The private app starter pack, 2026

Every phone we set up gets the same first hour of apps. This is that list for 2026 — not the 40-app “awesome privacy” dump, just the ones that survived actually living with them. All free unless marked, all available without a Google account. (Looking for a specific Google service instead? The app-by-app replacement directory covers all of them, service by service.)

First: where to get apps without Google

• Aurora Store — an anonymous front-end for the Play catalog. Anything you’d normally install from Play, you install from here without signing in. This is the workhorse.
• F-Droid (or the faster Neo Store client) — open-source apps only. Get Aurora from here first.
• Obtainium — installs apps straight from their GitHub releases and keeps them updated. For the handful of apps that live outside both stores. (Ten-minute setup guide.)
• On GrapheneOS, you also have the option of real sandboxed Google Play — the compatibility of the Play Store without the privileges. Use it for banking apps that verify their installer.

Messaging

Signal. Non-negotiable first install. Works flawlessly without Google services (it falls back to its own push system), and it’s the one private app your family might already have. Molly, a hardened Signal fork, is the enthusiast option — same network, extra protections.

Email, calendar, notes

Proton Mail + Proton Calendar — the pragmatic default; one account replaces Gmail and Google Calendar. Tuta is the leaner, cheaper alternative. For notes, Standard Notes or Joplin (syncs through anything, including your own server) — both end-to-end encrypted, unlike Google Keep.

Maps

Organic Maps. Full offline navigation from OpenStreetMap data — download your country, get turn-by-turn driving/walking/cycling with zero network traffic. Its community fork CoMaps is drop-in identical if you prefer its governance. Honest caveat from the weekend guide: no live traffic. If you need transit times in a big city, run Google Maps sandboxed with location off rather than pretending you won’t.

Two-factor codes

Aegis Authenticator. Encrypted, makes proper backups (export the vault, store it with your password manager), imports from Google Authenticator via QR. Moving your 2FA off the old phone before you wipe it is the step people forget — do it first, not last.

Passwords

Bitwarden — the right answer for most people and shared family vaults; you can self-host later. KeePassDX if you want a local file and no server at all. If you’re paying for Proton anyway, Proton Pass keeps it to one subscription.

Browser

Vanadium on GrapheneOS (it’s the hardened default — keep it). Brave anywhere else, with aggressive blocking out of the box. Add DuckDuckGo, Startpage, or Kagi as the search engine.

Photos

ente Photos — encrypted Google Photos replacement with real ML search that runs on-device (paid, worth it). Immich if you’d rather self-host on a home server. Both have painless Takeout importers.

Media and the “keep a Google app” clause

YouTube is most people’s sticking point. NewPipe (F-Droid) plays it without ads, tracking or an account. And here’s our honest clause: if there’s one Google property you keep — YouTube in a private browser tab, sandboxed Maps for transit — that’s fine. The starter pack above removes Google from your messages, mail, location, photos, passwords and codes. One contained leftover doesn’t put it back.

Mistakes that cost people an afternoon

• Wiping before moving 2FA. If your authenticator codes live only on the old phone, a reset locks you out of every account that uses them. Export Aegis (or move each account) and test one login on the new phone before you erase anything.
• Installing one app from two sources. An app from F-Droid and the same app from GitHub or Aurora are usually signed with different keys, so one can’t update the other. Pick a source per app and stick with it.
• Saying yes to every permission prompt. First launch is when apps ask for contacts, location and notifications all at once. Grant what the feature you are using right now needs; you can add more later from App info.
• Restoring an old cloud backup “just to get started”. It brings back the apps and settings you were trying to leave behind. Restore contacts, photos and chat history on their own instead.

The install order, condensed

1. Aegis — move 2FA first
2. Bitwarden — passwords second
3. Signal
4. Aurora Store + F-Droid
5. Proton Mail/Calendar
6. Organic Maps
7. ente Photos
8. NewPipe

One hour, and the phone is genuinely yours. If you’re still choosing the phone itself, start with our researched phone picks or run your model through the phone checker. Keeping a stock phone for now? Pair these apps with debloating, a firewall and a settings lockdown.