Thanks for the great guide! Here are some additions you could make: - Sensors, network, scoped storage and scoped contacts permissions are unique to GrapheneOS, so it would make sense to mention them briefly. - Your IMEI is exposed to Google during e-SIM provisioning. The e-SIM must be installed from the owner profile. After installation, you can delete Google Play Services again. - For system-wide ad-blocking, AdGuard DNS can be used by setting `dns.adguard-dns.com` as the Private DNS domain.