GrapheneOS basics: the setup that actually matters
A practical checklist for a secure, usable GrapheneOS daily driver.
1) Keep it boring
Security comes from defaults and updates, not “200 tweaks”. (If you’re brand new to GrapheneOS, start with the beginner’s guide and then follow the setup guide.)
- Install updates promptly
- Use strong screen lock + device encryption
- Keep the app set small
2) Separate identities
Use separate user profiles for (we cover the practical “how” in the setup guide):
- daily apps
- sensitive workflows
- testing
3) Permissions are the product
- deny location unless needed
- restrict background network where possible
- prefer web apps for “tracking-heavy” services
4) Google services: choose intentionally
Some apps need Play Services. GrapheneOS lets you run sandboxed Play Services.
Use them only where needed. If you want a fast sanity-check decision, our GrapheneOS vs /e/OS comparison explains why this approach is different from microG-based ROMs.