The short answer: Notification access lets an app receive a copy of every notification your phone posts — sender, text, app, and often the attached image — plus the ability to dismiss them. It is granted device-wide, not per app, and Android deliberately makes you turn it on from a full-screen warning rather than a normal permission prompt. The only question that matters is where the app sends what it reads.
If you have installed a smartwatch companion, a car head-unit app, an automation tool or a notification saver, you have met this screen: a warning that the app will be able to read all your notifications, and a toggle that Android will not let another app tap for you.
It is worth understanding properly, because it is one of the broadest permissions on the platform and the warning text does not explain much.
What the permission grants
Technically the app registers a NotificationListenerService. Once you enable it, Android calls that service every time a notification is posted or removed, and hands over:
- the package that posted it, and the channel it used
- the title and text — for a message, that is the sender’s name and the message preview
- the timestamp, and whether it is ongoing, silent or a group summary
- any large icon or image attached, such as a photo in a chat notification
- the actions on the notification, including the ability to trigger them
It also allows the app to dismiss notifications, and to snooze them. That is how “clear all” buttons in third-party apps work, and how a watch dismissing a notification clears it from your phone.
In short: everything you can see on your own lock screen, an app with this permission can also see — and act on.
What it does not grant
Just as important, because the warning implies more than is true:
- It is not access to the apps themselves. It does not open WhatsApp’s database, read your message history, or see anything that never produced a notification.
- It does not reach backwards. The service is only called for notifications posted while it is running. Nothing from before you granted access is available, ever.
- It cannot send messages as you. It can trigger a notification’s own actions — a “Reply” action exists on some notifications — but it does not get general control of other apps.
- It is not the internet. Reading notifications and transmitting them are unrelated. An app with notification access and no network permission cannot send anything anywhere.
That last distinction is the whole basis for judging one of these apps, and it is the one people most often collapse into a single worry.
It is device-wide, not per app
This surprises people, and it matters.
You do not grant notification access “for WhatsApp”. You grant it to an app, once, and from then on that app receives notifications from everything on the phone — your bank, your work email, your two-factor codes, all of it.
Android provides no mechanism to grant it for a subset of apps. Any filtering happens inside the receiving app, by its own choice, after it has already been handed the notification. So “this app only reads the apps I selected” is a statement about the app’s behaviour, not about a restriction the system is enforcing.
Filtering is the receiving app's own choice, not something Android enforces — so it is worth checking that an app offers it at all. Here every app is opt-in, and anything not added is ignored and never stored.
Which makes the per-app controls inside these apps worth looking for. An app that captures everything by default, with no way to exclude your banking notifications, has made a different decision than one where nothing is captured until you add it.
How to see what already has it
Worth checking periodically, and especially after installing anything that asked:
Settings → Notifications → Notification access
On some phones it is Settings → Apps → Special app access → Notification access, and on Samsung it may appear as “Notification access” under Settings → Apps → Special access. Searching Settings for “notification access” finds it on any build.
The screen lists every app that has requested it and shows which are enabled. Turn off anything you do not recognise or no longer use. Revoking takes effect immediately, and the app stops receiving notifications from that moment.
How to judge whether an app should have it
Three questions, in order of how much they tell you:
- Does it need the internet at all? An app that reads notifications and has no reason to transmit them should say so, and its permission list should back that up. You can check the permissions of any installed app under Settings → Apps → [app] → Permissions, and on the Play listing under “App info”.
- Does its privacy policy describe notification content specifically? A generic policy that never mentions the notification text it is reading is a bad sign. A specific one will say where the text is stored and whether it leaves the device.
- Does it require an account? An account implies a server, and a server implies your notifications potentially reaching it. Not automatically bad — a watch companion has to send things to the watch — but it should match what the app is for.
For what it is worth, NotiWeave answers these as: no account and no sign-up, no NotiWeave server, notifications kept in a private database on the device, apps opt-in one at a time, and one tap to clear everything captured. Nothing it captures is ever handed to anyone else.
Why it sometimes stops working on its own
A quirk worth knowing, because it looks like a bug in the app rather than what it is.
The toggle can read “on” while nothing is actually being delivered. Updating an app breaks the system’s binding to its listener until something reconnects it, and on manufacturer skins that kill background apps aggressively — Xiaomi’s MIUI in particular — the app may be prevented from reconnecting at all.
The fix is to toggle the app off and back on in the Notification access screen, which forces a fresh bind. If it recurs, the cause is the manufacturer’s background limits, covered in why Android notifications go missing.
Common questions
Is notification access safe?
The permission itself is a normal, documented Android API, and it is the only way an app can read another app’s notifications — which is why every app in this category asks for it. The risk is not the permission, it is what the specific app does with what it reads. Judge the app, not the toggle.
Why does Android show a full-screen warning for it?
Because of the breadth described above, and because it cannot be scoped. Android also blocks other apps from tapping the toggle for you, so the grant has to be a deliberate act.
Can an app read my banking notifications or 2FA codes?
Yes — anything that posts a notification is visible to it, and that includes one-time codes. This is the strongest argument for keeping the list of apps that hold this permission short, and for preferring apps that let you exclude sensitive apps from capture.
Does it drain the battery?
Not meaningfully. The service reacts to notifications you were already receiving rather than polling for anything. The more common problem is the reverse — the system suspending the listener.
What happens if I revoke it?
The app stops receiving notifications immediately. Anything it already saved stays saved, since that data is in its own storage; if you want that gone too, clear it in the app or uninstall it.
What else uses this permission?
Smartwatch and fitness-band companions, car head-unit apps, automation tools such as Tasker, notification savers, and apps that replace a notification’s sound — including a per-caller ringtone for WhatsApp and Instagram calls, which is only possible because the call arrives as a notification.
Is this how notification history apps work?
Yes. Notification savers write each notification to a local database as it arrives, which is also why they can still show a message that was later deleted in the app that sent it.
The permission is unusually broad and unusually honest about it. Grant it deliberately, to as few apps as you can, prefer the ones that let you decide which apps are read, and check the list in Settings occasionally — the apps that requested it a year ago are still receiving everything.