Uninstalling App Doesn't Revoke Google Sign‑In Permissions

The "Sign in with Google" button offers a quick one‑tap login, but it stores access tokens on Google’s servers that remain active even after the app is removed.

How permissions work

When the button is used, the service receives an access token saved in Google’s cloud. Uninstalling the app does not send a revocation request, so the service can still access data as long as the token is valid.

Google documents three automatic revocation scenarios: the user revokes the permission, six months pass without token use, or the Google password changes if the token includes Gmail scopes. Tokens also expire when a user exceeds 100 tokens for the same client, when a temporary grant ends, or when a system admin blocks the token.

What does not trigger revocation

App deletion is not among the listed cases, and the six‑month rule only starts counting when the token is idle. Consequently, background sync services for contacts or calendars can keep their tokens alive indefinitely if they are used regularly.

In June 2025 Google added a cleanup routine that deletes developer accounts inactive for six months, which stops Google‑Sign‑In for those accounts and invalidates associated tokens, but it does not affect regular user apps.

What users should do

To stop an app or service from accessing a Google account, removing the app or merely changing the password is insufficient. Users must go to their Google Account settings and manually revoke the specific app’s permission.

This revokes any lingering tokens and prevents unwanted access to Gmail, Drive, Calendar, or other linked services.