[Android General] ladano:
In any ROM (even without gapps) there will always be automatic connections with Google(captive portal mode, ntp) and Qualcomm (ntp, gps) The theory says that we have to deactivate automatic date and time and use only the integrated GPS (or otherwise contact Google / Qualcomm) but in practice these hosts will connect to the internet when they can ... The file in a LineageOs ROM is usually in /vendor/etc/gps.conf. On the other hand, there are geolocation alternatives, such as theUnifiedNIp project. Later, we can use other servers such as Mozilla. For this purpose we need to have MicroG installed, although I leave the information in case you are interested in.

The exception would supposedly be Replicant, but it supports few devices.

To avoid the espionage of Google we need the following:

-Before installing / formatting / flashing, we export our contacts in .vcf format and then recover them by importing the file from the Contacts application. If you want synchronization you can use, for instance,DAVdroid in Nextcloud / Ownclowd. This file and our photos / videos are taken to the PC and viceversa using a wire. We also download F-Droid, Afwall firewall and Adaway apks. We do not connect to the internet till I say even we have to avoid mobile data or wifi in the setupwizard.

-We flash a LineageOs ROM, without gapps and without MicroG(because it generates too many connections with Google). In your options we will uncheck Automatic Date / Time. We become root with Magisk or su.

-The next step is to deactivate the captive portal mode. All Android phones send a ping to Google to verify that the internet works. In Development Options we will enable the Local Terminal / Shell. Afterwards, we look for the new app and we open it.

In order to have root access we write:su

Then we will put:settings put global captive_portal_mode 0

And finally:reboot (also in the terminal, because if we restart manually it will be activated again)

-We disable "Intent Filter Verification" system app. It connects to Google and Amazon to verify the net. It is not necessary to be root. We force stopping and afterwards we disable it.

-If we use Android Pie we change Private DNS from automatic (default) to No.

-Install the firewall Afwall + We will give access only to the apps that interest us. However, there is a "bug" in Android that produces another inevitable data leak for any Firewall. This occurs at the boot of the system in which the program is incapable because it is loaded later, and the OS takes advantage to skip the locks. In its experimental options, there is one that controls this behavior. "Fix the data leak at boot" To let us mark the option, which by default will be gray, we must indicate in the immediately superior option "Path of the home directory for script", the first one that appears/sbin/.core /img/.core/service.d. Besides, we mark IPv6 compatibility. Thus, Afwall could "see" some IP's and block them. Nowadays I do not know what they are but there are several (an failed) unknown connections.

-AdAway. Now It is the moment to connect to the internet. We add the lists I put below, update the app and reboot. We are going to block Google servers (time.google.com) and Qualcomm servers (Izat, izatcloud.net) because despite blocking them in the firewall, disabling automatic date / time and using only the integrated GPS for time, they will try to connect to the time servers as soon as the phone connects.

To simplify, we added the host that I created for that purpose:

https://gitlab.com/Jorgu81/hosts/raw/master/HostsGoogle

Most recommended is Steven Black, although it is not essential:

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

- After that, we install the F-Droid store. We are going to avoid Yalp Store/Aurora because they generate too many connections with Google, but you can install / uninstall if you need any app.

-IceCat web browser. Startpage, Qwant or SearX search engines. The reason, here:

https://spyware.neocities.org/articles/browsers.html

First of all we disable its addons because they break the webs. Afterwards, we put the ublock addon Origin.. If you want to avoid Google webcrawling we must block its domains with the aforementioned add-on. These are some of its trackers:

adservice.google.com

admob.com

adwords.com

adservice.google.es

adservice.google.com

doubleclick.net

googleapis.com beware! Some forums will not load correctly if we block ajax.googleapis.com

google-analytics.com

googletagservices.com

googleusercontent.com

googletraveladservices.com

googlesyndication.com

googleadservices.com

gstatic.com (it tends to break many websites, so use it manually where possible)

-SD Maid. This program is very complete and with it we can disable system applications or avoid autobooting them. But what interests us is to remove tracking permissions of the apps, specifically those referred to Google. These are boot (auto-start),analytics, tracking, firebase and in general those that refer to google. If the apps contain any of them, we will remove them. We look for "Application Control" (previously we can mark it to indicate also those of the System in Settings) and after selecting them, we select the app and choose "Permission Manager". Do not forget to give the 3 points above (Other) to see all of them. Example with Whatsapp. Uncheck "com.whatsapp.Bootreceiver","google.android.gms.measurement.AppMeasurement Receiver","com.google.firebase.iid.FirebaseInstanceIdReceive r","com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver"

https://sdmaid.darken.eu/download/production/

If we want to avoid its automatic connections we could disable the options in Settings, General Settings, Bug reporting.

Do not forget Trust in LineageOs in order to change, deny or allow permissions of our installed apps.

With this we have finished the initial configuration to avoid, as far as possible, the espionage of our system.

----------------------------------------------------------------------------------------

Applications / recommended settings (from F-Droid, as usual):

-Beta Updater for WhatsApp. To update the well-known application.

-XprivacyLua. We need Xposed:

Xposed (not Android 9)

https://xdaforums.com/xposed/xposed-installer-versions-changelog-t2714053

EdXposed (Android 9, alpha)

https://xdaforums.com/xposed/android-9-0-xposed-solutions-t3889513

It will block all the information from our terminal that apps can takefor their indeterminate purposes. Few of them will make an incorrect use of it because they come from F-Droid. If we use WhatsApp we have to leave at least permission to clipboard and Contacts. In IceCat only for clipboard.