pull down to refresh

If I install, say, gmail or google maps on this phone, have I ruined privacy?
There are degrees of privacy.
With GrapheneOS you have the option to not give big tech your data, but of course you can opt-in to do so installing Gmail or other Google/Meta/etc apps.
Note that you can read and send emails from your gmail account using a much more private email client, such as FairEmail or K-9 Email
You can also get map directions using other apps such as Organic Maps, Magic Earth, etc.
Is it possible to have multiple "private" profiles? For instance,
Yes, you can have multiple profiles, including a guest one:
GrapheneOS raises the limit on the number of secondary user profiles to 32 (31 + guest) instead of only 4 (3 + guest) to make this feature much more flexible.
Each one of these profiles is unique, private, and independent of each other. For example you can have a special profile with sandboxed Google Play installed while your main profile doesn't have it.
User profiles each have their own unique, randomly generated disk encryption key and their own unique key encryption key is used to encrypt it. The owner profile is special and is used to store sensitive system-wide operating system data. This is why the owner profile needs to be logged in after a reboot before other user profiles can be used. The owner profile does not have access to the data in other profiles.
For further information, the GrapheneOS discussion board is excellent, as well as the official site