What Permissions a Mass Deletion Tool Really Needs

Three tiers of authorization

Tier	What the tool receives	Typical implementation	Worst case
On-device parsing	Only the archive file you upload	Processing a ZIP in the browser or a local app	Data never leaves your machine
Scoped API access	Read your public posts and perform deletions	OAuth with narrowly requested scopes	Public content and delete rights, no direct messages
Full account access	Public and private content, DMs, social graph, settings	Asks for your password or very broad scopes	Equivalent to handing over a long-lived copy of your account

The gap between the second and third tier is not technical difficulty. It is whether the tool chose restraint or convenience. A third-party tool asking for your password has no reason to exist: the platform's scope mechanism is sufficient for deleting posts.

What each tier can actually see

Tier one is capped at the archive contents, meaning whatever you chose to hand over. An archive does not carry direct message bodies, a complete follower snapshot or account settings. Even if the tool itself is untrustworthy, the exposure is limited to the file you supplied.

Tier two reads public content. A tool can walk your posts, analyze word frequency and find the ones containing phone numbers. It cannot read DMs and cannot change your account settings. The grant can be revoked from the platform's connected-apps list at any time, and the token dies immediately.

Tier three is far blurrier. Broad scopes tend to include reading DMs, viewing follows and followers, and reading the account email. None of that helps with deletion, and all of it is raw material for profiling and outreach. To judge whether a grant is excessive, count how many requested scopes have nothing to do with removing posts.

Five minutes to spot an over-broad grant

1. Does it ask for your password? Anything that does is out, no exceptions.
2. Count the scopes on the consent screen. Three or four is usually reasonable. Past seven or eight, read each one.
3. Look for a read-DMs entry. Deleting public posts does not require message access, so its presence settles the question.
4. Confirm a revocation path exists. It is only manageable if you can find the revoke button in the connected-apps list.
5. Check whether the privacy policy states a retention period. A page that says it values your privacy without naming a number of days has not answered.

Step three is the most efficient single test. A tool that only deletes public posts has no functional need for message scope, so requesting it signals convenience for someone else. The full audit process is in auditing third-party app access.

Two things to do after granting access

Whichever tier you pick, go back to the connected-apps list once the deletion job finishes and revoke anything you no longer need. Grant it again next time you use it. The cost is one click.

The second item is checking logged-in devices. Revoking an app does not touch existing sessions. Both checks are covered in reviewing login devices.

About Digital Footprint Health

Digital Footprint Health (digital-footprint-health.shop) sits in tier one. You upload your X archive and everything, parsing and scoring alike, happens on your own machine with no upload and no account permission requested. Run a free check from the homepage to see your risk list; authorization only comes up if you choose to delete, with scope and pricing on the pricing page and further tool comparisons throughout the blog.