Main profile is foss only, private space mostly for closed source. Even then I disable network permission for apps I rarely use like Google Play. If you want a VPN there too you must set it up