always-on VPN, always off: bluetooth, location, microphone (unless strictly necessary); use Tor browser often; minimize/uninstall default corporate apps