With #GrapheneOS, you should always be starving your apps of permissions and capabilities until needed temporarily in the moment.

I *always* keep bluetooth, GPS, mic, and camera disabled until an app explicitly needs it.

I *always* deny full filesystem access, choosing to scope when possible.

I *always* keep my device in Airplane Mode when not being used.