A method (400, 500, 510) of restricting transfer of information from a user device to an external computing device through an application (107a, 212) loaded onto the user device, the method comprising: receiving (401, 501, 511) information; determining (402, 502) whether the application (107a, 212) has access to an external computing device by reading a list (112, 212b) of network addresses in the application (107a, 212) and determining that the application (107a, 212) does not have access to an external computing device if the list (107a, 212) does not include one or more network addresses and determining that the application (107a, 212) does have access to an external computing device if the list (112, 212b) includes one or more network addresses; when the application (107a, 212) does not have access to an external computing device, providing the information to the application (107a, 212); and when the application (107a, 212) has access to an external computing device, (i) determining that one or more network addresses are authorized by: decrypting a signature in the application (107a, 212) into a decrypted value, the signature being associated with the one or more network addresses; comparing the decrypted value with a predetermined value; and if the decrypted value matches the predetermined value, determining that the one or more of the network addresses are authorized; (ii) when the one or more network addresses are authorized, requesting (403, 503, 515) user consent for providing the information to the application; and (iii) providing (404, 504, 516) the information to the application (107a, 212) only if user input indicating consent is received. receiving (401, 501, 511) information; determining (402, 502) whether the application (107a, 212) has access to an external computing device by reading a list (112, 212b) of network addresses in the application (107a, 212) and determining that the application (107a, 212) does not have access to an external computing device if the list (107a, 212) does not include one or more network addresses and determining that the application (107a, 212) does have access to an external computing device if the list (112, 212b) includes one or more network addresses; when the application (107a, 212) does not have access to an external computing device, providing the information to the application (107a, 212); and when the application (107a, 212) has access to an external computing device, (i) determining that one or more network addresses are authorized by: decrypting a signature in the application (107a, 212) into a decrypted value, the signature being associated with the one or more network addresses; comparing the decrypted value with a predetermined value; and if the decrypted value matches the predetermined value, determining that the one or more of the network addresses are authorized; (ii) when the one or more network addresses are authorized, requesting (403, 503, 515) user consent for providing the information to the application; and (iii) providing (404, 504, 516) the information to the application (107a, 212) only if user input indicating consent is received. (i) determining that one or more network addresses are authorized by: decrypting a signature in the application (107a, 212) into a decrypted value, the signature being associated with the one or more network addresses; comparing the decrypted value with a predetermined value; and if the decrypted value matches the predetermined value, determining that the one or more of the network addresses are authorized; decrypting a signature in the application (107a, 212) into a decrypted value, the signature being associated with the one or more network addresses; comparing the decrypted value with a predetermined value; and if the decrypted value matches the predetermined value, determining that the one or more of the network addresses are authorized; (ii) when the one or more network addresses are authorized, requesting (403, 503, 515) user consent for providing the information to the application; and (iii) providing (404, 504, 516) the information to the application (107a, 212) only if user input indicating consent is received.