So i am installing GrapheneOS rn and i need help:

1. i want app tracking protection to every app something like duckduckgo's app tracking protection if there is something better?!
2. someone explain me (with simple words) what is auditor cause i can't understand even if i read about it on GrapheneOS' website (i am like 50% noob with these things)
3. is my wifi masked automatically with GrapheneOS or should i 100% use a vpn? is there a setting in the OS somewherere? i need a lot of privacy and security to my phone!!!

also tell me additional tips for privacy/security for GrapheneOS if u have any!

thanks a lot!

So which on of these are better for my pixel 7a if we consider these:

i dont care about leaving the bootloader unlocked

i want customization to my os as long as this is possible

i hate google so i dont want any google things or google spyware (i dont use any google service)

i need push notifications for some apps (maybe microg or sandboxed google play services? idk)

i don't use esim or google pay so idc about these

i need A LOT of privacy and security to my data to the point that i want to block trackers for any app i use

i wanna use google camera as it is in stock rom but i dont want google spy shit. if i use a firewall would that be ok?

Note: i can sacrifice locking the bootloader and customization for my privacy/security/not having spyware on my phone

Thanks in advance!

Edit: i just saw that there is iodé (which sees app trackers and i found it interesting) plus CopperheadOS

Edit 2: THANK YOU ALL A LOT, your answers are the best, imma go with grapheneos and donate them a