Flatpak runs desktop apps in a sandbox that limits their access to the host system. Fixing an app’s access to a file or device and cleaning up its stored data are separate jobs: the right control depends on whether access comes from a static override, a portal grant, or app data left on disk.
Give an app the narrowest access that solves the problem; remove its stored data only when you mean to delete it.
Overrides and portal permissions control different kinds of access
A static override is a setting that changes an app’s sandbox permissions. Flatseal can manage overrides for access such as filesystems, devices, sockets, and network connections. A portal permission is a dynamic grant made through a desktop service when an app requests access to something specific, such as a file selected by the user. Flatseal can manage certain portal permissions as well as static overrides, according to its upstream documentation.
The distinction helps narrow down the fix. If an app needs continuing access to a particular folder, a filesystem override may fit. If it needs a file you select through a chooser, a portal can grant access to that selected file without giving the app broad access to your files. KDE’s Flatpak KCM manages portal interactions and remembered grants, including screencast and remote-desktop sessions, within KDE System Settings. Flatseal also covers some portal permissions, so the tools overlap; the KCM is the KDE-integrated option. KDE’s project documentation describes its portal focus.
Grant access to a specific path where possible
Flatpak’s home filesystem permission reaches across your home directory, with an exception for ~/.var/app. That is broader than granting access to one folder. Flatpak recommends using portals where they fit, or narrower filesystem permissions; when an app only needs to read files, a read-only grant such as :ro can limit what it can do. The Flatpak sandbox guide explains these permission scopes.
For example, if an app cannot open files in one project folder, a grant for that folder is a more limited fix than access to your entire home directory. If a file chooser can handle the task, it provides another way to give the app access to a file you choose. Broad access can weaken the sandbox boundary, so grant only what the app needs for the task.
Choose a tool by the job
| Your task | Tool or command | What it manages |
| Change an app’s filesystem, device, socket, or other static sandbox permissions | Flatseal or flatpak override | Static permission settings and user overrides |
| Manage portal permissions, including remembered grants in KDE | KDE Flatpak KCM or Flatseal | Portal interactions; Flatseal also manages static overrides |
| Inspect or delete an app’s stored user data | Warehouse | App data and related management tasks; its README assumes the default ~/.var/app location |
| Remove unused Flatpak references, such as runtimes | flatpak uninstall --unused | Unused references, not an individual app’s stored data |
| Repair installation inconsistencies | flatpak repair | Invalid or missing repository objects and references |
Flatseal is the relevant choice when you need to adjust an app’s static sandbox access; KDE Flatpak KCM is useful for portal settings integrated with KDE. Warehouse handles app-data tasks, along with features such as snapshots, remote management, and batch actions. Its upstream README says it assumes app data is stored in ~/.var/app and describes it as a tool that facilitates Flatpak operations, rather than replacing Flatpak.
Uninstalling an app does not always delete its data
Flatpak stores persistent app data under ~/.var/app/$FLATPAK_ID, including redirected data, configuration, cache, and state locations. A normal uninstall may leave that data in place for a later reinstall. To remove the app and its stored data from the terminal, use:
flatpak uninstall --delete-data APP_ID
This option deletes the app data and associated permissions. Review the selected app or reference before confirming: the data will not be kept for a reinstall. The Flatpak command reference describes the command and data location, while Flathub’s uninstall guide explains the difference between ordinary uninstall and deleting app data.
flatpak uninstall --unused has a different purpose: it removes unused references, such as runtimes, rather than the app’s personal data. And flatpak repair addresses problems with installation objects and references; it is not a cleanup command for leftover app data.
