[Vivo X90 Pro Plus] extremecarver:
Please see:

https://arxiv.org/pdf/2302.01890.pdf

Important to know: On China OS some apps have hidden rights according to the above study! So removing the rights for some apps will not help because they actually will get those access rights no matter what you setup in android! So we should remove them with adb. However what needs to be removed? According to the article I came to the below conclusion:

Let's check what we really need to debloat, because the amount of data sent on China OS is pretty crazy. It's a bit harder because ColorOS is not identical to OriginOS but pretty close. We can assume that modules used for spyware on Color OS also exist on Origin OS.

Clearly we have:

anysthing related to Amap including

com.amap.android.location

com.tencent.soter.soterserver

anythign related to weather.service

com.android.contacts

The wallet should be removed too as it's used for sending more data than it needs/tells you.

However as the analyisis shows it's essential to remove the massages app too! this for example is not done in even the deep debloat script!

As for wechat - I noticed that there are clear differences in Wechat installed via Vivo appstore and google playstore. If you use wechat - remove it with adb debloat and install the global version from play store - the vivo version is not only much worse when it comes to advertisement - but likely sends all your messages to china as well - more as on the global version which is still a blackbox in itsefl. Why do I assume this? Because clearly as shown in the study the Chinese firmwares behave differently to the international ones - Chinese users are of greater interest to the chinese government and add agencies/companies than interantional ones.

However this is not the end - some other apps like:

com.android.mms (the messenger) and com.android.mms.service

and likely the phone should be replaced too. The phone is not mentioned in the study but I would be very wary about it. The problem is - while the messages app can be debloated without problems - the original phone app is needed for accessing service menus.

com.vivo.phonehandoff

com.vivo.findphone

com.android.dialer

com.android.phone

com.vivo.smartanswer

Note however that the following apps cannot be removed:

adb shell "pm uninstall --user 0 com.vivo.findphone" > CON

adb shell "pm uninstall --user 0 com.android.phone" > CON

adb shell "pm uninstall --user 0 com.android.dialer" > CON

adb shell "pm uninstall --user 0 com.android.mms" > CON

adb shell "pm uninstall --user 0 com.android.mms.service" > CON

adb shell "pm uninstall --user 0 com.android.contacts" > CON

At least the messages app is a clearly listed exploit. So in effect you cannot store any EU persons private data on this phone. Actually google would be good to forbid it's servers to communicate with China OS phones until they fix that mess.

Not sure if it will help to hide that information because it seems the app per se is not spying - but removing the inbuild address book should be done too.

Likely we should remove the registration service too - problem is then that you lose some functionality as in replacing system launcher and similar. It's clearly better to have non China firmware in first place - because you cannot completely remove the spywaer without cutting functionality (not all is replacable).

Just about the implications the result of the study linked above - but best read through it yoursefl. Clearly it is illegal to use a china ROM phone without debloat in the EU - because you unwillingly will transmit data of third parties to China servers. Yes the same in a way also applies to all META / Facebook / Facebook messeger / Whatsapp / Instagramm apps if you grant them address book access. So no - please check that global companies aren't clearly spying on you too. Meta is clearly on the same level as the chinese crap here. As for google apps - so far what is konwn they use your data - but at least not transmit third party data to google servers.