How to prevent apps from collecting our data with GrapheneOS.

Graphner

I've been looking at the large amount of data that some apps collect (especially free ones) and I was wondering if an OS for those who value their privacy, such as GrapheneOS, can prevent the following from being collected, for example: (This can be seen on Google Play in each of the apps we want to install in Data Safety - See details - Data collected)

Device or other IDs
User IDs
Phone number
Photos and videos - in the case of video recording apps

If so, how? How do you do this in GrapheneOS? As far as I know, paid apps can only be downloaded through Google Play, so I wonder what to do in these cases.

de0u

Graphner Some of these casss are addressed by settings described in the GrapheneOS FAQ (device i.d.'s), and usage guide / features list (storage scopes).

Users with specific concerns may benefit from consulting the material there about specific issues.

And consulting those materials may raise awareness of new issues.

AcclaimSublevel19

Graphner Device or other IDs
User IDs
Phone number

You're probably referring to unique, device-specific identifiers like the IMEI. As far as I am aware, this is only accessible (if at all) by granting the Phone permission. Besides being tracked based on device identifiers, your device may have other IDs associated with it. These include your IMSI and phone number, which are again only accessible with the Phone permission. There's also an ID for DRM which is shared across profiles and could be used to help fingerprint you as any app can access it. Finally, especially for apps from Google Play, Google generates a unique advertising ID for your account (you already have this whether or not you use GrapheneOS) which you can reset in the Google Play Services settings.

Graphner Photos and videos - in the case of video recording apps

These are only accessible if you grant the Photos and videos permission. You can use Storage scopes to prevent access to everything if you want. What do you mean by video recording apps though? If you're referring to recording a video with your phone's camera, you already have a trusted, preinstalled camera app. For screen recording, Android has a native feature that lets you record your entire screen or a specific app. Unless I've misunderstood something, you don't need any extra apps for that.

Graphner If so, how? How do you do this in GrapheneOS?

I'm not sure what you're asking here, please clarify.

Graphner As far as I know, paid apps can only be downloaded through Google Play, so I wonder what to do in these cases.

You have a few options here:

Just sign in to Google Play with your normal account, buy your apps and enjoy. Drawbacks: I guess it isn't that great to give Google your credit card details.
Transfer an app from another compatible device where it was installed from Google Play (maybe even on a different account). I did this when I set up my phone to get the one paid game I had onto my Pixel without logging in to Google Play. Note that the phones have to use the same architecture (I think Pixels all use arm64-v8a). Drawbacks: You need a second phone, you're still not free from Google and you can't get updates for the app.
Find a free alternative to the app and use that, or find an app that can be payed for outside Google Play. Drawbacks: Sometimes it's hard to find a good alternative.
Mentioning this solution so you DON'T choose it by accident: get the app from an insecure, malicious APK website.

chinook

Graphner hey, you probably want to read https://grapheneos.org/faq#hardware-identifiers and the next paragraph, just to give you some hard data on what is or is not available.

This in no way exhausts the subject -- just search up "fingerprinting" on this forum -- but it's something for a good start.

hello-gos

AcclaimSublevel19 Transfer an app from another compatible device where it was installed from Google Play

Do you mean backup and restore the whole phone with Seedvault or is there a way to just transfer a single app?

AcclaimSublevel19 Drawbacks: I guess it isn't that great to give Google your credit card details.

Could you use Google Play gift vouchers?

AcclaimSublevel19

hello-gos Do you mean backup and restore the whole phone with Seedvault or is there a way to just transfer a single app?

I never found an app I could trust to back up my phone or specific apps (and even ADB backup was useless for some of them). I managed to pull the APK for it with ADB, along with the libraries and then repackaged them into an APK for my phone with a few small changes (i.e. renaming the arm64 directory to arm64-v8a because my old phone had a different, yet compatible architecture).

hello-gos Could you use Google Play gift vouchers?

I forgot those exist! Assuming Google doesn't have a problem with purchases being made from uncertified devices, they should totally work and are a great idea!

duckyfuzz

hello-gos Could you use Google Play gift vouchers?

AcclaimSublevel19 Assuming Google doesn't have a problem with purchases being made from uncertified devices

Not sure what is meant by "uncertified devices" but I feel that before using such vouchers Google would require the user to add a real bank card to KYC and prevent tax fraud / gift voucher scam.

AcclaimSublevel19

duckyfuzz Not sure what is meant by "uncertified devices"

Certified devices are the ones that run a Google-approved Android distribution that comes with Google bloatware, etc. Those devices pass Google's Play Integrity checks not because they're more secure but because Google is getting lots of money and certain benefits in return for certifying their OS. Pretty much every device sold in stores as having Android will be certified by Google. GrapheneOS, on the other hand is not paying Google for certification nor wants to follow their orders as to what goes into the OS, so it's uncertified and Google is known to sometimes reduce function on uncertified devices (e.g. the situation with Google Wallet). This also explains the warning you get when booting GrapheneOS.

AcclaimSublevel19

duckyfuzz I feel that before using such vouchers Google would require the user to add a real bank card to KYC and prevent tax fraud / gift voucher scam.

Yes, this is a valid concern and I'd be surprised if they didn't.

wizoatk

duckyfuzz Not sure what is meant by "uncertified devices"

https://www.android.com/certified

Play Protect Certified Android devices: safe and secure

Manufacturers across the globe can choose to pre-install Google’s most popular apps on Android devices. The Android team at Google certifies these devices to ensure they are secure and ready to run apps from Google and the Play Store.

Safety tested
We provide hundreds of tests to ensure Play Protect certified devices adhere to the Android security and permissions model and have software builds with recent security updates. Play Protect certified devices are also required to ship without pre-installed malware and include Google Play Protect, a suite of security features such as automatic virus scanning and Find My Device. This provides baseline protection against malware, privacy hacks and more.

[...]