Not using a service isn’t the same as revoking access

Calendar integrations serve a useful purpose: a scheduling tool can find available time slots and, with the right permissions, add a confirmed booking directly to your calendar. To do that, it needs to stay in sync as new events are added – otherwise it wouldn’t know about the events you add today.

The calendar integration can keep working even when you don’t have the website open. No longer using the service or uninstalling its app doesn’t necessarily revoke the permission you granted it. As long as the permission remains in place, the service can still access the data it covers.

Signing in isn’t the same as granting access to your data

“Sign in with Google” doesn’t mean “share my calendar.” When you sign in this way, Google passes on basic profile information such as your name, email address and profile picture. The third-party service does not receive your Google password. Signing in helps it create your account or recognize you when you return.

To read emails or access calendar details or files in Google Drive, the service needs additional permissions that you explicitly grant. However, signing in and granting permissions may be part of the same setup process. Later, you may not remember that you also granted access to your data.

In your account settings, the same app may have both a sign-in connection and additional permissions. The number of linked services doesn’t tell you how many are allowed to read your emails.

Start with the account that holds your data

To revoke access, you don’t need to reopen the forgotten scheduling tool and hunt for the right setting. Instead, go to the account where your data is stored. Its connection settings show the permissions you’ve granted and let you revoke access you no longer need.

Three common places to check are:

• Google Account: for Gmail, Google Calendar, Google Drive and Contacts
• Personal Microsoft account: for your online mailbox and calendar in Outlook.com, as well as files in OneDrive
• Dropbox account: for files and folders in your Dropbox

If you have more than one account, check the email address shown: each list applies only to the account you’re currently signed in to. You can do this in your browser – whether you’re using Windows, a Mac or Linux.

Google: check what each service can access

Open your Google Account settings and look under “Security & sign-in” for connections to third-party apps and services. On the “Third-party connections” page, follow these steps:

1. Open the “Access to your Google Account” view. The “Sign in with Google” view covers the sign-in method described earlier; on its own, it doesn’t tell you what further access a service has to your data.
2. Select the service in question. If more than one connection type is shown, look for the section “[App name] has some access to your Google Account.”
3. Select “See details” and review the listed permissions. Two things matter: which data the permission covers and what the service is allowed to do with it.

Access limited to Google Calendar does not automatically include access to Gmail, Photos or Contacts. It also matters whether a service is only allowed to read and copy events or can also edit, create and delete them. Even “read” access can have different scopes: a service may only be allowed to see which time slots are free or busy in your calendar, without seeing event titles or details. Knowing that you’re busy at a particular time isn’t the same as knowing you have a doctor’s appointment. So when checking that old scheduling tool, look at the verbs and the scope of access, not just the word “calendar.”

If you still use automated appointment booking, it makes sense for the service to be able to create events. But for a service you tried and abandoned long ago, that reason no longer applies. If you don’t recognize an entry, first identify the service or feature behind it. For every connection, check that all the listed permissions match the features you still use. This applies to Google, Microsoft and Dropbox alike.

If access is no longer needed, select “Remove access” and confirm. Don’t blindly remove sign-in-only connections if you still need that sign-in method.

Microsoft: permissions for your personal account

In your personal Microsoft account, you can manage permissions from the “Overview” page under “Privacy.” Look for “Other privacy settings” and “Apps and services.” The entry you need is called “Apps and services that can access your data.” Review the service in question and its permissions. To revoke access, select “Remove these permissions.”

These permissions relate to your online data, for example in Outlook.com or OneDrive. This is not the permissions manager for the Outlook application on your PC, nor do these permissions grant blanket access to local files. For work or school accounts, connections may be managed centrally.

Dropbox: check the scope of access

Sign in to the Dropbox website. Select your profile picture or initials, then “Settings” and “Apps.” Open an app’s entry and check under “Permissions” to see what access it has. Select “Disconnect” to remove the connection.

An app may be limited to individual files or an app folder, or it may have access to your entire Dropbox. What an app can read, edit or manage also depends on the permissions actually granted. So a connection does not automatically mean full access to all your files.

What revoking access stops – and what it doesn’t

When you revoke permission, the service can no longer use it to access your data. As a result, features such as syncing, imports or calendar updates may stop working. For example, a scheduling tool will no longer add new bookings to your calendar through that connection. If you need the integration later and it’s still available, you can set it up again.

Revoking access does not, however, delete your user account with the third-party provider. Copies of data already transferred don’t automatically disappear either. If you want those copies deleted too, you’ll need to contact the provider separately.

You can remember that old flame fondly – without letting it keep reading your new calendar events.

While checking your connections, did you find a service you’d long forgotten? If you’d like, tell us in the comments which connection surprised you – however, do leave out account details and private calendar entries...