Settings > Network > Private DNS. Set: dns.quad9.net.
AndyOS Settings > Network Privacy. Enable: "Block all trackers".
AndyOS Settings > App Permissions. Set: "Deny by default".
Settings > Location. Mode: "Device only" (no network).
AndyOS Privacy Guard > Firewall. Deny background data for all apps except essential ones (e.g., Signal, K-9 Mail).
Settings > Network > VPN.
- Enable: Always-on VPN.
- Enable: Block connections without VPN.
Settings > Network > WiFi. Advanced > Privacy: Use randomized MAC.