Pixel 9 or earlier with GrapheneOS (ideally purchased unlocked without a carrier contract, so in-store or on ebay), sandboxed google play services, and ideally using FOSS apps as much as possible.