Windows has a permission called notification access. Turning it on lets an application receive every notification the system shows you: the app it came from, its title, its body text, and the moment it arrived.
That is a broad permission, and being uneasy about it is the correct reaction. It is also a narrower permission than most people assume.
What the permission actually grants
Windows hands notifications to applications through a listener. An app holding notification access receives, for each notification displayed, the name of the application that raised it, its title and body text, the time it arrived, and whether it is still in the notification centre.
That is the list. It is not a keylogger, a screen reader or a file browser. Notification access does not reach:
- your files, folders or drives
- your keystrokes or clipboard
- the contents of any window
- your microphone, camera or location
- anything in an application that did not raise a notification
An app that wants those needs separate permissions, and Windows asks for them separately.
Why it is still sensitive
Because of what people put in notifications.
- Verification codes. Many authenticator and banking apps show the code in the toast itself.
- Message previews. Chat and mail notifications routinely carry the first line of the message and the sender's name.
- Amounts and balances. Payment apps show the sum and often the merchant.
- Calendar detail. Meeting titles reveal the shape of your week to anyone reading them.
- Health, HR and legal apps. Anything that notifies you also summarises itself in the notification.
The risk is not the breadth of the permission. It is the density of what flows through it.
Six questions to ask before granting it
These apply to any app, including ours.
- Does the app have network code at all? "We don't sell your data" is a policy. "The application makes no network requests" is a property you can check with Windows Firewall, Resource Monitor, or by pulling the network cable and seeing whether it still works.
- Where is the data stored, and can you look at it? A database file you can find on disk is auditable. A store you cannot locate is not. Find the path before you install.
- Can you delete it, all of it, on demand? There should be a way to clear the history from inside the app, and removing the app should remove the data. Check what the uninstaller leaves behind.
- Is there an account? An account implies a server, and a server implies a copy. A tool with no sign-in has nowhere to send anything.
- Can you exclude applications? The strongest control in this category is not encryption, it is not recording in the first place. If you can tell the tool to ignore your banking app, that stream never enters the database.
- Is the export readable? An app that exports to CSV or JSON is one you can leave. A proprietary store is one you can neither audit nor migrate away from.
How to see and revoke notification access
Windows 11: Settings → Privacy & security → Notifications. The top toggle, Let apps access your notifications, is the master switch, and every app that has requested the permission is listed below it with its own toggle.
Windows 10: Settings → Privacy → Notifications, same structure.
Two things worth doing on that page whether or not you install anything. Read the list, because most people have granted this to something they no longer use. Then turn the master switch off and see what breaks; if nothing does, leave it off.
Revoking takes effect at once. An app that loses the permission stops receiving new notifications immediately. It does not lose what it already stored, which is what the delete function is for.
Reduce what is in the stream
Independent of any app, you can make notifications carry less.
- Hide previews at the source. Teams, Outlook, WhatsApp, Signal and most banking apps have their own show message preview setting. Off, the notification says "New message" and the content never leaves the app.
- Turn off lock screen notifications. Settings → System → Notifications has a Show notifications on the lock screen checkbox. A locked machine on a desk is the most common way notification content is read by someone else, and no software is involved.
- Move two-factor codes to an authenticator that does not put the code in the toast. Codes are the highest-value item in the stream.
- Turn notifications off for apps you never act on. Fewer notifications is better privacy and better attention at once.
What a notification history is worth against all that
Windows keeps almost nothing. The notification centre holds a handful of items per app, it empties on restart, and Clear all cannot be undone. If you have ever needed to know what a notification said an hour after it arrived, you have met the limit.
A history closes that gap: a searchable, timestamped record of what was displayed, filterable by app or date and exportable.
Notification Logger stores notification content in a local database on your device, and its privacy policy states that this content is not sent to GagarinSoft or to any cloud storage. It cannot recover notifications that arrived before it was installed, and like everything in this category it works only while notification access is granted.