On any android device 99.5% of the apps want the permission "Write / Read contents of SD card" in a combination with "Full network access".
Theoretically these 2 permissions are enough for the app to read all of my personal files (cloud storage) and send them to their server. Is there a way to only permit apps access to their folders?
Why do all apps have access to all folders? Why is such a basic concept not implemented?
Folder level permissions are not a good choice for sdcard (whether it is emulated or external). It makes things more complicated.
By default, sdcards are mounted noexec, no binaries are able to execute from sdcard. Needless to mention, many external sdcards at the moment are formatted with fat32, permissions arent an option for them.
Every app has their own uid/gid. If an app has to have exclusive read/write permissions (preventing other apps to read that content) onto a folder on sdcard, then chances are that the folder is inaccessible to other apps. This kind of situation breaks things.
For eg, Music files go under Music folder on sdcard. If that folder has exclusive permissions to only a particular music app, then U cannot have multiple music players on your device.
Another example is a third party file manager cannot even access all the content on sdcard, which makes file manager pointless.
If at all such concept is available, chances are that android/google enforces sorting of files/folders on our sdcards. I wouldn't prefer that. I would rather like to have files/folders sorted the way I prefer, not the way someone enforces me to.
Why do all apps have access to all folders?
That's because that's the explicit purpose of external storage, to share data between applications that have not necessarily been designed to work together.
If an application you use is storing private data in external storage, stop using that application. Application developers and users alike often got the misconception that external storage is for storing large files. That thinking is wrong and dangerous. If a data isn't intended to be shared, they should be stored in the internal storage, no matter how large they are. Another dangerous misconception is equating external storage with SD Card.
Why is such a basic concept not implemented?
That's an incorrect assumption. As of Android 4.4, applications can access an application specific directory in the external storage without holding the broad READ_EXTERNAL_STORAGE/WRITE_EXTERNAL_STORAGE permission. Starting from Android 4.4, those permissions are only necessary if an application wants to either use data shared by another application through external storage.
