Can Google still get my data if...

AffiliateAnthony

If you login to an app that was downloaded from the Aurora store, is Google still able to get information on you or is it just the app itself?

I have network permissions turned on. It's for Solo learn and Mimo but I want to know for apps in general.

Thanks.

unwat

AffiliateAnthony

I'm not sure I understand the question. Are you asking if Google can get info from the phone if just Aurora is installed? If Aurora and Google Play are installed? Or just from apps in general?

If just Aurora, info that Google can get about you would be very limited.

Many apps use Google libraries in their code for things like serving ads or crash reports or analytics (just a few examples, there are lots of libraries with other uses). If one of those libraries are included in an app, then of course Google can still get info from your phone even if you don't have Google Play installed. This is one reason why we prefer to use open source apps when possible But keep in mind that Google and those apps would only have access to things you give them access to, so it's always a better idea to grant permissions sparingly.

If you're asking if Google can still get info about installed apps if Aurora installed them, then the answer would be kind of. Any app can list installed apps within the same profile.

If you're asking if Google can get info about you since they're Google and AOSP is a Google product, then no. Google apps do not have any special privileges on GrapheneOS. Google apps have the same restrictions as any other app.

[deleted]

unwat Talking about giving app permissions. For example Proton VPN requests 8 permissions as per Exodus:

https://reports.exodus-privacy.eu.org/en/reports/ch.protonvpn.android/latest/#permissions

and in app settings 3 that user can change: network, notifications and sensors. Does user action cover all of these or are some granted by default?

AffiliateAnthony

unwat If you're asking if Google can still get info about installed apps if Aurora installed them, then the answer would be kind of. Any app can list installed apps within the same profile

Yes. This is exactly what I was asking.

So would it just be better to use the web based version of an app instead of downloading it?

Thanks for the response by the way.

unwat

[deleted]

Some permissions are granted automatically, but I don't know exactly which ones are....

Install-time permissions are mentioned on the Android developer website, but I can't find a specific list.

A list of almost all of the permissions on Android is here: https://developer.android.com/reference/android/Manifest.permission. Most permissions have a "protection level." Dangerous permissions aren't granted automatically for user-installed apps. Signature/privileged are for preinstalled apps.

Quickly looking through the list, permissions with the protection level of "normal" seem to be granted automatically for the most part, though I didn't go through the whole list and I'm not familiar with all of them so maybe some are restricted. This page says:

[Normal] permissions allow access to data and actions that extend beyond your app's sandbox but present very little risk to the user's privacy and the operation of other apps.

The ProtonVPN permissions on the website you linked are mostly pretty common I think. ACCESS_NETWORK_STATE, INTERNET, QUERY_ALL_PACKAGES, RECEIVE_BOOT_COMPLETED, and WAKE_LOCK are all granted automatically I think. Not sure about the other three. FOREGROUND_SERVICE is common and is necessary for ProtonVPN to show that persistent notification and to continue running in the background. I find it strange that CHANGE_WIFI_STATE is a "normal" permission. Maybe that permission is granted when the app is a VPN app? I have no idea what DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION is.

I've seen some cases where a permission is granted automatically (like QUERY_ALL_PACKAGES), but Google won't publish the app on Google Play, like they say on this page.

unwat

AffiliateAnthony So would it just be better to use the web based version of an app instead of downloading it?

I guess it all depends on what you're trying to achieve. I personally don't use the Twitter app, for example, because I prefer further restricting what it can access.

This section on non-hardware identifiers of the website covers what apps can access without needing any special permissions. I'd say that if you don't want an app to have access to that information, not using the app in favor of the website/PWA might be a good idea. Other benefits would be that the site cannot communicate with other apps via IPC and there's essentially 2 layers of sandboxing.