Traceable but not the kind of access an app has. Traceability can be spoofed not the data that app is reading from your device. No website is ever going to ask your contacts permission to proceed further while their are tonne of apps that won't let you use app if you reject that permission.

For example, GPay in India needs freaking location permission. God knows what it does with that data.

My point isn't that either apps or the Web are better. It's a more fundamental issue of software I use constantly talking to systems I don't control. It just so happens that the Web only exists if I accept that this will happen. Applications can exist even if I don't.

Sure, you still have to deal with tracking cookies and the like, but this a tiny amount of pain compared to what a full native app could do to you without your awareness. Wiping the slate with a web browser is a fairly trivial exercise too.

Progressive web applications are the best and brightest future we have. I can only hope that some sort of antitrust shake-up forces vendors like Apple to fully-embrace PWAs and other such alternatives. When looking at the technical specifications, there isn't a whole lot of good reasoning for requiring native apps outside of exclusivity and control over their ecosystem.

I never updated stock Droid OS on my 2017 phone. I disabled most google incl Google Play, Gmail, yet the system does not let me disable PLAY Services

How do you disable play services?

Plus then you wouldn't need to give apple 30% of your money, and spend hundreds or thousands of dollars on an Apple product, and pay for their dev kit.

"Win win win"

The web would have won were it not for Apple's insurmountable power.

We have to break Apple and Google up or force them to make a first-class application marketplace they don't control and don't tax.

Then again, take a look at your desktop/laptop OS, and by comparison mobile devices are almost fortress-like in their protections. We're still using security models based on the threats of several decades ago, with barely any attempt made by any of the major desktop OSes to develop a suitable defence to the biggest threats of 2020.

The real problem here, IMNSHO, is that most users don't take privacy and security seriously, which in turn is at least partly because most users lack even rudimentary understanding of what is happening and what could be done about it. Almost everyone suddenly has a life full of small, somewhat independent devices with significant computing power, sensors, and external connectivity. Even people who choose not to use such devices themselves will still find themselves affected by this technology because so many other people around them do use it, so unless you're willing to become some sort of modern-day hermit, you can't entirely escape the trap.

But until public awareness is increased, until these issues start becoming a matter of real competition and hitting inferior product developers in their quarterly results, until there is enough concern over the more serious abuses for politicians to learn about these issues properly themselves and legislate or regulate accordingly, trying to stay off as many radars as we can is sadly the only realistic strategy. You can avoid installing untrusted software on your computers and putting IoT devices in your home, and that's a significant improvement, but it's still far from ideal.

If you think in terms of who the paying customers were/are for desktop OSes (by-and-large, corporations and governments), the "threats of several decades ago" were—and continue to be—real threats to them (vis. industrial espionage/cyberwar); whereas the modern "threats" aren't things that threaten their interests at all, "only" things that affect the lives of individuals. A corporation won't lose money because a rival knows everything about its employees shopping habits.

Insofar as nobody's currently making money selling a desktop OS to consumers (Microsoft sells cloud with the OS as a loss-leader; Apple sells the hardware with the OS as a cost-center; and RedHat, Canonical, VMWare, etc. only make money from enterprise support) there's nobody incentivized to protect the wellbeing of individual customers on the desktop.

This looks like the root cause of the problem, except that in reality users are still paying for their OSes in many cases, it's just bundled in with the cost of the equipment and they don't see it as a separate line item.

However, given the huge barrier to entry for any new competitor, not only in building a better OS but also in developing the ecosystem around it, I am increasingly sceptical that this offers a realistic route out of the current hole we find ourselves in, at least not any time soon. That's why I favour better public education, and ultimately relying on competitive and/or statutory forces to push developers in a healthier (for customers/society) direction.