alltheqs If I have Google Play in its own sandbox, and I install the Notion app with Google Play, does Notion go in its own sandbox, or does Google have access to the data there?
On Android systems, every non-privileged app is sandboxed (runs in its own sandbox).
On Google's OS, the Play ecosystem apps are privileged system apps, so they are not sandboxed. On GrapheneOS the Play ecosystem apps are not privileged system apps, so they are sandboxed.
On Google's OS, the Play ecosystem apps have elevated abilities to access the internal data of regular apps, but on GrapheneOS they don't.
alltheqs Is it possible to have Google Play in its own profile, but download apps to a different profile? Is that overkill?
That may make sense for some apps, but not apps that need access to services provided by the Play ecosystem, which must be in a profile with the Play ecosystem apps.
alltheqs The Google Play sandbox information is what confused me in the first place. I should have linked this at the top.
It might be productive to quote a specific sentence or two that would benefit from interpretation and then ask a specific question about that quoted part. If all somebody has to go on is a report that a large piece of text is confusing in a general sense, it may be difficult to provide specific clarification.