Best way to keep Google Services separate

MrNessuno

While I wait with my Pixel 10 Pro almost untouched, and I'm still using my Poco F2 Pro with MicroG.

I was thinking how to manage my profiles to be ready for the installation:

owner
daily
banking
google services + android auto + apps that need play services to work (probably none but I need to test them)
socials (keeping them separate so I will probably use them less and less)
AI apps (Pixel got me a year of Gemini Pro, so... why not)

The problem:

How can I keep updated my apps? If I install sandboxed play store in the owner profile I can't just close them as in a separate profile so google services are always running in the background.
Also some apps in my daily must require GCM as Bluelink, Whatsapp (unfortunately I need it), Twitch (not sure if move it under socials), how I can fix this?
Also, if I move my banking app in another profile I will miss all the notifications from payments (also working with GCM)

Other apps works fine without GCM or just don't need notification from them.

Any advices?

userofgos

I think you're going to have a lot of issues come up with this complicated setup.

MrNessuno google services + android auto + apps that need play services to work

If you're like me and are constantly driving for work and need to take work/family calls it doesn't make sense to put Android Auto in a separate profile from your Daily/SMS/Calling. You'll face way too many inconveniences and missed calls

I mean you could allow forwarding Phone calls, SMS and notifications to your Android Auto profile, but then you run into the issue that you won't know who is calling/texting unless you also have your Contacts synced from your Daily profile. Which in that case also means you'll have two databases for contacts, SMS and Phone calls (one in each profile) and to me that's just a waste of space and inconvenience that doesn't really provide any privacy benefit.

You could have Android Auto in the Private Space of the Owner/Daily profile if you do want some separation. That might be worth testing.

The only reason is see it making sense to have a separate profile for Android Auto + Navigation is if you don't want to receive any SMS/Calls and don't want to be tracked (which is still hard even if you use office maps), and want it isolated from everything else.

mythodical

This seems overly complicated. My advice would be to cut all of that down to just two "profiles"; Owner and Private Space (PS).

Chances are good that your contacts under socials already know who you are, have you in their address books by name, and therefore your use of those apps is likely tied back to privacy-invasive telemetry already. Same goes for your banking.

Using Gemini Pro is likely already tied to your Google account, so i don't see a need to separate that either.

You can put the bulk of your apps on the owner profile, and use PS for the few apps/activities that warrant a bit more anonymity. A VPN, Tor, or similar is still needed on the PS "profile" if you wish to have IP separation from your owner apps.

For apps, you can install your owner apps through the Play store, and then use Accrescent, Aurora, Droid-ify, or Obtainium for your PS apps.

That's my advice anyway. It may not be the perfect solution for everybody, but it should suit the vast majority of users just looking to keep some apps separate from Play Services.

schweizer

I think that os overly complicated too.

I suggest an owner profile without PS for most apps including banking. There are just few apps that do not work well enough without PS. These go in the PS-enabled private space. Do not log in there! I only open the private space when it is needed i.e. when using google maps.

I downloaded the apps available on github through Obtanium and the others in Aurora.

I then have a secondary profile with PS and google account. This profile was created using a public wifi and after its creation the profile runs on Tor. I use this secondary profile once a week solely update the apps in the owner profile. This method provides separation between Playstore and Play services. And the apps get checked by google. I avoid fingerprinting through the list of apps because the list of apps is not identical for the owner and the private space.

I deleted almost all my ssocial media accounts and the only one left I use in a browser.

DeletedUser499

Simple, keep it simple or it will get in the way of what you are doing, you will get tired of the complexity you created for yourself.

MineralWater

I think if you need apps daily who need play services, you should install Google play store and services in the main owner profile.

And the few things who don't need Google, for those you could make a secondary profile. You would receive calls and SMS in that profile. If you need app messages from owner profile in the secondary profile, you shouldn't use a secondary profile, but private space in owner profile, so you don't miss any message or call at all.

I think you should keep it simple. Most people need apps that rely on Google services, so if you need these, you can install it in the main owner profile to have it most convenient.

Google in owner profile doesn't get your contact list or whatever else if you don't allow it. What data apps like for example WhatsApp get is what you give them, and there is nothing that GrapheneOS could change about it.

I just have an owner profile with Google services and store installed, plus private space and that is working excellent.

I once tried different profiles but in my opinion that really only makes sense for those people who avoid Google at all cost and didn't install Store and Services.

schweizer

MineralWater the few things who don't need Google

Have you tried your important apps without google? I was surprised to see that almost everything works without once it is installed. I.e. all messengers including Whatsapp work without. All my ebanking apps work without.

Thus no need for Play Services in owner profile.

MrNessuno

schweizer ye, but how I install and update them?

Nobody seems a good way to do this, I like this method

Nobody

If you want to keep the more complex user profiles you can simply disable the g-play g-services after updating apps. You can do this on a schedule of once a week or whatever freq you wush.

Further you can do all sorts of things in how you setup profiles. Obviously if you have gplay installing and updating it knows what the apps are so its only the data in the apps we need to protect. You could install all apps in the owner profile and the push them to the profiles you wish. Then in owner profile disable network permission on all the apps as you will not use owner for anything but adminstration tasks. Then you simply enable g-play and services and check for updates which updates those apps across all the profiles. Then disable the g play/devices until next update. Takes less than a minute to do.

If your using something like Orbit on VPN mode that would further block any apps internet access as you can keep orbit disconnected until you need it to do a update check. Only give the software store apps that do updates access thru orbit VPN. The others will all be blocked unless added.

Lots of ways to skin that cat.

As long as the apps are only used outside the owner profile all your use and data will be isolated from google play services. I personally do not use apps that require active connection or confirmation of active google services to use. But if you do you can group those in one or more isolated profiles and add their own session of google services to those profiles. Again you could still push all of that from the owner profile so you get system wide update pushes.

You can make it as complex or simple as you wish for your use case.

schweizer

MrNessuno how I install and update them?

There are different ways of installing apps. Some are available on github, some like whatsapp or Threema can be downloaded on the developers website. But you can use Aurora and F-Droid as well. After the initial update you can update the apps from Play Store in a secondary profile or private space with Play Store installed but where you are not logged in.