Don't forget to remove your SIM card and microSD card, delete your Google account, then do a Factory Reset. Unless you have a really dated phone (2012ish or earlier) the internal storage should already encrypted by default (so enable it if is that old). If someone were to attempt to use some kind of consumer-grade recovery utility, even if you didn't do a Factory Reset the data residing on encrypted storage media will just appear to random, unreadable bits anyway.
--- As for reading somewhere that it is possible to recover your data, yes it is but the facility doing this needs to have the necessary equipment, computing resources, and trained staff, involving several millions of dollars, to maybe get some data. Unless you're actually being investigated by some governmental body, whomever might be the next recipient of your old phone a) won't be able to do much as far as recovering all or any of your old info, and b) probably won't bother to restore old data as they just want to use the it.
It's much, much more likely your personal data will be compromised by your online social media services, not from an old smartphone.