Thanks for the great guide!

Here are some additions you could make:

- Sensors, network, scoped storage and scoped contacts permissions are unique to GrapheneOS, so it would make sense to mention them briefly.

- Your IMEI is exposed to Google during e-SIM provisioning. The e-SIM must be installed from the owner profile. After installation, you can delete Google Play Services again.

- For system-wide ad-blocking, AdGuard DNS can be used by setting `dns.adguard-dns.com` as the Private DNS domain.