@rporter @eff that's a good start, as long as #CloudFlare is not the VPN provider & out of the DoH loop. OTOH, the VPN just moves the risk to the VPN svc, so #Orbot/Tor is better. But in the context of the OP, neither will help if the app xmits your IMEI w/gps coords.