Security-wise, LineageOS is a start but (correct me if I am wrong) you need to unlock the bootloader, which is not great. These ROMs purport heightened privacy or "hardened" security.
iodéOS: "deGoogled" LineageOS fork, uses lots of blacklists for ad- and tracker-blocking. Sells pre-installed devices.
CalyxOS: Provides a fair amount of privacy. Limited device support. microG is optional. Uses F-Droid and Aurora Store.
DivestOS: Soft fork of LineageOS. "Hardened" with things like the Mulch WebView, uses F-Droid repositories for updates. Comes loaded with a tracker blocker, Mull browser, removal of proprietary blobs to reduce attack surface. ROMs available for many devices.
/e/OS: A "deGoogled" Android experience. Uses microG, no telemetry sent to Google, modified NTP and DNS servers, modified GPS service. Uses the "App Lounge" which combines the Aurora Store with F-Droid and PWAs. Has a tracker blocker. Requires you to have an @murena.io account for some functionalities.
GrapheneOS: Private, secure, hardened... has a long list of features. Updates are fast, exploitations are quickly mitigated, non-profit. Probably the most recommended, but Pixel-only.
shameless promotion
If you are just getting started, perhaps an introductory guide to digital provacy would be something you're interested in. Let me know if you see mistakes, or want to propose updates for me to include.
A very noble idea for a project, but given that it doesn't appear to support any devices from the last decade I'm not sure if it's really worth noting as something you might actually install on your phone!
I love grapheneOS but holy hell the pixels suck now. Two 5as and a 7 both with random screen issues. The first 5As screen died while sitting on my desk, you could unlock it with fingerprint and hear audio but just black screen. Ubreakifix fried the board during repair lmao
I'm on the 5A now and my wife has a 7, her 7 has the screen randomly freak out where you can't even turn it on or reset (holding power will make it vibrate after about a second preventing the hold to reset). Just have to mess with it until you can get in and hit restart then it's fine for another week or two usually.
The 5A is fantastic until it abruptly dies which has happened to me twice now (both times while sitting with it in my hand). If they didn't have screen and motherboard issues I would absolutely run this phone into the ground since it's a great experience with GrapheneOS, has a headphones jack, and has the rear facing fingerprint sensor.
I can't speak to the 6 but I know some people didn't like them after the 5 since it switched to tensor
For the users who run custom ROMs: do you typically run them on your device fresh out of the box, or do you typically wait until OS updates are no longer supported and swap then?
I used to only do it when the support ran out, but now that security/privacy is way more of an issue I think I'll put GrapheneOS straight on my next phone
I've been out of the custom ROM scene for a while, is Cyanogenmod still a thing? that shit was like magic on my Galaxy S4. I remember it getting really slow like a few months into having it only because of how damn bloated the OS was before flashing CM onto there.
Potentially for my next device, I'll look for it (and I'll keep my eyes peeled for builds for my current device in the meantime). I already have this one so with diminishing returns, I'm gonna use the phone I have with the stock OS if that's what I have to use (with as much de-googling and privacy-mindful configuration as possible). Potentially when I do get a new device, I might end up working on a build for the one I currently have.
But yeah, I'm not presently in the market for a new phone and I needed a cheap one quickly when I bought this one as at the time I was transitioning out of a phone my roommate had lent me at the time. It works and I'm trying to learn as much as I can about privacy-proofing this thing as much as is feasible.