As the title says, I don't have a threat model so much as I have a spite model. Specifically, I want to minimise the income big tech companies (or anyone else who is monetising my personal data) make off me, and I'm willing to give up some convenience to achieve this. Also, f** AI and spiralling enshittification.

Switching to GOS is my first step on this journey and it's honestly taking me a lot longer to set up my new phone than I expected, because I keep going down rabbit holes trying to figure out the privacy and security implications of various choices. I would therefore really appreciate some feedback and input on where I'm at. This is a very long post, so thanks in advance.

Useful context:

I have no formal IT education. I'm more tech savvy than the average consumer but please ELI5
I live in Switzerland, so decent privacy laws
I'm not on a tight budget, and I'll be donating to any FOSS services I end up using. However, functionality needs to be good enough.
I'm switching from an iPhone and some Android specific things have been tripping me up

Main profile (Owner profile)

App Store
My apps are downloaded primarily from the sandboxed google play store. For this, I've created a new google account without my phone number, primary email, or payment information. I've opted out of every kind of history and tracking that I could, and deleted the advertising ID in the store.

I'm refusing to download any apps that require purchases via the google store, or apps that require play integrity. In these few cases I'm either using a Web App, or downloading the apps using Obtainium and confirming them with App Verifier.

Questions:
1) Am I only fooling myself with this new google account? I figure this wouldn't stop anyone from identifying me if they physically searched but hopefully this will make it more difficult for their system to automatically connect my old and new accounts, since I'm switching from apple to android, from google maps to organic maps, from outlook mail to a new provider (eventually), I've started using Adguard DNS, etc. so my fingerprint should be very different.

2) How risky is it to use Obtainium? I've seen lots of comments regarding security issues with F-Droid but not much about Obtainium. In particular, are there any additional risks and / or benefits to downloading an F-Droid APK via Obtainium?

VPN and DNS
I have an AdGuard VPN subscription but, after reading this awesome article, I've concluded that it's only useful to me if I use an unsecured wifi, or I want to hide my country for some reason i.e. rarely. My ISP uses CGNAT, and I'm pretty sure it's illegal for them to track me, so I have no reason to trust AdGuard over them with regards to my IP address.

I also have AdGuard DNS which provides private DNS as well as filtering out trackers and ads. (Here's a useful article for any future readers of this thread who, like me, had no idea what the Private DNS Mode setting was about: A cartoon intro to DOH)

I've therefore decided to set the Private DNS Mode to enabled, with the AdGuard Host entered.

Questions:
3) Am I right that a setup with a Private DNS that also filters ads and trackers is sufficient for my purposes?

4) I automatically received a personal AdGuard DNS subscription with my VPN subscription. This provides the ability to add blocklists, as well as a dashboard showing what traffic has been blocked, etc. However, in order for these add-ons to work, I have to enter a specific DNS host name, instead of Adguard's public DNS host name. It seems to me this is exactly what I don't want, since it makes it easy for Adguard to track my activity across all my devices. Yes, I can opt out of logging my DNS data, but again, I have no need to trust Adguard in this way. I'm therefore opting to use their public DNS instead. Does this make sense, or am I missing a value to the personal DNS service?

5) Am I correct that using the Adguard DNS will filter out trackers and ads from all internet connections, including trackers bundled with any apps I download? I understand that the apps can share data without trackers but I see no reason to make it easy for them.

Apps
I'm doing my best to avoid apps with lots of trackers, especially social media and ads trackers (thank you Exodus), and using web apps where it makes sense.

Question:
6) I haven't quite understood how using a web app provides better security and privacy than downloading the app. I think it has to do with the chromium sandboxing that Vanadium is using?

Also, just as an aside, the android Files app is horrendous. I understand GrapheneOS has just hardened / cleaned up the standard app, so no shade to you. However, I really miss the simple, clean interface of the Apple Files app. I'd love recommendations for alternative document management apps.

Private Space

For my private space I've created a 2nd new google account, sans email, phone number, and payment info, opting out of history, no ad ID, etc. In this space I've so far only put my banking apps (including one that uses Play Integrity sigh).

Question:
7) There are a few other apps that I don't use every day that I'm considering putting in there, purely because they have trackers. However, if the private DNS is blocking the worst of the trackers, this wouldn't add any value, right?

Email / Calendar / Contacts

The biggest hold up right now to using my new phone is moving away from outlook mail. I've had a Proton account for ages but never got around to setting it up. When I tried to set it up on GOS, I discovered that I can't sync my proton contacts with my android contacts. I really don't want or need 2 contact lists. I've also come to the conclusion that a Proton email would add no value to me because I don't know anyone else using Proton, or anyone encrypting emails for that matter.

So, I'm now leaning toward mailbox.org because it's based in Europe, they have an option to send PGP encrypted email if I ever feel the need, and I can use any email client I want.

Question:
8) I feel as if I might be behaving like a spoilt child regarding the Proton contacts thing. Is there a good reason to try make this work? Any ideas on how I could easily resolve the contacts issue (without self-hosting)? Or other votes for mailbox.org / another email provider? (Yes, I've looked at Tuta, but again I don't actually need encrypted email, and their apps are apparently not great.)

Thank you for reading if you made it this far :)