I’m guessing his/her point involves the location of its incorporation. Any company in the “five eyes” zone can be forced to release details about its users to any member state. One must evaluate whether NordVPN keeps anything more than a few hours - days tops - to decide if it is “safe enough”. I was worried enough about this particular point that I chose a VPN that is not in any way beholden to five eyes or the fourteen eyes, which is a similar agreement.

Proton caught heat because of its release of information to the local law enforcement recently. While Switzerland is not part of the five eyes, it does have its own laws requiring a reveal in certain circumstances. I forgot the details, but I think they had an IP address that had not yet been wiped from cache, and that was enough to pinpoint the hackers being sought.

In truth, there’s no sure way to be sure. One still must trust the organization is both honest and competent enough to properly wipe any residual information. No matter who it is, some amount of information has to be in cache for some time in order to be able to deliver the service, and there also needs something tracking the workings of the system to ensure it isn’t overloaded or to find opportunities to improve it.

I know a few are on F-droid, so he could get those at least

I get those with Magisk/LSposed, but having it by default is nice. Maybe i will check it out sometime.

Does it have parental controls?

Anything you get from f-droid or Izzy will work fine. OsmAnd is on F-droid. Anything from play store will expect google push notifications, etc., so you need microg or equivalent.

I found that google voice is working with LineageOS with MicroG. The last time i checked a year or so ago, it didn’t.

That only blocks for the browser. What about your apps? I never see add banners or popups in apps as i use adaway. Further, I can customize with well maintained blocklists that include other categories like malware and harvesting sites.

I’m confused. Authy is just a 2FA client. There’s half a dozen in fdroid. I use FreeOTC myself. Are graphene users unable to use anything else?