Have you tried searching before commenting?
https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation
not sure about win/mac, but for android yes they do keep record of stuff like what apps are being launched and upload/sync to google account. it’s not hidden though… it is(was) literally available on google account history or something (was about 7 years ago)
regarding keystrokes there was a case of a famous chinese keyboard app doing dubious stuff. not sure if i can say it’s on a os level but i’m pretty sure more than a few chinese phones ship with that. https://citizenlab.ca/2023/08/vulnerabilities-in-sogou-keyboard-encryption/
codeberg seems to be working well for me. i got too many cloudflare captchas with gitlab.com.
I use this and rsync the folder. https://f-droid.org/packages/com.github.tmo1.sms_ie/
And then the next screen asks if I want the VPN app to block ads, trackers and/or malware. (https://support.mozilla.org/en-US/kb/how-do-i-change-my-privacy-features) I already have Pihole on my network, so I don’t enable those features either.
Those DNS blocklist features are on Mullvad as well. FYI your PiHole won’t work while connected thru VPN, if it does you’re leaking DNS.
Luckily, as of today I can still set my user agent to something like a Playstation or ancient firefox/IE to get a lightweight HTML-based page. The results are in www.google.com/url?q= format but I can use a redirector extension for that.
btw my work website also checks if i’m active/focused on a tab or if I clicked off it, this addon spoofs it well https://addons.mozilla.org/en-US/firefox/addon/always-visible/