How to Replace Google in Your Life: Alternatives for Every Service

To replace Google, first download a full copy of your data with Google Takeout, then move the things that lock you in (your email address, "Sign in with Google" logins and two factor authentication) before you move files, photos, maps and the browser. Open, standards based options exist for every service: IMAP mail on your own domain, CalDAV and CardDAV for calendars and contacts, self hosted or paid storage, OpenStreetMap based maps, and browsers and search engines that publish what they collect. Delete individual Google services, or the whole account, only after every login and recovery path points somewhere else.

This guide walks through that order service by service. Export and deletion steps come from Google's own help pages, and each alternative is described from its own site or privacy policy, all linked under Sources. We compare by criteria rather than ranking, because the right answer depends on what you value.

Key takeaways

• Export first, delete last. Takeout archives expire in about 7 days and allow 5 downloads. Downloading deletes nothing at Google.
• Your Gmail address is the hardest thing to move. Move to an address on a domain you control, so the next move is easier.
• Unlink "Sign in with Google" app by app. Add a password or passkey on each site first. Google's help says removing the link "doesn't delete your data on the app".
• Keep two factor authentication working at every step. Save backup codes, export authenticator codes, and prefer passkeys and FIDO security keys.
• Standards beat brands. IMAP, CalDAV (RFC 4791), CardDAV (RFC 6352), vCard, iCalendar, OpenDocument and OpenStreetMap data let you change providers again later.
• Know what you lose. Live traffic, shared document editing, photo search, Find Hub and Play Store purchases are the usual casualties.
• Android is the deepest dependency. Privacy focused distributions support few devices and change your update path.

What "replacing Google" actually involves

Google is less a set of apps than an identity. One Google Account signs you in to Gmail, Drive, Photos, YouTube and Android, and often to many other sites through "Sign in with Google". It is also a recovery address for other accounts, the store holding your app purchases, and the service that locates a lost phone.

Google's privacy policy says it collects "the content you create, upload, or receive from others when using our services", with email, photos, documents and YouTube comments as examples, plus activity and device information.

That is why the order of the move matters more than the choice of apps. Swap the browser first and nothing breaks. Delete the account first and Google's own deletion page lists what goes: emails, files, calendars and photos, content bought on YouTube or Google Play, and on Android the ability to get or update apps from the Play Store.

You also do not have to replace everything. Many people move email, files and search and keep a minimal account for YouTube or an Android phone. We cover what is reasonable to keep near the end.

The migration order that avoids lockouts

This is the sequence we recommend, and the rest of the guide follows it.

Leave at least a few weeks between phases 3 and 10, so rare emails still reach you through forwarding.

Step 1: export everything with Google Takeout

Google Takeout is Google's official export tool, at takeout.google.com. Google's help page "How to download your Google data" describes the whole flow. The steps below follow it.

Select what to include

1. Sign in and open the Google Takeout page. Products holding your data are selected automatically.
2. Uncheck products you do not want; some offer "All data included" to choose a subset.
3. Select Next step.

Google notes the archive may miss changes made between your request and its creation, such as Drive sharing changes or photos added in that window, and leaves out data still being deleted.

Choose delivery, frequency, file type and size

If you use the Advanced Protection Program, Google schedules archives two days in the future and does not offer scheduled exports. If you send the archive to Dropbox, OneDrive or Box, Google says it is no longer responsible for the files once they arrive, and its download app stays in that service's connected apps until you remove it.

Get the archive

Google emails a link when the archive is ready. That can take from minutes to days, though Google says most people get it the same day. Then:

• Download each part. You may be asked for your password and 2 Step Verification again, which Google says is to make sure only you download your data.
• Archives expire in about 7 days, and each can be downloaded only 5 times.
• Use a desktop computer, as Google recommends, and open archive_browser.html inside the archive, which describes the file formats and how to open them.

If an export fails, Google suggests fewer products, a smaller archive size, or one product at a time.

Repeat an export with a URL

Google's help documents URL parameters for Takeout. Its own example:

https://takeout.google.com/settings/takeout/custom/google_account,my_activity,fit,youtube?dest=drive&frequency=2_months

The path lists product IDs, dest sets the destination (box, dropbox, drive or onedrive) and frequency sets scheduled exports. Product IDs appear as data-id values in the Takeout page source.

What you get, and in which format

Two gaps catch people. Takeout cannot export by date range, for Gmail or anything else. And Google's help on third party data transfer says some security data, such as passwords saved in Google Password Manager, "must be exported separately". We cover that next.

Export what Takeout does not cover well

Passwords. In Chrome, open More, then Passwords and autofill, then Google Password Manager, select Settings, and next to "Export Passwords" select Download file. The file holds your passwords in readable form: import it into your new password storage, then delete it.

Bookmarks. In Chrome, open More, then Bookmarks and lists, then Bookmark Manager, then More and Export Bookmarks. You get an HTML file other browsers can import.

Calendars. Google Calendar exports only on a computer. Settings, then Import & export, then Export downloads a .zip of every calendar; a single calendar's Settings and sharing page has Export calendar. You need the "Make changes and manage sharing" permission.

Contacts. In Google Contacts, select contacts, then More actions and Export, and choose vCard or Google CSV.

Store the archive like the sensitive file it is

A Takeout archive holds your mail, photos and documents in one place. Keep it on an encrypted disk rather than a shared folder, make a second copy on a drive you disconnect afterwards, and test that it opens before you delete anything at Google. Our guide to building a disaster recovery and backup strategy covers offline copies and restore testing in more depth.

Step 2: keep two factor authentication working through the move

Most migration lockouts happen because the second factor was tied to the thing being removed: a wiped phone, a deleted Gmail address, a reinstalled authenticator app.

Save Google backup codes

Google lets you create 10 single use backup codes for when you cannot get a code. Go to your Google Account, select Security & sign-in, then 2-Step Verification, then Backup codes, and download or print them. A new set makes the old one inactive. Keep them with your passport, not in the Gmail account you are retiring. Advanced Protection accounts cannot download backup codes.

Move authenticator codes before you change phones

If you use Google Authenticator for other sites, its help page describes a manual transfer that works without a Google Account: on the old device, open the menu, choose Transfer codes, then Export codes, unlock the device, select accounts, and the app shows one or more QR codes. On the new device, choose Transfer codes, then Import codes, and scan them.

If your new authenticator app cannot import these QR codes, re-enrol each site: sign in, turn two factor authentication off and on, scan the new QR code, and test it before closing the page. Authenticator can also sync codes to your Google Account; Google says choosing Use Authenticator without an account removes them from your Google Accounts and keeps them only on the device. Decide where those codes will live before you leave.

Prefer phishing resistant methods

The US Cybersecurity and Infrastructure Security Agency (CISA) says "any MFA is better than no MFA", but calls FIDO/WebAuthn the only widely available phishing resistant option. Passkeys and hardware security keys use that standard; text messages and voice calls are the weakest common options. When you set up your new email account, add a passkey or security key, and keep at least two working sign in methods for every important account.

Update recovery details at Google until the end

Google's deletion page tells you to update recovery info before deleting, in case you want the account back later. Point Google's recovery email at your new address.

Step 3: replace Gmail

Decide what your new address will be

The most durable choice is an address on a domain you own, such as you@yourname.example, so you can change providers later without changing the address. A provider supplied address repeats the lock in you are escaping.

Compare mail options by criteria

None of these is right for everyone. For the smallest change, look at hosted mail on your own domain; if confidentiality of stored mail matters more than client compatibility, evaluate end to end encrypted providers. Read the full privacy policy of whatever you choose.

Forward Gmail to the new address

Google's Gmail help gives these steps for automatic forwarding:

1. On a computer, open Gmail and sign in to the account you are forwarding from.
2. Select Settings, then See all settings.
3. Open the Forwarding and POP/IMAP tab (or Forwarding).
4. Select Add a forwarding address, enter your new address, and confirm.
5. Open the verification email at the new address and click the link.
6. Back in Gmail settings, refresh, return to the forwarding tab, choose Forward a copy of incoming mail to, and pick what happens to Gmail's copy. Google recommends Keep Gmail's copy in the Inbox.
7. Select Save Changes.

Google forwards all new messages except spam and shows a forwarding notice for the first week. Its help adds a security warning worth remembering: if you see a forwarding notice you did not set up, change your password and turn forwarding off, because someone else may have access.

Bring old mail across

• Copy over IMAP. Google's help says Gmail works in clients such as Thunderbird, Apple Mail and Outlook, and that IMAP is always on for personal accounts since January 2025. Add both accounts to one desktop client, using "Sign in with Google" for Gmail rather than an app password, and copy folders across. Google allows up to 15 email clients per account at a time and suggests syncing folders of 10,000 messages or fewer if a client struggles.
• Import the Takeout mailbox. Some clients and providers import the mailbox file; check your destination's documentation. Labels survive only as the X-Gmail-Labels header.

A message with three labels appears in three IMAP folders, so copy "All Mail" or the label folders, not both, unless you plan to deduplicate.

Change the address everywhere

Google's deletion page tells you to add a new email address to banking, social media and app accounts before deleting Gmail. Build the list from your saved logins, a Gmail search for words like "welcome", "verify your email" and "receipt", and your card statements. Change the highest risk accounts first: other email accounts' recovery, banks, government services, mobile carrier, domain registrar and cloud accounts. A registrar account that recovers to an address you no longer control is a common way to lose a domain.

Step 4: replace "Sign in with Google"

Sites you reach through "Sign in with Google" have no password for you, so deleting the account locks you out. To review them, open your Google Account's linked apps page, select Sign in with Google, the app, then See details; Stop using Sign in with Google removes it. Google says this stops automatic sign in but "doesn't delete your data on the app". For each site:

1. Sign in to the site with Google one last time.
2. In the site's account settings, change the email to your new address and set a password, or better, add a passkey.
3. Sign out and test signing in with the new method.
4. Only then remove the link at Google.

The same page lists apps with access to your Google data and apps Gemini or a Google agent can act in. Remove any you no longer use.

Google also lets a third party service request a copy of some of your data, once or with updates for 30 or 180 days. The process always starts on the third party's site, and Google's help says that once the copy moves, the third party is responsible for it. Treat a 180 day grant like any standing access and remove it when the migration is done.

Step 5: replace Google Calendar and Contacts

Calendars and contacts are where open standards help most.

• CalDAV, defined in IETF RFC 4791, is the standard protocol for reading and writing calendars on a server.
• CardDAV, defined in RFC 6352, does the same for address books using the vCard format.

If your new provider or server supports both, most desktop and phone platforms can sync with it. On Android, apps such as DAVx5 describe themselves as an "all-in-one CalDAV/CardDAV/WebDAV solution for Android" with two way sync.

1. Export calendars as .ics and contacts as vCard, as in Step 1.
2. Import them into the new service.
3. Add the CalDAV and CardDAV accounts to your phone and computer.
4. Spot check recurring events and contacts with photos and several numbers.
5. Only then turn off Google sync for calendars and contacts on each device.

For shared family or team calendars, ask the owner to invite your new address.

Step 6: replace Google Drive and Docs

There are two separate jobs here: storing files, and editing documents together.

A practical path for many people: personal files kept locally with good backups, a desktop office suite for editing, and sync only for folders you need on several devices. List who you share documents with first; collaborators lose real time editing unless your new setup provides it.

Self hosting deserves a frank warning. A home file server is internet facing software you now maintain. Apply updates promptly, turn on two factor authentication for every account on it, and keep an offline backup. A neglected server can be a bigger privacy risk than the service you left.

Step 7: replace Google Photos

Photos are usually the largest and most personal part of an export.

• What Takeout gives you. Google says downloaded photos and videos keep the original timestamp in their embedded metadata, while extra information such as comments from Google Photos goes into a separate JSON file. Your operating system may give the downloaded file a new file timestamp, so sort by the embedded date, not the file date.
• Self hosted photo libraries. Immich is one open source example, licensed under the GNU AGPL v3. Its documentation walks through setting a storage location and enabling backup from the mobile app. Like any self hosted service, it adds a server to patch and back up.
• A local library. The photo app that ships with your computer, plus two backups, one of them offline, is the lowest maintenance option.

What you lose: search by content, face grouping, shared albums with people who stay on Google, and automatic backup from a Google signed in Android phone. During the move, Google lets you schedule exports of new and updated photos when Photos is the only product selected, which gives you a second copy while you test the new library.

Step 8: replace Search, Chrome, Maps and YouTube

These are the easiest to change and to change back.

Search engines compared by what they say they collect

The search engine is not the only party that sees a query. DuckDuckGo's policy notes your IP address remains visible to your internet provider, and Mozilla's notice says Firefox search suggestions send what you type to your search provider unless you turn them off.

Browsers

Moving browsers is mostly bookmarks, passwords and extensions. Import the bookmarks HTML, move passwords to dedicated password storage, and reinstall only the extensions you still use, from the official add on store. Extensions can read every page you visit, as we explain in browser extension security risks.

Maps

OpenStreetMap describes itself as map data "built by a community of mappers", available under the Open Database License, which requires credit to OpenStreetMap and its contributors. Many apps are built on it:

The honest trade off is live traffic, transit and business information, where community maps vary by region. Export saved places from Google Maps with Takeout before you stop using it.

YouTube

YouTube is hard to replace as a viewer, because the videos are only there. You can watch signed out (export subscriptions and playlists with Takeout first), follow creators who also publish on PeerTube, which describes itself as "free, open-source, created for non-commercial purposes" and runs as federated instances, or keep a YouTube account if you create or bought content. Takeout exports uploads in their original format or as MP4; videos under a Brand Account need you to switch to it first.

Step 9: Android without Google, or without Android

Your phone is the deepest dependency, and the place where privacy choices have the largest security consequences.

Option A: keep stock Android, use less Google

Use the alternatives above as apps, change defaults, trim permissions, and add an open source store such as F-Droid, which needs no account and says "We don't track what you install." The stock OS keeps your maker's security updates and verified boot intact.

Play purchases, Play services and Find Hub stay tied to Google. Google's help says Find Hub turns on when a Google Account is added and stores encrypted recent locations with Google by default; remove the account and you lose remote locate and erase.

Option B: a privacy focused Android distribution

The security trade offs are real:

• An unlocked bootloader lets someone with physical access replace the operating system. Prefer a device and distribution that support relocking.
• Firmware updates come from the device maker and stop when it drops the device, whatever OS you run.
• Sideloaded apps skip store review. Verify what you install; our post on Android APK supply chain verification explains how.
• Some apps will not run. Banking and payment apps may check device integrity through Google's services.
• Carrier locked phones may block installation; GrapheneOS's FAQ says this is mainly a US carrier issue.

Follow only the project's own install guide for your exact model, never unofficial builds or "one click" tools.

Option C: a different platform

Moving to an iPhone swaps Google's ecosystem for Apple's. That is a legitimate choice, but it changes providers rather than ending dependence on one.

What to keep, and when to delete

You can stop short of deleting everything.

Delete a single service

Open your Google Account, select Data & privacy, then Delete a Google service (listed as "Remove data from services you no longer use"), and select Delete next to the product. To delete Gmail but keep the account, enter the non-Gmail address you will sign in with and confirm the verification email; Gmail is not deleted until you do.

Delete the whole account

From Data & privacy, scroll to "Your data & privacy options", select More options, then Delete your Google Account, and follow the instructions. First move any archive out of Drive, move every login and subscription off the account, and remove it from your phones. If you suspect the account was compromised, run Google's Security Checkup first; it is unavailable after deletion. Google says you might recover a deleted account "within a certain amount of time" but gives no period on that page.

If you simply stop using it

Google's Inactive Google Account Policy allows deletion of a personal account unused for two years, after notices. If you keep a minimal account, sign in occasionally.

Your apps are a supply chain too

Replacing Google means choosing new software: a mail client, a sync server, a maps app, maybe a phone operating system. Each is built from open source components and depends on someone shipping updates when one of them has a vulnerability. Two habits from how security teams work carry over: keep a short list of the apps, servers and versions you rely on, and patch self hosted software on a schedule, rebuilding container images when their base images change.

Our guide to evaluating the security of open source alternatives covers what to look for before you adopt a project. Safeguard does not replace any consumer service in this article. Where it fits is the software you or your team build and run: it scans repositories, container images and SBOMs for vulnerable components, and can open fix pull requests. If you self host and deploy with containers, the same scan works on your images.

Fix it without waiting for upstream

If you self host any of the alternatives in this guide, or build software of your own, the open source components inside them will eventually carry a known vulnerability. The following applies to those components, not to consumer services you sign up for.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Common mistakes

• Deleting the account before re-pointing logins. Sites you reach with Google sign in, and accounts that recover to Gmail, become hard to reach.
• Letting the Takeout archive expire. Archives last about 7 days, and large exports take time to download.
• Leaving the archive in Google Drive, or the password export on disk. The first disappears with the account; the second is readable by anyone who gets the file.
• Wiping the old phone before moving authenticator codes. Export codes first and keep backup codes on paper.
• Using SMS as the only second factor on the new email account. Add a passkey or security key.
• Copying both "All Mail" and every label folder over IMAP. You will get duplicates of every labelled message.
• Installing an Android distribution on an unsupported device or from an unofficial build. You may end up with an unlocked bootloader and no security updates.
• Self hosting without a patch plan. A neglected internet facing server can expose more than the service it replaced.
• Phishing during the move. Expect fake "verify your account" emails; navigate to sites directly. Our explainer on what phishing is covers the patterns.

FAQ

How do I completely remove Google from my life?

Export with Google Takeout, set up email on a domain you control, move every login and recovery address to it, replace "Sign in with Google" with passwords or passkeys, move calendars, contacts, files and photos, switch browser, search, maps and phone, and only then delete Gmail or the account. Expect weeks, mostly for logins.

What can I use instead of Gmail?

Hosted mail on your own domain, an end to end encrypted provider, or a self hosted server. Compare business model, privacy policy, IMAP client support and custom domain support.

How long does Google Takeout take?

From a few minutes to a few days, according to Google, and most people get the link the same day. The archive then expires in about 7 days.

What format does Google Takeout export Gmail in?

A mailbox download in which each message keeps its labels in an X-Gmail-Labels header; archive_browser.html in the archive describes the formats. Copying over IMAP is often simpler if you want folders.

Can I delete Gmail but keep my Google Account?

Yes, from Data & privacy, then Delete a Google service. You need a different, non-Gmail address on the account, and Gmail is not deleted until you verify it.

What happens to apps where I used "Sign in with Google"?

Removing the link stops automatic sign in, but the app keeps your data. Set a password or passkey and change the email in the app first, or you may lose access.

How do I keep two factor authentication when leaving Google?

Download backup codes, export authenticator codes before changing phones, and add a passkey or security key to your new email account.

Can I use Android without a Google account?

Yes, but you lose the Play Store, Play purchases and Google's Find Hub, and some apps that rely on Google services may not work. Privacy focused distributions ship without Google apps but support a limited list of devices.

What happens if I just stop using my Google Account?

Google's Inactive Google Account Policy says a personal account unused for two years may be deleted with its content, after notices. Active purchases and gift card balances, among other conditions, keep an account active.

See how Safeguard would help

Safeguard does not replace any consumer service. These demos show the software side: the code and servers you run once you start choosing your own tools. To try the CLI, download it from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli .

The first demo is a real CLI session. safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. If you maintain a self hosted project or scripts for your new setup, this is the same flow for fixing a vulnerable dependency locally.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and scans from the terminal. If you are moving services onto your own hardware, it shows how to check repositories and images locally.

Click through it at your own pace, or open it full screen.

The third demo is a real Android session: you send work to a computer running the CLI and approve each command on the phone with Allow once, Allow for turn or Deny. Approval stays with you, on a device you control.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Google Account Help: How to download your Google data
• Google Account Help: Share a copy of your data with a third party
• Google Account Help: Delete your Google Account
• Google Account Help: Remove products
• Google Account Help: Inactive Google Account Policy
• Google Account Help: Sign in with backup codes
• Google Account Help: Get verification codes with Google Authenticator
• Google Account Help: Sign in with a passkey instead of a password
• Google Account Help: Manage links between your Google Account and apps from other developers
• Gmail Help: Automatically forward Gmail messages to another account
• Gmail Help: Add Gmail to another email client
• Google Calendar Help: Export events from your Google Calendar
• Google Contacts Help: Export, back up, or restore contacts
• Google Chrome Help: Manage passwords in Chrome
• Google Chrome Help: Import bookmarks and settings
• Android Help: Find, lock, or erase a lost Android device
• Google Privacy Policy
• CISA: More than a Password (multifactor authentication)
• RFC 4791: Calendaring Extensions to WebDAV (CalDAV)
• RFC 6352: CardDAV, vCard Extensions to WebDAV
• DuckDuckGo Privacy Policy
• Brave Search Privacy Policy
• Startpage Privacy Policy
• SearXNG documentation
• Mozilla: Firefox Privacy Notice
• Brave Browser Privacy Policy
• Fastmail Privacy Policy
• Fastmail Pricing
• Tuta Privacy Policy
• Tuta: Privacy
• Nextcloud Files
• LibreOffice: Discover LibreOffice
• Immich documentation: Introduction
• OpenStreetMap: About
• OpenStreetMap: Copyright and License
• Organic Maps
• OsmAnd
• PeerTube
• F-Droid: About
• DAVx5
• GrapheneOS FAQ
• GrapheneOS install guide
• LineageOS

Last reviewed: 23 October 2026. Google changes its help pages and Takeout options from time to time; check the linked pages before you start a migration.