I've looked into grapheneos features, I've done a lot of digging throughout the forums, and the number one recommendation I've seen is to have a threat model. After some thinking, I've done that, and now I come here for help outlining what steps I should take to secure myself.
With scales from 1 to 10, I want to lean in to about an 7-8/10 with regards to security, and a cool 5 or 6 with privacy. I want to protect my accounts as much as possible, hence why I use 2fa TOTP wherever possible, and use a password manager. To go a step further, I use grapheneOS to reduce my attack surface and protect myself from most 0 clicks that pop up, along with strong defaults.
With regards to privacy, here is where I'm not so sure. As far as I am concerned, most data I generate while using an app is theirs to keep. If I like a post, and they use it to target ads, I don't mind. After all, they gotta keep the lights on and I can't pay a subscription for everything.
Where I draw the line is borderline creepy behavior behind my back aka data they generate when I DO NOT use their service. Browsing history, pictures I never shared, background location (I never want anything shared to lexis nexis), etc.
What steps should I take to prevent this stuff from happening? Would using PWAs instead of apps help like for instagram or google maps? What about for discord? Does the app sandbox prevent this stuff from happening anyway? I know apps can communicate with mutual consent, but I'm having trouble wrapping my head around the actual impact this has on privacy. For now I just have every app in the Owner profile (along with PWAs wherever possible), but I'm wondering if the privacy benefits of multiple profiles would be worth the added hassle and battery drain.
FWIW I do try to use privacy respecting FOSS apps wherever possible. However, my social life does depend on non privacy respecting proprietary apps like Instagram and Discord, so I can't just not use them. I could limit what they can do to track me though (within reason).