I have a setup on GrapheneOS which works using a DNS whitelist So everything is blocked by default (ControlD dns provider) and only a few websites are accessible. The password to the owner profile is locked away and can only be unlocked by waiting, so the DNS setting can't be changed on a whim. I'm very happy with this setup.

This way it does not really matter that you can install apps because to be interesting they need internet access.

I hope you never find a workaround :)

Thanks for mentioning my plugin!

Soulseek is great still use it regularly.

I’ve been using GrapheneOS for a couple of years now, and it’s been perfect for me. Contactless payments used to work fine, but then my bank switched to Google Wallet. Since then, I’ve just kept a physical card tucked behind my phone case so I can use it when needed.