Everything in owner because I don’t understand the implications well enough to do otherwise (so thanks for the thread).

Got 7 profiles actually.

1. is the owner of course.
2. Then I have my main profile.
3. A untrusted profile. Shady apps cracked apps etc. This profile also is not allowed to run in the background.
4. Then my finance profile. Has my banking apps and such.
5. A testing profile. Used to test backups of grapheneos and such.
6. A work profile. Dont need that to run in the background either. But is useful to stay in touch over the weekends.
7. And a private profile.

This way I can still use all my apps. While not requiring google play in all my profiles. Also being able to disable certain things for profiles is super useful. Running in the background, allowed to make/receive calls to name a few

Everything in Owner and a secondary phone for all proprietary work and communication apps. The secondary phone is powered off or at least disconnected once I leave work. Google stuff and banking through a computer browser whenever possible.

If I were forced to use only one phone, the secondary phone’s contents would be on a secondary profile. This used to be my setup but switching between profiles throughout the day wasn’t my thing.

You might also consider the new private space feature depending on your needs: https://www.youtube.com/watch?v=G94V5I2xH1E

I have everything in Owner profile (including Sandboxed Google Play)

One profile. No Google sandbox stuff. All open source programs.

On my work Pixel tablet I have a home profile as owner with Aurora store just to be able to load it on the other profile. Then a secondary “work” profile with all the bloat

I have 7 profiles

1. owner - network setup and app management (mullvad vpn)
2. Daily - no google services and 95% of my daily usage app (always on VPN to my home)
3. GPS - navigation and other apps that need location services (mullvad vpn)
4. PS-USA - playstore account and google services with USA identity (fake of course), (US residential VPN for sports streaming)
5. PS-CH - playstore account switzerland and google play services, my banking stuff lives here (residential vpn CH)
6. PS-DE - playstore account germany and google play services (mullvad vpn) - used for apps not available in US and CH when traveling through Germany
7. NOVPN - this account only has vanadium and connectbot (ssh) for network diagnostics in case I have issues with a wifi or something. My only account without always on VPN

I have a work profile for my work stuff. All my personal stuff is on Owner.

All you people with multiple profiles better have insane backup strategies and love doing it often and it’s a removed. You have to backup each profile and restore individually once booted back up starting with owner then one after another. It’s a nightmare.

You also cannot use a single drive to backup each profile as the backup reading process that distinguishes each profile does not understand.

Meaning the same drive cannot even be partitioned to have a save of each profile. It requires different drives entirely. The absolute simplest process for backups are having a flash drive for each profile. Graphene os is very cumbersome to backup and DOES NOT backup all data. Once you restore from a backup you’ll understand all the pains I say, including the data you have to restore separately. A good backup is only good if you know you can restore and it works.

Hope this helps people refine their profile strategies. Most people avoid owner usage. I think there are pros and cons to that strategy. Like no pop up messages, notification delays, many other lacking options outside of owner profile like certain settings are unavailable to tweak. Including dev mode.

I’ve used graphene for years, across multiple pixel generations. It’s not the white knight made out to be. Their project is very silo’d in security and lacks the true polish of a complete OS. I still use it and think it has great merit just note the drawbacks are many. There’s so much more to add. It is late in my timezone. Hope this helps someone.

I think after testing multiple strategies that the best is to main owner, business and Google stuff 2nd, sketchy apps and things you don’t care if they get lost to delete the phone back to factory. Backup 1 and 2 only. 3 or more are throwaways. You have far more threats to lose your data from theft or social engineering by friends or family etc. than you do someone hacking multiple encrypted browsers with sandboxes of apps and then across encrypted profiles. Most of those scenarios are too complex but your imagination makes them appear big and real because of movies or TV.

Reality is the true threats are often much easier and simple. Bad actors tend to be least effort to get their goal. Nor are most Jason Bourne.

I do…

Owner - these are the apps I daily drive.

Work - all work stuff lives here.

Google - apps that require the playstore.

I thought about using my owner profile as a hub for app stores and then a 2nd profile as my main profile but I found the 2nd profiles a bit unreliable in terms of receiving calls and texts.

I have all of my open source apps in my main profile, a Shelter profile for proprietary apps (which I hardly use nowadays), a user profile for apps needed for my university, and another user profile for apps needed for a certain gig I’ve been involved with

Thank you. I can’t inform a response, but your question is very helpful for me with limited / low level ideas and poised to jump to GOS.

This thread is illuminating and makes my GOS use feel very pedestrian. I just use a single profile, I keep everything off my default and only enable what I need when I need it (GPS for instance which is rare) and then disable again, and I have no accounts logged in to anything on my phone.

Currently everything in owner, with banking apps in my private space.

I was tempted by the idea of owner as an app repo but the private space is only available in the owner profile.

Someone else in this thread mentioned they were using another device for their app repo and sideloading from there. That’s an intriguing idea for keeping even sandboxed Google off my owner profile. An idea for the future maybe.

Just the one profile that comes with the install. I need a way to get Ticketmaster tickets in to a wallet tho, so I may need to set up another profile with Play Services and Google wallet, just for tickets. Either that or reset my old Samsung phone and download the tickets on to it, bring it with me to the concert. I have one year to figure it out, the concert is Dec 2026.