Strategy for User Profiles

aop

I am fairly new to GOS and am wondering about the best strategy for User Profile Setup.

I aim at getting privacy benefits from GOS, but don’t want to have a massive trade off on usability.

Some of my apps need location, others google play services. Some both. And i also wants to install android auto. Some banking apps need adjustments to the standard settings (less restrictions).

What would be the best way if setting up user profiles? Is there any privacy benefits you get from separating apps (in my case banking apps) that so not need location/google play services (but have less restrictive settings) into a specific profile?

Thank you in advance!

Murcielago

Hello and welcome.

(Un)fortunately, there is no one right strategy for a user profile setup, but there is a lively exchange about it here in the forum and many people present their setup here - perhaps you can be inspired by this, for example:

https://discuss.grapheneos.org/d/2769-curious-to-learn-more-about-user-profiles
https://discuss.grapheneos.org/d/7394-help-me-understand-the-best-user-profiles-work-profiles-set-up-for-me
https://discuss.grapheneos.org/d/8035-how-many-user-profiles-do-you-use-and-what-for

question:
Is there any privacy benefits you get from separating apps (in my case banking apps) that so not need location/google play services (but have less restrictive settings) into a specific profile?

answer
Android's user profiles are isolated workspaces with their own instances of apps, app data and profile data (contacts, media store, home directory, etc.). Apps can't see the apps in other user profiles and can only communicate with apps within the same user profile (with mutual consent with the other app). Each user profile has their own encryption keys based on their lock method.

source: https://grapheneos.org/features#improved-user-profiles

Just as a side note (since you asked about the privacy benefits rather than the security benefits - but perhaps interesting nonetheless: https://grapheneos.org/faq#encryption

A personal note:
I have tested some setups and usually split profiles according to security needs (e.g. banking) and privacy needs (isolating invasive apps).

I currently use the following setup and am quite happy with it:

Owner Profile as my daily driver (profile without Google Play Services installed)
Private Space for invasive apps such as Google Maps, Social Media Apps (with Google Play Services installed)
Banking (separate user profile with Google Play Services installed)

Form me personally this profile setup is the sweet spot between privacy, security and usability - especially the ability to share things (also from clipboard) easily between Owner Profile and Private Space has been a game changer for me in terms of usability.

If you want to learn more about Private Space -a relatively new feature coming with Android 15, you may find these links helpful:

https://discuss.grapheneos.org/d/16670-private-space-on-android-15-grapheneos
https://grapheneos.social/@GrapheneOS/113351721569189227

If sharing beteween profiles is a thing for you - Private Space is not your only option. Some ways that come to mind off the top of my head to share beteween profiles are Inter Profile Sharing app, Syncthing, Localsend, cloud storage or flash drives).

One last remark - especially if you're new to the topic: It's generally better to start with one or just a few profiles (if your threat model alows it) and expand your setup if necessary - privacy fatigue is your biggest enemy.

JollyRancher

The "correct" answer is something that depends on your threat model and phone usage.

Personally, I stuff Google Maps, Uber, Lyft, and the various airplane apps in one travel profile. That one uses Google location services and the profile is only used when traveling (and doesn't run in the background).