Don't link or setup an icloud account. Have a admin account, never use it Run everything from a unprivileged account Use virtual machines such as UTM to segment your different workloads. Only allow the admin user to decrypt the hard drive. I.e. on first boot you login as admin then logout then login as your daily driver Never, never, install anything that needs admin privileges