Built for journalists, for people leaving abusive situations, for anyone who crosses a border more often than most, and for anyone who has simply decided their phone should not be a tracking device.
Not a list of apps you still have to configure. All of it is installed, connected and tested before the phone reaches you.
A hardened Android built for privacy, with no Google services and every app confined to its own sandbox. The bootloader is relocked after installation, so the phone refuses to start if the system has been altered.
A second PIN that looks exactly like your real one but erases the device the moment it is entered. If you are ever forced to unlock the phone, you can hand over a code that destroys the data instead of revealing it.
An account identified by a random number, with no email address and no name attached to it. Configured, tested, and set to connect automatically.
Carrier-agnostic mobile data that works across most of the world with no personal details at activation. Data only, already installed and running when you receive the phone.
A hardened fork of Signal that encrypts its message database at rest, so your conversations stay locked even while the phone is on. It talks to ordinary Signal users normally; they see nothing different at their end.
Two fully isolated environments on one device, each with its own apps, accounts and encryption. What happens in one profile is invisible to the other.
The setup, the duress PIN, the profile switch and the recovery steps, on paper. Nothing to sync, nothing to store, no file that can leak.
The hardware and configuration are identical. What changes is how long the service runs, how much data comes with it, and whether your message history comes across.
A complete, hardened phone with three months of private data and VPN. Everything works the moment you take it out of the box.
Twice the service period, three times the data, and your existing message history carried across in person.
Priced the same whichever tier you buy. None of them are required.
| Add-on | Price |
|---|---|
| Signal and Molly message migration Your existing history moved across in person, device to device, over an encrypted local transfer. Included with Standard. | $49 |
| Additional six months of VPN Extends your Mullvad account by six months. Still no email address, still no name attached to it. | $49 |
| eSIM with a phone number Adds voice and SMS to the data eSIM, for the services that still insist on a number. | $49 |
Tell us roughly what you need the phone to do. No name, no email, no form to fill in. If you are not sure what you need, that is a normal place to start.
We go through what is in stock, what each tier covers, and whether any add-on is worth it for you. We will tell you if a cheaper option does the job.
We hand the device over configured and tested, walk you through it, set your duress PIN with you, and migrate your message history if that is included.
Questions, a setting you want changed, something that stopped working: message us for the length of your service period and we will sort it out.
If yours is not here, ask us directly. We would rather answer it than have you guess.
GrapheneOS is an Android built from the same open source base as the one on your current phone, with the tracking removed and the security rebuilt. A stock Android device reports to Google continuously: location, the apps you open, the networks you join, an advertising identifier that follows you between apps. GrapheneOS ships without any of that, hardens the parts of Android that attacks usually target, and lets you decide app by app what gets network access, sensors or storage. The result is a phone that works like a phone but is not, by default, a surveillance device.
Because they are the only widely available phones that let you install a different operating system and then lock the bootloader again afterwards. That last step is what matters: a relocked bootloader with verified boot means the phone checks its own system on every start and refuses to boot if anything has been tampered with. Almost every other manufacturer either blocks alternative systems entirely or leaves the bootloader permanently unlocked, which removes the protection you installed the system for. Pixels also receive long hardware security support windows and ship with a dedicated security chip that GrapheneOS makes full use of.
Molly is a fork of Signal, built by an independent group from Signal's own published source code. It speaks the same protocol and connects to the same network, so you message ordinary Signal users normally and they see no difference. What it adds is protection on the device itself: Molly encrypts its message database at rest and can lock it behind a passphrase, so your conversation history is unreadable while the phone is sitting locked rather than merely hidden behind the screen lock. It also strips out components that depend on Google services. If you have used Signal, you already know how to use Molly.
No. The reason we configure these devices rather than sell instructions is that the setup is the hard part, and we have already done it. When you receive the phone the operating system is installed, the VPN is connected, the data plan is active, messaging is set up and the second profile exists. You use it the way you use any phone. We walk you through it in person when we hand it over, you get a printed guide, and you can reach us with questions for the length of your service period.
The phone remains yours and keeps working. GrapheneOS continues to receive updates directly from the project at no cost, and the device is not tied to us in any way. What ends is the prepaid VPN subscription and the data on the eSIM. You can extend either through us, or top them up yourself directly with the providers, or move the phone to any ordinary carrier SIM. Nothing stops working when you stop paying us, which is deliberate.
Yes. The device ships with a data-only eSIM, and there is a second physical SIM slot, so you can put your current SIM in alongside it and keep your number. You can also register Signal or Molly with your existing number without keeping that SIM in the phone. If you would rather have a separate number that is not connected to your name, the eSIM with voice and SMS add-on covers it. Which of these makes sense depends on what you are trying to protect yourself from, and we will talk it through with you before you decide.
Three reasons. A shipped device passes through hands we cannot account for, and the whole point of verified boot is knowing the phone has not been interfered with between our bench and yours. Shipping also requires a name and an address, which is a permanent record of who bought a privacy phone and where they live. And the handover is where the value is: twenty minutes with the device in your hands, showing you the duress PIN and the profile switch, is worth more than any manual we could write.
No customer database, no email list, no order history tied to a name. We keep what we need to run the business: what a device cost us, what it sold for, and when a VPN subscription or data plan comes up for renewal. None of that is linked to your identity, because we never collect it. This website has no analytics, no tracking scripts, no cookies and no contact form, and it loads nothing from any third party. If we cannot tell you what we hold about you, it is because there is nothing to tell.
Whoever finds it gets an encrypted brick. The storage is encrypted, the bootloader is locked, and without your PIN there is no way in and no way to flash something else onto it. Message us and we will disable what can be disabled remotely, such as the eSIM data plan, so it cannot be used up. What we cannot do is unlock or recover the device for you, because we do not hold your keys. That is the same property that keeps your data safe from everyone else. Back up anything you cannot lose, and we will show you how at handover.
Journalists and researchers who need a phone that does not log their sources. People leaving abusive relationships, where a shared account or a family plan is a live safety problem. People who travel constantly and would rather not hand their identity to a new carrier in every country. Lawyers, doctors and anyone else holding other people's confidences on a device. And a fair number of people with nothing in particular to hide who have simply decided they are done being tracked by default. You do not need a threat to justify wanting privacy.
There is no contact form on this site and there never will be. A privacy business that asks for your email address before it will talk to you has already told you something about itself.