Ironically the best option if you want a secure, private phone is usually to buy a Google Pixel phone, then install GrapheneOS on it. Technically you can use pl

Ironically the best option if you want a secure, private phone is usually to buy a Google Pixel phone, then install GrapheneOS on it. Technically you can use plain old AOSP, but GrapheneOS is probably the better option because: * You can re-lock the bootloader after installing it for security (unlike AOSP which is not signed by Google). * It has additional security/privacy protections on top of AOSP, like the ability to disable the "Internet" permission for individual apps. * It supports Play Services in a secure sandbox to allow for much greater app compatibility (since most Android apps in the Play Store require Play Services). The only way to add support for these apps to AOSP is to install the "Google privacy invading software" you mentioned on top of it, and grant it special privileges over your phone (otherwise it will refuse to run). While the Play Services sandbox feature of GrapheneOS requires installing Play Services on your phone, it not granted any special permissions; it's treated just like any other app. GrapheneOS simply lies to Play Services, telling it that it has special permissions when it actually doesn't. Pretty clever solution! And if you're not comfortable even with this low risk version of Play Services, you can simply choose to stick to F-Droid, but it's nice to have the option if you need it. You can even install sandboxed Play Services in an isolated profile to keep it separate from your main apps if you want. https://grapheneos.org/usage#sandboxed-play-services https://grapheneos.org/usage#sandboxed-play-services Edit: AOSP also has no backup/restore options, while GrapheneOS has Seedvault. I also found a fun video that provides a glimpse at what raw AOSP really looks like: https://www.youtube.com/watch?v=ZWaAilxX28g&t=306s https://www.youtube.com/watch?v=ZWaAilxX28g&t=306s It doesn't even have a setup wizard.