What a Shared Device Exposes
On a device more than one adult uses, the app itself is rarely what gives things away. The leaks are ambient: an icon in an app list, a name in a spotlight search result, a still-signed-in session, an address-bar suggestion, a notification arriving at the wrong moment, an entry in a shared app-store purchase history. Locking the app is the obvious response and it addresses only the smallest of those.
This post is about household devices shared between adults. Nothing here concerns anyone under eighteen, and device-sharing arrangements involving young people are outside this site’s scope entirely.
The surfaces that are not the app
Working through them in roughly descending order of how often they catch people out.
Notifications. A locked screen displays whatever the app sent, to whoever is nearby. This is the most frequent disclosure route by a wide margin, and it has a proper fix: previews only when unlocked, ideally set per app. See notification previews and your lock screen.
Device search. Both platforms index installed apps and, in some configurations, in-app content. Typing a few letters into the phone’s search can surface an app you would rather not surface. Both platforms let you exclude an app from search and from suggestions — it is a per-app setting, and it is not where you would expect to find it.
The app-store purchase history. If the store account is shared, or the payment method is a shared family arrangement, the subscription and the purchase are visible there. That is entirely separate from anything on the device and no device setting affects it. See who you actually bought the subscription from.
The photo library. Screenshots land in the camera roll and sync to whatever shared album or shared library configuration exists. See what a screenshot becomes after you take it.
Browser history and autofill, if you use the web version. An address-bar suggestion after two keystrokes is a real leak, and a private window prevents it.
The keyboard’s learned dictionary, which picks up unusual names and offers them as predictions in every other app. This is a genuinely surprising one and it has its own discussion in what your keyboard can see.
What locking helps with, and what it does not
Some apps offer a passcode or biometric lock. It is worth enabling and it is narrower than it feels.
It protects the contents from casual opening on an unlocked device. That is real and it is the main thing you want.
It does not hide the app’s existence, its icon, its name in search, its entry in the app list, its subscription, or its notifications. All of those are outside the app’s control.
It is not encryption in any meaningful sense unless the app says so. An app lock is usually a screen in front of data that is stored the same way it would be otherwise. Treat it as a curtain rather than a safe.
Platform-level app hiding — a hidden app folder or a locked apps area, which some phones now offer — is stronger, because it removes the app from the list and from search and requires authentication to reach. If your device has it, it is more effective than any in-app lock.
Separate profiles are the real answer, where they exist
The clean solution to a shared device is not to share it at the account level.
Tablets and Android phones commonly support multiple user profiles, each with its own apps, accounts, storage, and photo library. A second profile is a genuinely separate environment, and it solves nearly everything above at once. If a household tablet is the shared device, this is the change to make.
iPhones do not offer this, which is why the iPhone answer is a mixture of the narrower measures above plus, sometimes, using the web version instead of installing anything — see the browser version versus the installed app. No icon, no app list entry, no purchase history entry.
Guest mode, where available, is for handing the device to someone else rather than for your own use, and it is worth knowing exists.
Handing over a device
Two specific moments deserve attention because they are when accidents happen.
Handing a phone to someone to show them something. The phone is unlocked, in someone else’s hands, and may receive a notification. Guided-access or screen-pinning features, which lock the device to a single app until you authenticate, exist for exactly this and are almost never used.
Passing a device on permanently — a spare phone going to a family member, a trade-in, a sale. Sign out of everything, then use the platform’s full erase function rather than deleting apps individually. A factory erase destroys the encryption keys, which is a much stronger guarantee than manual tidying. The migration context is covered in what changes when you switch phones.
What this does not tell you
These are all local, social exposures. They have nothing to do with what an operator collects or retains, and fixing every one of them changes nothing about what leaves your phone.
They also cannot be solved completely on a device with one account and several adult users. The honest summary is that a shared account on a shared device offers limited privacy for anything, and the measures above reduce accidental disclosure rather than provide confidentiality. Where the distinction matters, a separate profile or a separate device is the only real answer — and recognising that early is more useful than layering settings that were never designed to carry the weight.