I think what you really need is threat modeling. It seems like you’re currently trying to protect yourself against anything and everything. That’s not necessarily wrong, but it stresses you out and overwhelms you. And it’s ultimately not really beneficial either. I suggest reading the guide from PrivacyGuides.org and other resources. Ente and Proton also recently wrote a blog post about it.

I tried Graphene OS but my banking failed so back to stock Android

Any features in the mobile app that don’t exist on the website? I’ve had good luck checking my bank balance and all sorts of other things through Firefox on Android - pre-edit: I missed that it was app only. That sucks.

For browsing on Android I use Mull and on my android Proton VPN is always on. I visit twitter and twitter ocasionly but always through mull browser.

The VPN really doesn’t do much at all for privacy. It just moves the point of trust from the service provider for the current network to the VPN provider, plus now you have extra hurdles as you’ll show up as a VPN IP rather than a “normal” residential or cellular IP. Realistically set your DNS to be something like Quad9 or Cloudflare and you’ll already be several steps ahead on browsing privacy

For spending habniys I try to use Google pay as little as possible and use my master card.

Realistically any card is going to be selling your spending habits. Cash and crypto are about the only ways to have private purchases, and plenty of places won’t accept either

Personally I had a long hard think about my privacy practices and how they only isolated me and made me unhappy, and realized that if I’m already blocking all ads so I never get to see the results of the incredibly dystopian advertising hellscape, does it really matter that much if Google knows I spent $200 on random model train shit last month when they already know I watch a few hours of train-related content on Youtube? So I take smaller steps to not fully given in, but I don’t take steps that create extra hassle in participating in modern society and living my life to its fullest.

Monero

Give attention to Qubes OS also, It’s the easiest way for separating apps for different tasks, using them with different proxies (VPNs, Tor) or profiles at the same tame.

On my mobile I use a pixel 4, I tried Graphene OS but my banking failed so back to stock Android

Here in Australia I just use a physical card for tap and go for payments etc or use cash. No need for Google Pay or bank payments app. Can log in via my bank via a web browser to move cash about or check spending.

I think you demonstrated the entire point, people prefer invasive convenience over privacy., along with flimsy justification. Not having a go, it’s exactly what most people say when I query them about privacy, “It’s so much eaaier and how I manage” etc etc.

Then we have your FB messenger thing. Dead lord, stop that. If they don’t want to chat to me on Signal, they’re obviously not my friend.

I wouldn’t use Proton for mails and Drive and Passwords, I would separate into different services

Set your system-wide DNS to a provider in a country with better privacy laws. I use quad9. Disable DNS over HTTPS (DoH) in Firefox if you have it enabled, as it sends DNS queries to cloudflare, which may be even worse than sending your DNS queries to your default ISP servers (also disable DNS prefetch). If you’re hosting a DNS server, you can also set up a DNS blocklist if you use something like unbound or unwind.

I would get away from proton, they’re too popular and too much of a target, and most critically they fucked over a climate protestor, and then removed “we do not keep any IP logs” from their privacy policy. If they’re willing to lie about that, what else are they willing to lie about? If you want a fun project, set up your own mail server. Easy (relatively speaking) to do on OpenBSD with a cheap VPS provider like buyvm. Password manager is easy enough to write yourself with an openssl script, or you can use some other open source password manager if you hate scripting. Storage should be cheaper on a VPS than whatever proton is providing, and you can even host your own VPN (though this has potential to be easily routed back to you unless you serve multiple users with your VPN).

Disable javascript everywhere you don’t need it. I use qutebrowser, and javascript is disabled by default, and I only reluctantly enable it per-domain when I absolutely have to.

Use 3rd party open source clients for propietary apps, or move to open source ecosystems (like lemmy!).

I would get off of Android all together, and switch to a real Linux phone, if you can tolerate the jank. I don’t trust Google not to put a backdoor in the Android kernel (which forked all the way back at Linux 2.something). You could also try switching to a dumb phone, but those still run some amount of spooky blackbox software and I wouldn’t totally trust it from any major phone manufacturer.