Galaxy A37 5G privacy guide: mid-range settings and AI

The Galaxy A37 5G is Samsung’s middle child: more phone than the A17, half the price of an S26. It reached US stores on April 9, 2026 at $449.99 and sells for $489.99 at Samsung.com today. Its predecessor, the A36, was a global top-10 seller, and the A37 is the model Samsung counts on to sell in volume. The buyer is someone who wants a decent camera and long support without paying flagship prices.

For privacy, the A37 lands in between too. It gets Samsung’s newer Privacy Alerts, a big set of AI features, and six years of security updates, but those patches arrive quarterly, not monthly. And like every US Galaxy, its bootloader can’t be unlocked, so a private OS such as GrapheneOS is out. This guide hardens One UI 8.5 as far as it goes. It’s part of our privacy rundown of the 10 phones Americans buy most.

What you can and can’t fix on the Galaxy A37 5G

You can turn off most of Samsung’s data collection, tighten permissions, lock down theft scenarios and remove a good share of the preloaded apps. Here is what stays:

• One UI for life: US Samsung phones have no OEM unlock, so custom systems won’t install.
• Quarterly patches: Samsung’s update list puts the A37 on the quarterly schedule, alongside the A17, A26 and A36. It does get up to six Android upgrades and six years of security updates, so the phone stays supported a long time.
• Ad sharing by design: Samsung’s US privacy policy says sharing identifiers and online activity for personalized ads “may be considered a ‘sale’”. You can only opt out.
• Undeletable apps: Bixby can be disabled, not removed.

Samsung warns that menu names “may vary depending on the model and software version.” When a path below doesn’t match, search Settings for the name.

Before you start

1. Install everything at Settings > Security and privacy > Updates. With quarterly patches, check again each time a new quarter begins.
2. A carrier-bought A37 follows its carrier’s update timing.
3. Back up photos and contacts before you remove apps with ADB later.

1. Privacy Alerts, then a permission review

Samsung names Privacy Alerts as a feature of the A37 and A57. Samsung describes them as notifications that give “clearer insight and control over location permissions or suspicious monitoring of sensitive data.” You don’t switch them on; they appear when an app oversteps. When one shows up, take it seriously and cut that app’s access.

Alerts only cover what Samsung’s model flags, so do the manual check too:

1. Open Settings > Security and privacy > Privacy > Permission manager.
2. Work through Location, Camera and Microphone. Choose “Only while using”, “Ask every time” or “Don’t allow” for each app.
3. Look at the usage history for the last 24 hours and 7 days.
4. Leave automatic permission removal on for apps you stop using.

The green dot at the top of the screen means the camera or mic is in use; tap it to see who. If your Quick Panel lacks camera and microphone block tiles, tap Edit in the Quick Panel and add them if they’re offered.

2. Awesome Intelligence: know which AI goes where

Samsung calls its A-series AI “Awesome Intelligence”. The launch release for the A57 and A37 lists Voice Transcription in Voice Recorder (including call recordings and voicemail), AI Select from the Edge Panel, Object Eraser, Circle to Search with Google, an upgraded Bixby that changes settings by voice, and Gemini for tasks across apps.

That’s a lot of AI for a mid-range phone, and the privacy question is where each feature runs. Circle to Search and Gemini are Google services. Samsung’s flagship guide documents a Settings > Galaxy AI > “Process data only on device” switch, but Samsung hasn’t confirmed it for the A37. Search Settings for “Process data only on device”. If it’s there, turn it on and accept that cloud-based features stop. If it isn’t, assume features that need a connection send data off the phone.

A sensible middle path:

• Voice Transcription: useful for lectures and meetings, but think before running it on call recordings that include other people.
• Bixby: if you won’t talk to it, go to Settings > Advanced features > Bixby > Leave Bixby, then Settings > Apps > Bixby > Disable.
• Side button: to keep Gemini off the long press, set Settings > Advanced features > Side button > Long press to the power off menu.
• Keyboard: in Settings > General management > Samsung Keyboard settings, turn off what you don’t want under Predictive text, or reset it with Erase personalized predictions.

3. Samsung’s data collection and ad opt-outs

• Send diagnostic data: off, at Settings > Security and privacy > More privacy settings > Samsung.
• Customization Service: collects app usage, Samsung Internet browsing and searches, location and voice for personalized content and ads. Search Settings for “Customization”, turn off the ad consents in your Samsung account’s Security and privacy section, and delete past data at privacy.samsung.com.
• Opt-out request: Samsung says US data may also be used “to develop and train our artificial intelligence algorithms and models.” Use the Samsung privacy rights portal and the Samsung CCPA opt-out.
• Samsung account: optional at setup. Without it you lose Identity check, the Secure Folder reset and some AI features. If you use Samsung Cloud, turn on Enhanced data protection under More security settings, if your model shows it, and store its 28-character recovery code yourself.

4. Private Album and Secure Folder

Samsung added Private Album to the A37’s Gallery: you can lock away photos without a Samsung account. For apps and files, Secure Folder sits at Settings > Security and privacy > More security settings > Secure Folder. Samsung no longer supports Secure Folder backups, so keep a copy of anything you store there.

5. Auto Blocker and Maximum restrictions

Go to Settings > Security and privacy > Auto Blocker and confirm it’s on. It blocks apps from outside Galaxy Store and Play, USB commands, malicious images in messaging apps and uncertified system software.

Maximum restrictions, at the bottom of that page, adds automatic app scanning, a 2G block, no auto-joining of non-secure Wi-Fi, no links or preview images in texts, no Gallery shared albums, and location stripped from photos you share. It breaks work apps that need device admin or a work profile, and it leaves you without service where only 2G works. If the A37 is a personal phone, turn it on.

6. Theft protection and Knox Vault

1. Settings > Security and privacy > Lost device protection > Theft protection: enable Theft detection lock, Offline device lock and Remote lock.
2. Add Identity check if you have a Samsung account and fingerprint set up. Outside your Safe places it requires biometrics and adds a one-hour Security delay.
3. In Lost device protection, review “Allow this phone to be found”, “Send last location” and “Offline finding”.
4. Search Settings for “Lock network” so nobody can kill mobile data without unlocking.

The A37 has Knox Vault, Samsung’s isolated, tamper-resistant security hardware. Samsung’s whitepaper names the A37 but says A-series hardware “may differ” from the flagship design.

7. Google’s side

Delete your advertising ID at Settings > Security and privacy > More privacy settings > Google > Ads, and turn off Usage & diagnostics on the same screen. At myaccount.google.com/activitycontrols, limit Web & App Activity, and in My Ad Center switch off personalized ads.

8. Network settings

• Private DNS: Settings > Connections > More connection settings > Private DNS, set to a filtering resolver. See our Private DNS resolver walkthrough.
• Scanning: turn off Nearby device scanning on the same screen, then Wi-Fi and Bluetooth scanning under their Advanced settings.
• Secure Wi-Fi: Samsung’s free VPN (1024 MB a month). Handy on hotel Wi-Fi, but your traffic then runs through Samsung.
• Per-app blocking: a no-root firewall can stop chatty apps from going online; our per-app firewall guide shows how.

9. Remove preloaded apps with ADB

No root needed; follow our ADB debloat steps, and switch Auto Blocker off for the session because it blocks USB commands. Turn it back on afterwards.

Low-risk choices from the UAD-ng list, disabled with adb shell pm disable-user --user 0 <package>: com.samsung.android.bixby.agent, com.samsung.android.app.spage, com.facebook.appmanager, com.facebook.services, com.facebook.system, com.samsung.android.game.gamehome, com.samsung.android.app.omcagent and com.samsung.android.rubin.app. Undo with adb shell pm enable <package>.

Keep com.samsung.android.fmm (Find) and com.samsung.android.app.updatecenter. Never remove com.sec.android.soagent, com.wssyncmldm or com.samsung.android.kgclient.

Carrier-bought A37s carry more: on AT&T, com.att.myWireless, com.aura.oobe.att and com.digitalturbine.android.apps.news.att; on Verizon, com.vcast.mediamanager and com.verizon.obdm; on T-Mobile, com.tmobile.pr.adapt and com.tmobile.echolocate.

10. Carrier ad settings

• AT&T: personalized ads are on by default. Opt out at att.com/PrivacyChoices, and limit CPNI use at att.com/cpni/optout.
• Verizon: turn off Custom Experience in My Verizon > Privacy preferences, or call 866-211-0874.
• T-Mobile: switch off “Relevant Ads” and “Analytics and Reporting” in the Privacy Dashboard.

Is a private OS worth the switch?

If you would rather not spend an evening on settings, the alternative is a phone that runs a private OS from the start. See our comparison of GrapheneOS, CalyxOS and /e/OS or our list of phones that ship degoogled.

Block apps from the internet with Rethink

One UI can limit apps, but it can’t cut one off completely. Settings > Connections > Data usage > Allowed networks for apps holds an app to Wi-Fi only, and Data usage > Mobile data usage > [app] > Allow background data usage stops it using mobile data in the background. Samsung notes both vary by carrier. To block an app on every network, the Galaxy A37 5G needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play. Auto Blocker stops installs from outside Galaxy Store and Play, and Samsung says apps from other sources can’t update while it’s on, so the F-Droid build would mean switching Auto Blocker off for every update.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: Gallery, Calculator, Voice Recorder, Samsung Notes if you don’t sync it, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Connections > More connection settings > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Connections > More connection settings > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > Battery and choose Unrestricted, so One UI doesn’t put it to sleep.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Samsung’s Secure Wi-Fi and any VPN app compete for the same slot. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps inside Secure Folder run in a separate profile that Rethink doesn’t cover.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Galaxy A37 5G get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Samsung says it’s visible to Bluetooth and Wi-Fi devices. Keep the model name or anything else that isn’t your name.
• Quick Share: Settings > Connected devices > Quick Share > Who can share with you. Pick Contacts or Your devices; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: tap the gear next to a saved network and check that MAC address type reads Randomized MAC.

Photos and finding networks

• Camera: Camera > Settings > Location tags, off. New photos then carry no GPS position.
• Sharing older photos: in Gallery, tick Remove location data on the share screen. Maximum restrictions does this automatically.
• Samsung offline finding: Settings > Security and privacy > Lost device protection > Offline finding. Samsung says this makes your phone a “Find Node” that helps locate other people’s SmartTags and Galaxy devices. If you keep it on, turn on Encrypt offline location.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: Settings > Connections > Wi-Fi Calling > Emergency Address shows the address your carrier keeps on file for 911. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: You can skip the Samsung account at setup, but the Galaxy Store needs one. Google Play needs a Google account, so give it as little as you can.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Samsung Internet: use Secret mode (Tabs > Secret mode). Smart anti-tracking is on by default; leave it that way.
• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• Latest quarterly patch installed
• Permission manager reviewed; Privacy Alerts acted on
• “Process data only on device” found and on, or cloud features avoided
• Bixby left and disabled; side button set to power menu
• Samsung diagnostics and Customization Service off
• Samsung opt-out request sent
• Auto Blocker on, Maximum restrictions on if you don’t need a work profile
• Theft protection and network lock on
• Advertising ID deleted, Private DNS (or Rethink’s DNS) set
• Bloat and carrier apps disabled; carrier ads off
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check the unlocked Galaxy A37 5G on Amazon
affiliate link — same price for you, small commission for us

Compare the A37 with the A17, the S26 line, the Pixels and the moto g phones on our US best-sellers privacy overview.