Strive1154 Other users will be able to answer your Android Auto question. Anyway, Aurora Store is apparently having connecting issues at the moment, and because Google is cracking down on account sharing, my guess is it's unlikely that Aurora will exist for very long.
You will have to be signed in to the Play Store for it to be able to update your apps.
Granting the location permission to Magic Earth does not automatically grant the location permission to Play Store and Play Services. Keep in mind that these are all sandboxed apps on GrapheneOS, and are inherently hard-blocked from bypassing the Android permission system. (Android Auto can be granted privileged access, but that is detailed on grapheneos.org). As such, installing apps from the Play Store does not grant Google any privileged or otherwise magical abilities.
By signing in to the Play Store, it will naturally be able to collect data about what you do in the app, including which apps you install. It will see which apps you already have installed. It can collect your IP address. Beyond that, since it's restricted by Android's app sandbox, I'm not sure what else it can gather about you. You of course choose which information you directly provide when creating a Google account.
When you try to create a Google account it may ask you for a phone number if you trigger their spam-detection stuff. If you don't want to provide a phone number, you'll most likely not have any luck with connecting behind a VPN, as most VPN server IP addresses are quickly added to spamlists. But I've had success with this method:
- Connect to a public Wi-Fi network, such as in a library, cafe or whatever
- Install Google Play Services from Apps and open the Play Store app
- Provide a real-sounding name and date of birth
- Accept the email address that Google suggests to you
- After registration, set up two-factor authentication from within the Play Store app, at your earliest convenience
This increases your chances of not being asked by Google to provide a phone number. I am not certain that all steps are necessary, except for steps 1 and 2, which do seem to trigger far fewer spam control checks by Google.