So Owner running clean, and Google crap confined to its own user? That includes some critical stuff for me like banking apps, plus all my work stuff which my client insists must run on Google... (so it's all Gmail, Google Docs, Google Meet, Google Calendar, Asana... the whole fucking stack of shit).

To be totally honest, I'm seriously considering a two-device separation. I did it for many years and it was an absolute bitch (especially when for one reason or another I forgot to take one of the phones... which happened often). 

 that's exactly what I do, tbh, I just didn't wanna sound too paranoid, lol. the second one doesn't even have to be running on graphene, lineage would do the trick. leave pixel at home, go out the other. and now that I'm paranoid enough, I must confess: I have a third one, a cheap ass one only to use as a hotspot when I go out. as we have lotsa robbery here, it also serves as "thief's mobile". 

 LOL let's just say you're among friends. 

 someone called me paranoid here just yesterday cuz I avoid fingerprint on browsers, one never knows haha  

 If you're a dissident, there's no such thing as too paranoid. 

 as hunter thompson once said: "there's no paranoia, it's all real." 

 Would you run a set-up like this:
1. Graphene OS, no SIM. Wifi only.
2. iPhone with SIM and data as hotspot for the GOS device when I'm not in the house.
? 

 if only as hotspot, perfecto. leave it on airplane mode, turn it on like two or three miles away from your home.