To counteract the spread of Covid-19, many countries have introduced mobile applications for contact tracing, which raises considerable questions about how these apps protect users’ information privacy. Through an exploratory analysis of Covid-19 contact tracing apps being used in Australia, France, Germany, Japan, and New Zealand, we identify normative and technical principles for the design of privacy-sensitive contact tracing apps. Based on a Restricted Access/Limited Control (RALC) account of information privacy, we discuss how the apps protect users’ information privacy through limiting access to and allowing users to actively manage their personal information. Our findings illustrate what understanding of information privacy is evident from the various designs of Covid-19 contact tracing apps, and how competing design principles can contribute to users’ information privacy. From a practical perspective, our findings can inform the design of contact tracing apps and the development of privacy approaches that can be applied in particular contexts. Our work thus bridges the gap between ethical design guidelines and technical analyses of specific implementations.