Protecting Your Privacy on Android

This post is for those who, like me, choose Android over iOS because they prefer Android's openness or don't like that Apple is a jewelry company first and a technology company second, only caring about privacy because they embarrassingly leaked a bunch of nude photos of celebrities.

Step 1: Buy a "straight" unlocked Android phone such as a Pixel. Everyone in the chain between Google and you is going to be trying to monetize you as much as they can, and each step delays or even drops security updates. That means if you buy a Samsung phone from Verizon, your private info is going to be stored on Google's servers, Verizon's servers, and Samsung's servers. And I guarantee you both Verizon and Samsung are far more incompetent when it comes to protecting your privacy than Google is.

Note that there is no such thing as an unlocked CDMA phone, which means you cannot use Verizon. You can use an unlocked phone with AT&T, but then you're supporting one of the most evil companies in existence. I've used T-Mobile and Google Fi and been happy with both. Google Fi even works internationally, while T-Mobile requires a special account with international roaming. Fortunately, since you bought an unlocked phone, you can get a pre-paid SIM in any country that uses GSM, which is most of them.

Step 2: Use a Google account only for Android, and lock it down. Don't use it for email. Use a strong password you don't use anywhere else, and memorize it instead of putting it into a password manager (this is one of your most important accounts, treat it like you would a banking or brokerage account). Turn on two-factor authentication. Go into your privacy settings and turn everything off, especially location history and app & web activity. Do not use any apps, like the Google Assistant (also used by Google Home and Android Auto) that force you to turn these back on. If you tell Google not to retain information, they don't.

Step 3: Understand and pay attention to app permissions. If an app asks you for permissions you don't think it needs or don't want it to have, don't use it. And in general don't install apps you don't really need.

Step 4: Install and use F-Droid. F-Droid is an "app store" for open source apps that respect your privacy. Nearly all of the apps I use on a regular basis come from there. There are even apps to access Facebook, YouTube, and Twitter without leaking a bunch of additional details and asking for a bunch of unnecessary permissions. NewPipe even lets you watch and download YouTube videos without logging in! There are also BitTorrent apps, Orbot and Orfox (Tor relay and browser, respectively), and OpenVPN for using VPNs (do not use any VPN that doesn't support it).

And that's pretty much it. You could go farther and turn off your phone when you're not using it, leave it at home when you don't need it, etc. But I'm not quite that paranoid yet.