I love the GrapheneOS approach with scopes.

The API for apps is also flawed. I'm not sure about Android but on iOS apps are told whether the user has given them full or partial access, and some apps needlessly ask for full permissions when they don't need it. Apple themselves set a bad example with this, iMovie for iOS won't even launch without full photos access

And with the current state of machine photo classification, they can sort out at least some subset of the interesting ones, so it won't just be a ton of noise they need to sift through if say they are looking for nudes or post-its with passwords written on them.

https://immich.app/

I'm running Immich.

If you have a really robust Internet connection you can reverse proxy into your home server. Make sure it's SSDs though.

For me I just have 2 people so we share 1tb of a VPS and that satisfies the photos everywhere itch.

I don't care about photos, hardly take any, so can't give you an exact answer, but I assume self-hosting is the best approach.

i use Synology Photos on my NAS, its fast, convenient, and the data stays mine. I simply pipe it through Pangolin and can access it from anywhere, my phone library is always empty.

I had the same dilemma, after self hosting Immich for a while I decided on Ente.
There 3 main reasons why I went with Ente over Immich for my family photo/setup even though Immich is perfectly cromulent and easy to setup (and I have the infra)

1) Ente gives 3xS3 storage backups with compliance lock. I was a bit nervous being in charge of uptime/backups of my families photos, this offloaded it to Ente. Once you add in the same replication the self hosted cost increases a bit.
2) Following on from point 1. Immich doesn't easily allow you to encrypt the photos at rest across users, or at least not at default. I didn't want access to my dads photos.
3) One of my favourite use cases of google photos that ente has (and immich doesn't without scripts) was automatically recognising a face of my daughter on all our families gallerys and moving them to a shared album.

I could get past point 1,2 but adding in 3, it made me just want to offload the hastle.

Theres 5 people using my Ente instance at £10 a month (£2 each). I also keep a running local backup of my gallery too.-----

Proton Drive? I am skeptical about this one. I know Proton is more secure on paper. But it is like going from 1 walled garden to another.

I use Proton for a few services and I think this is an unfair comparison, while you're right to be sceptical and Proton aren't perfect, they're much better than Google.
You need to move to a service that you can egress easy and proton does allow that.

I run Immich on a cheap dell desktop I got off ebay (7th gen i5 CPU in it), it has 2 HDDs in a mirror and sends encrypted backups to online storage at Backblaze using Restic.

A European hosted bucket and a selfhosted immich instance

Isn't grapheneOS restricted to pixel phones? Those phones can get quite expensive

Graphine makes a secure camera app you can use on any android phone: https://play.google.com/store/apps/details?id=app.grapheneos.camera.play&hl=en_US

rejection indeed

You want me to go somewhere that isn't YouTube? How inconvenient

/s