I thought I'd share some notes from my recent experience using Private Space.

I've always avoided Google Play on my GOS devices, but I'm increasingly aware of the security risks associated with some third-party stores. I wanted to see what it would be like to use Play and Play Services in the Owner profile alongside other apps that are already associated to my real identity.

I would then use Private Space along with a VPN for more anonymous (logged-out) browsing, media scraping, and torrenting, with these apps managed via Obtainium and/or Droid-ify.

My overall goal was to increase general app integrity, and potentially lower battery usage through the use of Play Services for notification delivery, while implementing app and storage isolation where deemed necessary.

This approach has worked as expected but not without several unresolvable pain points...

Secure, but not as secure as other options

It's worth mentioning for newcomers that once Private Space is unlocked, a device restart is required to fully close Private Space's encrypted filesystem. The Private Space "lock" function does terminate any apps running in that space, but access to the data stored within this secondary filesystem is still possible as the encryption keys remain loaded until the device is restarted. My understanding is that this is necessary to allow for unlocking Private Space via biometrics after first unlock (AFU).

Using a full-fledged user profile will provide greater security, as its encryption keys can be unloaded upon closing the session (and the use of biometrics can be avoided altogether).

Extracting your data from Private Space

Android doesn't include a means of extracting files from the Private Space profile. Any connected USB storage appears only under the Personal (Owner) profile, and USB-to-PC transfers only work for full-fledged profiles. If you need to backup or extract data from your Private Space, you'll need to use a third-party app to send files to the Personal side (or send it to a cloud service, remote server, etc.).

Sharing items between Personal and Private apps

In-app sharing appears to default to the source app's origin (Personal or Private). For many apps, sending multiple items from Private to Personal, or vice versa, will require you to navigate to the opposite tab in the Sharing Link menu for each and every occurrence. Android appears to have no notion of a last used space for the Share destination. Some apps, such as Chromium-based browsers, do remember the last-used destination and even provide a direct shortcut to it within their context menus.

Android's generic sharing menu, displayed whenever copying something (text, image, etc.), always defaults to the Personal tab in the Sharing menu, regardless of the source app's location. This gets tiresome quickly with repetitive sharing (such as when sending links to a downloader). This one is particularly painful for me, as I prefer to use the generic menu in order to prevent the source app from tracking where things were shared.

Launchers and Private Space

Very few third-party launchers currently support Private Space, and what follows are my own observations from those I could find.

For the sake of comparison, the default GrapheneOS launcher provides very basic support for Private Space. Once Private Space is enabled in the device settings, it appears at the bottom of the Apps menu. Users can lock/unlock Private Space from this location as well, but cannot incorporate private apps into the Home screen in any way.

Please do share if you're aware of any other launchers that support Private Space.

µLauncher

µLauncher (FOSS) provides the best integration of Private Space thus far. Users can:

Easily unlock/hide Private Space using the padlock icon shown in all of its app menus, and will be automatically prompted to unlock when using a gesture to access the Private Space menu
Add PS apps alongside regular apps in the Favorites menu
Assign gestures to access the Private Space app menu and/or toggle the Private Space lock
Assign gestures to launch specific private apps

Note that all private apps are prefixed with 'Private', and this prefix cannot be changed. The 'Private' prefix is also not taken into account for sort order, which can result in menus like this:

Private Aurora Store
Brave
Private Brave
Files
Private Files
Gallery
Private Gallery
Gboard

Kvaesitso

Kvaesitso (FOSS) provides basic Private Space support:

Private Space apps and controls are accessed via the All Apps menu tab
Users can add private apps alongside regular apps in Favorites, including those shown on Home screen
Users cannot integrate Private Space in any other way (no actions or direct dialing of private contacts, etc.)

Lawnchair

Lawnchair (FOSS) nightly builds, as of v15, provide very basic Private Space support:

Private Space apps and controls are provided at the bottom of the All Apps page
Users cannot add private apps to the Home screen, nor integrate private apps or actions in any other way

Smart Launcher

SmartLauncher 6 (proprietary) provides bare-bones Private Space support:

Provides a dedicated Private Space app page via the All Apps kebab menu
Smart Launcher can lock/unlock Private Space via this kebab menu too
Users cannot add private app icons to the home screen nor integrate private apps in any other way (no assignable actions, etc.)
Very cumbersome if you access Private Space frequently