I don’t use apps, I disable JavaScript when I can, and I use non-megacorp web browsers that have granular security settings.

That’s not a complete solution on its own, but it’s a start.