, open it from inside the app you are curious about, and the page lists the JavaScript commands it detects. One blind spot, which Krause points out: code run in a separate, isolated context can still read the page without the page detecting it, so a clean result is not proof that nothing ran.

The fix is simple: open links in your real browser. Most in-app browsers have an option for it in their menu, or copy the link and paste it into Safari or Chrome.

2. Trackers on the websites you visit

Most "how did this app know" moments come from the websites, not the phone. Sites embed scripts from ad companies, and those scripts report your visit back. If the same company also has your app login, it can join the two.

In June 2025, researchers disclosed a sharper version of this on Android. They found that the Facebook and Instagram apps, and several Yandex apps, listened on fixed local ports on the phone, while the Meta Pixel and Yandex Metrica scripts on websites sent identifiers to those ports from the browser. That let the companies link mobile browsing to the identity in the app, and the researchers wrote that it "bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls." They also built a test app showing that a third-party app listening on the Yandex ports could collect the addresses of sites visited. The page records that Meta's script stopped sending to localhost on June 3, 2025, and that Yandex also stopped (Local Mess).

The lesson outlasts that specific trick: incognito mode hides your browsing from your own device, not from trackers on the page (more on what incognito leaks). A browser or extension that blocks tracking scripts cuts this route at the source.

3. Keyboards with full access

A third-party keyboard sees everything you type in it, including what you type into a search box or address bar.

On iPhone, Apple limits that. Without what Apple calls open access, the full access setting for that keyboard, "the system ensures that keystrokes cannot be sent back to you or anywhere else," Apple tells keyboard developers. With it, the keyboard "can send keystrokes and other input events for server-side processing." iOS also swaps in its own keyboard whenever you tap a secure text field such as a password box (Apple Developer).

Check it: go to Settings > General > Keyboard > Keyboards (Apple), tap any third-party keyboard and see whether it has been allowed full access. Remove keyboards you do not use.

On Android, any keyboard you install can see what you type into it. Stick to keyboards from companies you would trust with your passwords.

4. Android accessibility permission

Accessibility services exist to help people use their phones, such as screen readers. To do that, an accessibility service can read what is on screen, including the address bar of your browser. Google Play restricts who may claim to be an accessibility tool, and apps that use the API for other purposes must show a prominent disclosure and get consent. Play specifically says that "antivirus software, automation tools, assistants, monitoring apps, cleaners, password managers, and launchers" are not accessibility tools (Google Play policy).

Check it: open Settings > Accessibility and look at the installed services. Anything you do not recognize, or did not knowingly turn on, should go.

5. VPN, ad-blocking and filtering apps

An app that sets up a VPN on your phone carries all of your traffic. On Android, Google's own reference for VpnService says each read from the VPN interface "retrieves an outgoing packet" and that "Letting applications intercept packets raises huge security concerns." That is why Android asks your permission first and shows a notification while a VPN is running (Android Developers). Some ad blockers and "cleaner" apps use the same mechanism without being VPNs at all.

Such an app sees the sites your phone connects to, not the contents of HTTPS pages, unless it also got you to trust its own certificate. We map who sees what once a tunnel is up in what a VPN hides, and from whom.

If you use a VPN, choose one that says precisely what it does not keep. Secria VPN keeps no activity logs: we do not record browsing, DNS queries or traffic contents.

What about apps from the same company as your browser?

This is not an app reading your browser. It is your account. If you are signed in to Chrome and sync history, and the setting "Include Chrome history and activity from sites, apps, and devices that use Google services" is on, your Chrome history is saved to your Google account (Google Account Help), where other Google apps on the same account can use it. The same applies to any company whose browser and apps share one login.

Can apps track me across other apps and websites on iPhone?

Not with your permission switched off. App Tracking Transparency makes apps ask before they "track your activity across other companies' apps and websites." If you choose Ask App Not to Track, the app cannot access your advertising identifier and "is also not permitted to track your activity using other information that identifies you or your device, like your email address" (Apple Support). Review your choices in Settings > Privacy & Security > Tracking.

A two-minute phone check

iPhone: Settings > General > Keyboard > Keyboards, check full access for each third-party keyboard.
iPhone: Settings > Privacy & Security > Tracking, switch off tracking for apps that do not need it.
Android: Settings > Accessibility, remove services you do not recognize.
Android: Settings > Security & privacy > Privacy > Permission manager, review which apps hold sensitive permissions (Android Help). Menu names vary by phone maker.
Both: check for VPN apps you did not install on purpose, and open links from social apps in your real browser. For what a VPN you do trust can see, read can my VPN see my browsing history.

FAQ

Can apps see my search history? Not from your browser. An app sees searches you make inside that app, and searches made in its own in-app browser if it uses a web view. Search history saved to your Google account is visible to apps signed in to that account.

Can Instagram or TikTok see what I search on Google? Not by reading your browser. An app that builds its own in-app browser is technically able to observe pages opened inside it, and websites with their tracking code can report your visits back to them.

Can apps see my incognito history? There is no incognito history for them to read. Trackers on the pages you visit work in incognito mode too, which is where most of the leakage happens.

Can an app see my browsing history on Wi-Fi? Not from being on the same network. The router owner can see the sites your device connects to, which is a different question we cover in can the Wi-Fi owner see my history.

Your browser is walled off. The leaks come from the apps you give extra powers to, so the fix is to give fewer of them.