How private enough are these permissions for Google services? (GrapheneOS)

Questions
1

Hi there,

I only install open source and trustworthy apps in my main profile, the only 2 exceptions are Google Messages (for RCS use) and WhatsApp, both installed through Aurora Store, I don’t have a Google account.

Of course I need the sandboxed Google Play Services and Google Play Store to make RCS work and here are their current permissions:

Google Play Store: Network and Sensors
Google Play Services: Network, Notifications and Sensors

Obviously I had to allow other things to make RCS work in the first place. So what do you think about think about the current state (privacywise) of my main profile? As far as I know, only these 2 apps need GMS among my apps.

2

Are you sure sensors is needed?

  • Google can see a list of the apps installed on your phone, just like any app.

  • Theoretically they might be able to determine your location with sensors permission, just like any app with sensors permission.

  • They constantly know and are logging your IP address.

  • There’s probably more I’m not thinking of

  • Any apps that don’t have network but cooperate with Google could share their data with any other Google apps that do have network which could then be given to Google. Source: https://discuss.grapheneos.org/d/1517-gboard-and-google-play-services-check-ipc

You might be able to give Google less data by using WhatsApp installed from their website instead of Google because then it might not have Google’s services built in.

3

To be fair I’ve disabled Sensors for both of them yesterday, still haven’t had the opportunity to verify if it’s really needed.

You might be able to give Google less data by using WhatsApp installed from their website instead of Google because then it might not have Google’s services built in.

Google services are mandatory to get WhatsApp notifications without having to set the app to ‘unrestricted’ battery usage.

4

To confirm the titular question, the Network permission for Google Play Services is the minimum requirement for getting FCM-utilizing push notifications to work. The Sensors permission isn’t required for either that or the Google Play Store. Do note that disabling the Network permission for the Google Play Store can break some functionality, but FCM should still work. RCS might need a few more permissions for both Google Play Services & for Google Messenger, but the you should already be aware of them if you’ve set up RCS successfully. So, your set-up is as private as one can get with the requirements you set out (RCS & FCM).

But still, as @Expert4870 stated, there’s plenty of ways Google will collect your data even with this minimal set-up. There’s really nothing that can be done about it if you still want to use Google’s services. Good luck on your privacy journey. :blush:

5

updates would be affected too right? or would that be handled by Aurora store?

6

You can make separate profile just for rcs (private space for seamless experience) and separate profile for whatsapp.
That way google won’t spy on your main profile and whatsapp won’t spy on other apps and data.

If you want seamless experience with both, and you think that google is less “evil” than meta, and you need/want to use more google services with one google account, you might install logedin google service in work profile (with shelter, which is semi-separated from main) and whatsapp in private space with google service logedout.

PS: I’m eagerly waiting for multi private spaces in GOS

7

Export all your Google data and report back

8

Update: I uninstalled Play Store and Google Play Services since I was fine without RCS and just checking WhatsApp manually until I realized ProtonMail needed GMS. I thought it somehow had GMS baked-in, but it doesn’t, so I had to reinstall them unfortunately.

9

Good thing that my proton mail app don’t known about it and still works without gps…

10

Proton just needs for notifications, right?

11

Dunno, don’t use notifications in pm

12

You can get notifications for ProtonMail without GMS with You Have Mail.

13

RCS only works with Google messenger on the owner profile, as an FYI