Redmi 3s. I have microg, although Firefox is actually Fennec F-Droid and doesn't use it. I have UBlock Origin, decentraleyes, indie wiki buddy (only got to use once), libredirect and NoScript. NoScript is annoying for when I do want scripting, although it's a lifesaver for sites (like Discourse instances) that have scriptless variants. I also recall turning down the amount of threads or something in about:config? Not sure if that helped. Also RFP but it's half placebo at this point, my opsec is permanently beyond fucked and my threat model is nonexistent.

android sux inside

Yup.

lower android version

Security patches. I don't want the fucking Bluetooth backdoor. Kinda fine with local privilege at this point, though. Oh, and I ain't setting all that up again.