You can share this paper with them: _Android Mobile OS Snooping By Samsung, Xiaomi, Huawei and Realme Handsets_. I came across it sometimes ago, and you can probably find similar works on this topic of Android privacy. The worst OEM among those they tested — none of whom were particularly privacy friendly — has an obsene amount of in-built user tracking: > The events logged include, for example, every opening and closing of an app window (“activities” in Android parlance) plus the duration a window is open. Since all window events appear to be logged, this can easily reveal detailed information on user handset usage. For example, Figure 3 shows decrypted logging data sent to Xiaomi when a phone call is received. The dialer app opens its InCallActivity window when the call arrives and closes it when the call ends. Timestamps of the open and close events, plus the duration, are sent to tracking.intl.miui.com. Xiaomi system apps com.miui.msa.global, com.xiaomi.discover, com.android.thememanager also log events using Google Analytics. They also show how privacy-invasive certain system apps are. For instance, _Microsoft Swiftkey_ keyboard is a common keyboard default on Android, and this is how much data is logged: > Microsoft’s Swiftkey keyboard (used on the Huawei hand-set) also carries out extensive event logging, sending this data to telemetry.api.swiftkey.com. In particular, when the keyboard is used within an app then the app name, number of characters entered and an event timestamp are sent. In this way use, for example, of the searchbar, contacts and messaging apps is logged and so can easily reveal detailed information on user handset usage. See, for example, Figure 4. Interactions with the keyboard, e.g. opening the clipboard, viewing/modifying the settings, are also logged. Information on Swiftkey app crashes, including stack traces, is sent to in.appcenter.ms. Yeah… Android OEMs aren’t very privacy friendly out-of-the-box. The privacy ceiling is probably far from ideal too. Regardless of which Android distribution you use though (even if its GrapheneOS), I think _RethinkDNS_ is a great tool to have. 1. You can easily check which domains/IPs each app is contacting. 2. You can easily setup firewall rules for individual apps, alongside blocklists like HaGeZi’s Pro+ and Threat Intelligence Feed (TIF). So, you can block some basic trackers and adware. 3. WireGuard (including post quantum support), Orbot, SOCK5 and HTTP proxy support. For instance, the app I use to check local bus timings is, unfortunately, closed source, though the author does claim to not collect much personal data iirc. Nonetheless it does contact Google Firebase (maybe to serve ads and do some basic telemetry), instead of just the official public transport API. So, I blocked everything except that official API and everything still works . While not as ideal as a FOSS app, this lets me use that nice app while ensuring my privacy is upheld to a comfortable threshold. After all, user patterns of bus timing checks can probably reveal a lot about them.