[dannyfritz07]

GrapheneOS allows you to deny network access per app pretty trivially. Google Play services make it a bit more difficult because the app might marshall the network request through that; I'm not sure how to verify that behavior when it happens.

[igoose1]

Thanks for mentioning GrapheneOS. I'll just explain to others what "pretty trivially" means here. GrapheneOS adds a huge checkmark "Network access?" when you install an app. It's impossible to miss.

[bombcar]

The problem is the yes/no options - I want to give access to specific endpoints - but now that’s “all of Cloudflare for everything” which means the web entire.

It used to be you could let Onkyo App™ access the five IPs for onkyo.com and be done with it.

[inigyou]

I think Google Play Services will only marshal data to and from Google. This will bypass the permission if you're using it as a firewall, but won't let the app run a residential proxy.