Using GrapheneOS, my main profile has a handful of apps from PlayStore(Aurora): 1password, ProtonVPN, ProtonMail, etc.
I think I read somewhere that, for an app to appear in PlayStore, it must be compiled with linked libraries that implement check-ins with Google infrastructure… or something like that.
Obviously I’d expect apps like 1password and Proton to be “less evil,” but am curious whether everything from playstore leaks telemetry, or if it’s just “up to the developer”.
(in my case, I don’t have Google services or apps in the main profile at all)
No, Play Store does not require Play Services integration, nor does it mandate any trackers.
In practice though, most use Play Services for push notifications, and there are a LOT of apps with at least Google Crashlytics, Google Firebase Analytics, and Google Admob trackers. Check out Exodus for tracker reports. Or use the Tracker Controller app. Just note that some trackers are pretty benign, or even a security feature, like Sentry.