schweizer
And although apps must agree to share data with google you can assume the vast majority will have this setting to on/unlimited by default. Assume Play will share position as long as you have location enabled.
No, this is not how it works and completely baseless. There is no setting apps have to disable to avoid sharing data with Google Play. They have to go out of the way to include Google libraries and then use them in a way that shares data with it.
Assume Play will share position as long as you have location enabled. This allows you to find your device if it's lost or stolen.
This is completely false. It does not get access to location unless you go out of your way to grant it, which is completely unnecessary for any of the baseline functionality or app compatibility.
I actually even prefer the Aurora GUI because it lists the included tracker libraries and it shows wether it requires Play Services.
The Aurora Store information shown about trackers is highly inaccurate and not at all a good way to see which apps include privacy invasive functionality, share data with third parties or even which use Google services. It misinforms and misleads users.
If you don't care about privacy and security you don't want to install GrapheneOS in the first place. If the focus is on a shiny GUI there are better and probably cheaper options.
Using sandboxed Google Play and mainstream apps does not at all defeat the purpose of using GrapheneOS.
Because I think the average user will have a hand full of apps that really require Play Services it is recommended to install those in the private space of the owner profile.
This is not a specific recommendation from GrapheneOS. There are advantages to putting apps in separate profiles but none of it is specific to sandboxed Google Play.
Then you can easily switch on and off Play Services by unlocking and locking the private space.
Disabling apps individually or at a profile level when you aren't using them doesn't provide any significant privacy value. It mainly just saves battery life, but you won't get notifications while apps are disabled.
You can enable Tor on the private space to minimise your data footprint.
Tor is much more niche than a regular VPN and people should think the implications of Tor about it before using it.
schweizer
They get your coarse location through the IP.
This has nothing to do with Play services specifically and it's a misconception that Play services is needed for apps to use Google services. If you're using a VPN then it's not the case.
And for the exact location most people have it enabled permanently and also granted the permission to Play Services. Because it prompts and warns you that it is unsafe not to grant location permission. (You may not be able to find your device if it's lost or stolen.)
No, this is highly inaccurate. Standard permissions are not granted to sandboxed Google Play because they're regular apps and that's not how it works with regular apps. Location does not need to be granted for any baseline functionality or app compatibility, so very few people grant it to sandboxed Google Play. You're wrong about this.