[deleted] I'm curious if apps (google sandboxed or not) have any possibility of determining your phone number if you have a sim in the phone?
Not by default, but yes if you grant the Phone permission.
Also, there is the possibility of communicating with another app in the same profile that has the Phone permission, if both apps are designed to cooperate that way.
[deleted] f you have different profiles, so say instagram in one, tiktok in another, and instagram in yet another, is there any way for the apps to link your accounts other than public IP addresses perhaps? Is there anything internal to your phone they can read to assume you are on the same device on different accounts?
There are no known unique identifiers that apps in 2 different profiles would have access to. You can read the official GrapheneOS answer here, and the following section about non-hardware identifiers.
However...
Every app can see every other installed app in the same profile. So you could be fingerprinted that way, depending on how unique your set of installed apps is.
Another way would be by sending multicast packets to the local network, which are able to bypass the VPN. (Release 2024091700 attempted to fix, but was rolled back due to significant compatibility issues.) If 2 apps were cooperating this way, it would allow the apps to determine that they are on the same network. Not definitive proof that they're being used by the same person, but might make it highly probable.
There is another recent thread about using AI analysis of pixels in photos to identify a device, so if you're uploading photos to 2 different services, they could (in theory) tell they were taken by the same device.
I have no doubt there are probably many other possiblities.