How far would Google have hooks into OS with G-apps on Graphene?

darkmatter

I need to install some Google apps for family reasons. Everyone has their own Privacy / Threat model and unfortunately I need to still live in some of those apps while using the benefits of Graphene to control my privacy.

I absolutely need Google maps, as well as Family Link, and G-Cal. Even with those 3 apps, how far deep would Google have their hooks into GrapheneOS if at all. I plan to limit the permissions as much as possible, and technically could place those 3 in a seperate profile. I also need Macrodroid which I use to run a few Geofence macros.

I don't care about Google having my location because unfortunately G maps is a necessity, but I more care about the sharing of data from other non-G apps and any hooks I can prevent google having into the OS.

Thanks In advance.

nologo

darkmatter Hi! On GrapheneOS, Google Play is sandboxed, which should mean Google's hooks are weaker or smaller (kind of getting lost in the metaphor 😀 ) compared to 'regular' Android or Pixel OS. However, it is very hard, if not impossible, to tell exactly what is still being shared and what isn't. But Google Play not having special privileges or 'deep' access should definitely make a difference.

darkmatter but I more care about the sharing of data from other non-G apps

A possible approach is to seperate your Google apps from your non Google apps by using different profiles, or private space. Here is a good introduction to using profiles: https://seprand.github.io/articles/best-user-profile-setup/

darkmatter

nologo

Yeah the profiles I want to get setup for apps like Google Family Link. The only thing I'm not sure about is Google Maps, since if my location is shared on maps for family, than wouldn't that need to be running all the time and having that in another profile would kill it? I'm not sure myself but I think Google Services and Maps would rely on each other? so that's the part I just want to find out about.

As for what Google can get into/see, yeah I understand it's impossible to know what is fully being shared, I just want to limit as best as possible Google grabbing any data they use for advertising outside of G-Maps. I'm SH most other apps having replaced most google apps, and NewPipe has been amzing for youtube stuff.

nologo

darkmatter think Google Services and Maps would rely on each other

Yeah, probably. I don't use Google Maps though (I prefer CoMaps), so I don't speak from experience. Generally speaking, it's ptobably most convenient to have apps which you want to have running all the time in your owner profile. Setups with multiple profiles can be tricky with regards to convenience/usability though, switching between different profiles all the time is quite a nuisance.

Personally, I hardly use any Google apps (none on my tablet, on my phone just Camera and Photos without network connection isolated in private space). Hopefully a more Google minded GOS user can chime in and give you more advise than I can.

DohnJoe

darkmatter and having that in another profile would kill it?

It depends, if you have it in Work profile it will actually stay active all the time, no battery optimization allowed.
Also, if an app start a service, it will be virually unkillable by the OS.

You can kill a service manually from your notification menu.

EverettHitch

I think people underestimate the concept of sandbox. Even privileged Google Play can have many permissions removed and kind of be forced to behave. What you can't change in stock is default connections. I would say GOS sandboxed Google Play is less formidable beast, nevertheless still dangerous, danger lies in the code not the sandbox itself.