Max-degoogle any Android phone — no flashing required

Not every phone can be flashed. US carrier Samsungs, most phones on a payment plan, work phones, and plenty of perfectly good handsets simply have a locked bootloader or no degoogled OS that supports them. That doesn’t mean you’re stuck with the full Google-and-OEM firehose.

This guide is the series overview: how to max-degoogle the phone you already own, with no root and no flashing required. Each step links to a deep-dive with the exact settings and commands.

The order matters

Do these in sequence. Each step makes the next one easier and safer:

1. Accounts and backup — so nothing you remove costs you data.
2. Debloat — remove what you never use (no root needed).
3. Per-app firewall — cut the network off for what you can’t remove.
4. Private DNS — block trackers for every app at once.
5. Permissions and settings lockdown — the Google and system switches that matter.
6. Replace Google apps — one category at a time.
7. Change where apps come from — F-Droid, Aurora Store, Obtainium.
8. Habits — the part no app can do for you.

Budget an evening for steps 1–5 and a relaxed week for 6–8.

1. Accounts and backup (30 minutes)

• Export first. Run a Google Takeout for Contacts, Calendar and Photos. Big photo libraries take hours to prepare — start it now.
• Back up the phone the way you normally would, and copy your photos to a computer. Debloating is reversible, but a factory reset is the last-resort fix and wipes the phone.
• Decide on the Google account. You can keep it signed in for now — Play Store, banking apps and push notifications often depend on it. The goal of this series is to make the account see as little as possible, then retire it once your replacements work. Our weekend plan covers the account side.

2. Remove bloatware with ADB (1 hour)

A computer, a USB cable and Google’s own adb tool let you uninstall preinstalled apps for your user without root — Facebook stubs, the manufacturer’s assistant, ad services, duplicate app stores. Use a curated list (UAD-ng or Canta) rather than guessing package names, and prefer disable over uninstall for anything beyond the obvious junk.

→ Deep-dive: Remove bloatware with ADB — no root

3. Block the internet for apps you can’t remove (30 minutes)

Some system apps can’t be removed safely, and some apps you want to keep have no business going online (a calculator, a gallery, a keyboard). A local no-root firewall such as NetGuard or RethinkDNS lets you block internet access per app, separately for Wi-Fi and mobile data.

→ Deep-dive: Block internet for unwanted apps — firewalls without root

4. Private DNS: block trackers system-wide (5 minutes)

Since Android 9, the Private DNS setting sends every DNS lookup over an encrypted connection to a resolver you choose. Pick a filtering resolver (AdGuard DNS, Mullvad’s adblock resolver, Quad9, or your own NextDNS profile) and ad and tracker domains stop resolving in every app — including the ones you can’t firewall.

→ Covered in: Private DNS, permissions and settings lockdown

5. Permissions and settings lockdown (30 minutes)

Delete your advertising ID, turn off Web & App Activity and usage diagnostics, give location only to apps that need it (and only approximate where possible), hide sensitive notifications from the lock screen, and switch off 2G if your phone offers the toggle.

→ Deep-dive: the full permissions and settings walkthrough

6. Replace Google apps, one at a time (a week)

Swap one category per day so nothing breaks at once: browser and search first (easiest), then mail, then photos, then maps. Our Google-replacement picks list a private pick and alternatives for every Google service — mail, photos, maps, browser, keyboard — with honest notes on what each replacement can’t do. The starter pack is the short version.

7. Change where your apps come from

• F-Droid — the open-source catalog; no account, no tracking.
• Aurora Store — installs Play Store apps anonymously, without signing in to Google.
• Obtainium — installs and updates apps straight from the developer’s GitHub releases. See our Obtainium guide.

Our app-store comparison has the details and download links.

8. Habits that actually matter

Fewer apps, a monthly permissions review, a separate number for sign-ups, encrypted messaging by default, and knowing when a Faraday bag is (and isn’t) worth it.

→ Deep-dive: Privacy habits that actually matter

What you can’t fix on stock Android

Be clear-eyed about the ceiling:

• Google Play Services keeps system privileges. On a Google-certified phone, Play Services runs with privileged access that apps don’t have. You can restrict its permissions and firewall some traffic, but disabling it breaks notifications for most apps and much of the Play ecosystem. Only a degoogled OS changes this (GrapheneOS runs Play as a regular, sandboxed app).
• Manufacturer telemetry. Some OEM services are protected by the system and come back after updates — debloating reduces them, it doesn’t guarantee they’re gone.
• No per-app Network permission. Stock Android can’t truly cut an app off the network; VPN-based firewalls get close but share the single VPN slot. GrapheneOS has a real Network permission toggle.
• The cellular modem and carrier. Your carrier still sees which towers you connect to, regardless of software. Turning off 2G closes one attack path; it doesn’t hide your location from the network.
• Updates. If your phone no longer gets security updates, no amount of hardening fixes that. That’s the point to pick a new phone — ideally one that can run a degoogled OS.

Quick checklist

• Takeout export started, photos backed up
• Bloat removed or disabled from a curated list
• Firewall blocking apps that don’t need the network
• Private DNS set to a filtering resolver
• Advertising ID deleted, activity tracking off
• Location only for apps that need it
• Browser and search swapped
• One Google app replaced per day, from /apps/
• F-Droid / Aurora / Obtainium set up
• Monthly permission review in your calendar

Not sure whether your phone can do better than this? Run your model through our quick phone check — if it says “harden”, this series is your plan.