Even if you aren’t playing Pokemon Go, you know people — probably a lot of people — who are. And that means you, and your friends, should keep an eye on the permissions the popular app wants to access on your phone.

The issue affects iPhone (iOS) users who download the App Store’s current #1 app (beating out Facebook, Instagram, Google Maps, Snapchat, and Uber). As The Verge and others have reported, Pokemon Go requires access to your entire Google account on iOS. (It also reportedly happens on some, but not all, Android phones.)

That means the app has access to your e-mail, your location data, your browsing history, and anything else you let Google store and have access to. (You can see and change how much that is by looking at your Google activity.)

The good news is, you can go into your Google settings and remove Pokemon Go’s access pretty easily — if you need a guide, Lifehacker has a quick one.

Pokemon Go is made by Niantic, and in many ways it’s built on the same tech as Niantic’s previous augmented reality game, Ingress. And until 2015, Niantic was a Google company — so you can see how such a request might happen thoughtlessly rather than intentionally.

And as The Guardian reported, the slip did come from using an outdated sign-on process. But that doesn’t make it right, of course.

For its part, Niantic says the access request was unintentional, that none of the personal data has been accessed, and that it is updating the app to change the permissions it seeks. In a statement to press, Niantic said:

We recently discovered that the Pokémon GO account creation process on iOS erroneously requests full access permission for the user’s Google account. However, Pokémon GO only accesses basic Google profile information (specifically, your User ID and email address) and no other Google account information is or has been accessed or collected. Once we became aware of this error, we began working on a client-side fix to request permission for only basic Google profile information, in line with the data that we actually access. Google has verified that no other information has been received or accessed by Pokémon GO or Niantic. Google will soon reduce Pokémon GO’s permission to only the basic profile data that Pokémon GO needs, and users do not need to take any actions themselves.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.