Actually, there's the third option - heavy sandboxing with privilege spoof. Let the app think it gets access to all it wants. E.g. fake battery stats, never ri

Actually, there's the third option - heavy sandboxing with privilege spoof. Let the app think it gets access to all it wants. E.g. fake battery stats, never ringing buzzer, empty or fake contact list, throwaway email address, geolocation in random place (around the world or city of user's choice), random per-installation device IDs, etc.