​@

DNS adblocking with AdGiardHome (open source on GitHub, better than Pi-Hole because it supports out of the box regex matching and DoH/DoT which means it will also encrypt your queries so your ISP doesn’t mess with them, mine used to do and I don’t trust them).

Hosts adblocking on Android (AdAway) + pointing the Android system DNS resolver to a DoT server.

Firefox (PC) with uBlock Origin, Local Dan and HTTPS mode only so it will stop and warn about any page trying to load over plain HTTP. DoH configured to point to my own adblocking server.

Firefox (Android) with AdGuard extension (it blocks popups and invasive ads on mobile better than uBlock Origin and breaks less mobile websites), Decentraleyes (LocalCDN not available for mobile) and HTTPS Everywhere set to EASE mode to force HTTPS.

All my browsers configured to erase all data (cache, cookies, etc) as soon as they are closed. It’s almost like private mode but it bypasses the annoying popups that some websites display when browsing in private mode. It also means I don’t risk keeping tracking cookies for a long time if some cookie manages to bypass my filters because I close my browser daily.

This is not a 100% fool proof solution but works well enough and doesn’t break too many websites.

I’m a bit late but I’ve been running Android with an extra work profile to isolate apps for years. As others mentioned VPNs are a per-profile thing, so you can just use your Insular or Shelter app to install (clone) the VPN app to the work profile. Then just make sure you are always running 2 VPNs (normal profile and work profile).