GrapheneOS is a privacy-focused Android-based operating system for Google Pixel phones. It is de-Googled: Google services and tracking are removed while everyday Android apps still work. We sell new Australian-stock Pixels with GrapheneOS professionally configured by hand, with a 2-year Australian warranty and Australian support.

Is GrapheneOS legal in Australia?

Yes. GrapheneOS is free open-source software that you install and use on a phone you own. It works on Telstra, Optus and Vodafone networks in Australia, and you keep your existing number. No special permissions are required to use it on your device.

How does GrapheneOS compare to other de-Googled systems?

Privacy experts and organisations such as Proton align with GrapheneOS as the strongest de-Googled Android option for a Privacy Phone in 2026.

Does GrapheneOS only run on a Pixel?

Officially, yes. Current support is for Google Pixel phones because they meet the required hardware and update standards. PrivacyPros sells new Australian-stock Pixel phones for this reason.

How a GrapheneOS Privacy Phone works

1. You order a new Australian-stock Pixel Privacy Phone which includes a 2-year Australian warranty.
2. We update the phone to the latest stock firmware.
3. We unlock the bootloader, flash GrapheneOS, then relock the bootloader so Verified Boot stays on.
4. We professionally configure it by hand to our standards for 4-7+ hours for privacy, security and usability.
5. Australian support by a team of privacy advocates.

There is no flashing or technical setup required from you. The phone arrives ready to use. You insert your SIM or eSIM and start everyday use.

GrapheneOS key features in 2026

• Everyday apps still work. Most Android apps run normally.
• No Google or Apple account is required.
• It works on Telstra, Optus and Vodafone. You keep your existing number.
• One-tap controls: lock the camera, microphone, location, sensors and network when you want them off. See kill switches.
• Per-app network and sensors permissions: simple toggles that can block network access or sensor data for individual apps. Sensor data includes how you move the phone, lifting it, orientation and similar motion signals. See isolation features.
• Sandboxed Google Play: official Google Play that runs as a normal sandboxed app with no special system privileges. It is optional and only used in the profile that needs it.
• Duress PIN: an entered code that irreversibly wipes the device (and eSIMs) if entered (for emergencies).
• Auto-reboot: the phone restarts itself after a set locked period (default 18 hours) so data returns to an encrypted-at-rest state.
• USB-C port control: blocks data connections at the hardware and software level while the phone is locked (default is charging-only when locked).

GrapheneOS is community-driven and does not profit from your data. For the latest GrapheneOS features, see official site list at grapheneos.org/features.

Who GrapheneOS suits

Our level of professional configuration ensures an easy transition from normal phones. Our configuration includes usability so everyday apps, calls, messages and banking work when the phone arrives. You get GrapheneOS control without the complexity.

GrapheneOS suits non-technical Australians, families and everyday users who want stronger privacy defaults without building or flashing a phone themselves.

It also suits professionals such as doctors, lawyers and journalists, plus travellers and people handling sensitive client or personal information who need tighter control over apps, sensors and location.

How does GrapheneOS compare to other de-Googled phones?

De-Googled only means Google services were removed the phone. The replacements are not equal.

GrapheneOS, CalyxOS, LineageOS and /e/OS all start from Android. They differ on security hardening, how they talk to Google, which phones they support, how fast patches land, etc.

	GrapheneOS	CalyxOS	LineageOS	/e/OS (Murena)
Focus	Security-first hardening	Privacy with app compatibility	Custom ROM, wide devices	Beginner-friendly de-Google
Google path	None by default; optional sandboxed Play	microG	Customisable (potential leaks)	microG
Device Support	Google Pixels only	Pixels + others	Wide range	Fairphone and select devices
Usability for Beginners	Simple like stock Android	Easy, some Google services optional	Often needs tweaks, buggy	App-focused, slow performance
Updates	Up to 7+ years on current Pixels	Shorter, device-dependent	Varies by maintainer	Device-dependent
Australian Compatibility	Full support (Telstra, Optus, Vodafone, etc)	Good compatibility	Uneven	Limited local support

We configure and ship GrapheneOS only. It is the strongest hardened de-Googled option for Australians. You get stronger defaults, everyday apps that work, and without the trade-offs of other systems.

-> Shop Privacy Phones

-> See all FAQs

-> Contact us

Kill switches are one-tap tiles that turn off the camera, microphone, location, sensors, network, NFC or USB. They cut the path in the operating system. An app cannot flip it back on.

A permission screen is an app asking. A kill switch is the system refusing the hardware. Camera off means camera off, including to an app that already had permission.

How kill switches work

• Flip the tile. That hardware stays off until you turn it back on.
• Use it in a meeting, at a security point, or when you want the phone quiet.
• The ones you will use most sit in the quick-settings shade. One tap.
• For a full radio blackout, put the phone in a Faraday bag. Pro Bundle includes one.

What you can turn off

• Camera
• Microphone
• Location / GPS
• Sensors (motion, gyro, accelerometer and the rest)
• Network (Wi-Fi, mobile data, Bluetooth)
• NFC
• USB

Work and personal separation is profiles – a different control. See Isolation features.

The Faraday bag

The tiles quiet the phone from the inside. A Faraday bag blocks all the radios from the outside as well. Pro Bundle includes a Mission Darkness Faraday bag for phone.

Common questions

Is a kill switch the same as a duress PIN?

• No. Kill switches turn hardware off. A duress PIN wipes the device.

Can an app turn the camera back on?

• Not while the tile is off. The switch is enforced by the system, not by an app you hope is telling the truth.

Do kill switches hide me from my carrier?

• No. The network tile stops the phone using Wi-Fi and mobile data. It does not erase metadata the carrier already holds, and it does not hide a SIM that is still registered. The Faraday bag is the step when the radios themselves should be silent.

-> Shop Privacy Phones

-> Shop Faraday Bags

-> See all FAQs

A Privacy Phone can run separate profiles. Each with its own apps, files, and encryption keys.

GrapheneOS treats these profiles as separate users, not folders. Work stays in one. Banking stays in another. A child’s profile can be limited and controlled. Everyday apps stay in their own room. You switch between them in seconds, with no reboot.

How isolation features work

• Essential arrives with the Owner profile set up, and Private Space ready to use.
• Pro Bundle arrives with three profiles already built: Owner, Daily and Ghost. You can add more, up to 32.
• Storage Scopes and Contact Scopes limit what one app can see inside a profile.
• On a normal phone, one compromised app or one shared gallery can see far more than it should. Separate profiles limit how far that reaches.

How these are laid out, and which tier to buy, is in Essential or Pro Bundle.

User Profiles

A profile is a complete separate user on the phone. It has its own apps, files, accounts and encryption keys. You can also control whether that profile can make calls or send texts, on the SIM or the eSIM. It is closer to carrying a second phone than to a work folder on a normal Android device.

• On Essential, Owner is configured. You add Private Space, and extra profiles if you want them.

• On Pro Bundle, three arrive ready:
  • Owner – the admin profile. Installs and updates are pushed from here.
  • Daily – the profile you live in, with everyday apps.
  • Ghost – high-sensitivity profile, kept apart, with extra tools for tracker detection and private comms.

Private Space

A hidden room inside a profile, locked with its own PIN or fingerprint. Use it when you want one or two apps out of sight without creating a whole new profile. It has its own encryption. It still shares a few conveniences with the parent profile i.e. clipboard is. See it like a hidden drawer, not a second phone.

Scopes

Fine control over what one app can see inside a profile:

• Storage Scopes – the app gets the folders you name, not the full gallery and downloads.
• Contact Scopes – the app gets the contacts you pick, not the full address book.

The User Manual covers how to set these up.

Common questions about isolation features

Do I have to reboot to switch profiles?

• No. Switch in seconds.

Does Private Space hide everything from the parent profile?

• No. It has its own encryption and its own PIN. Some conveniences still pass through. The clipboard is the usual one. Hidden drawer, not a second phone.

Can I set up a profile for a child?

• Yes. You decide which apps exist, whether new installs are allowed, and whether calls and texts are restricted. See Privacy Phones for a child or teenager.

Separate profiles are one of the strongest practical advantages of this system. A compromised app or a messy profile stays contained.

-> Shop Privacy Phones

-> See all FAQs

Yes. A Privacy Phone can give a child or teenager their own profile on a phone you control.

That profile has its own apps, its own PIN and its own encryption keys. You decide what is in it. While installs are switched off, they cannot add an app store and fill it themselves.

This is not a separate kids phone we sell, and it is not a monitoring service. It is a GrapheneOS feature the setup is built for. You keep Owner. They get a limited profile.

How a Privacy Phone works for kids and teenagers

• Keep the Owner profile for yourself. Create a separate profile for the child or teenager.
• Install only the apps you allow, and turn off new installs in their profile.
• Restrict the SIM or eSIM if you want calls and texts switched off.
• No Google or Apple account is required. You keep the master PIN.

A stock family phone usually comes with a Google or Apple ID in the child’s name, and an app store already open. This layout removes both.

What Australian law covers for children’s privacy

From 10 December 2025, age-restricted platforms in Australia must take reasonable steps to stop under-16s holding accounts. That removed a lot of Instagram, Snapchat, TikTok and YouTube logins. It did not remove the Google or Apple account created the day a normal phone came out of the box. It did not stop a browser opening the same sites without logging in.

From 10 December 2026, the OAIC must register a Children’s Online Privacy Code. The dates are in Australia’s Privacy Law Changes. Neither rule removes tracking from stock Android or iOS.

Why Family Link is not a privacy fix

Family Link and Screen Time need a platform account on the child. You see more, but the company does too.

A Privacy Phone works the other way. You decide what exists in the profile. You do not get a live feed of their chats. Google does not get a childhood file from the operating system. An app you then allow can still collect what you permit it to collect.

Screen time, sleep and the habit itself are a separate problem. That guide is Device Addiction with Kids.

How profiles work for a child or teenager

A profile is a real user. Its own apps, files, keys and PIN. An app in one profile cannot read another. You switch in seconds. See Isolation features.

Owner is yours. It takes updates and pushes apps into the profiles you manage. After a restart, Owner unlocks first, then they switch. Give them their own PIN. Keep Owner’s PIN as the master key.

When you add the profile you can block new installs and restrict calls and texts. If TikTok is not installed, it is not in that profile.

Private Space is a hidden drawer inside a profile. It is the wrong tool for a child. Use a full extra profile.

Optional Private DNS in Owner, such as Cloudflare for Families or NextDNS, blocks many adult and phishing domains. It is a layer, not a wall. A browser can still reach what DNS does not catch.

Essential or Pro for a kids Privacy Phone

Essential arrives with Owner ready. You add their profile with the User Manual.

Pro Bundle arrives with Owner, Daily and Ghost already built. Their room is best created as a fourth profile. The 20-minute support call can cover the layout once. A longer walkthrough is a consultation. See Essential or Pro Bundle.

What a Privacy Phone will not do for kids

• It will not show you their messages or photos from inside their profile. Isolation works both ways.
• It will not replace a basic handset with no internet, for a young child who only needs to call home. This layout is for a child or teenager who needs maps, messages or a browser.

Common questions about Privacy Phones for kids and teenagers

Will you set up the child’s profile before the phone ships?

• Not as a set option. The manual has the steps. The Pro Bundle support call, or a consult, can walk you through it so you keep control afterwards.

Can a child open Instagram in the browser?

• If the site loads, yes. Take the app off. Decide whether a browser stays in that room at all. That is the control.

What about a school app that needs Google?

• Sandboxed Play in their room only. Do not put a Google login in Owner.

Does Australian law require a Privacy Phone for kids?

• No. The Privacy Act (1988) and the children’s code govern organisations. They do not strip tracking from a stock phone.

Start with a configured Privacy Phone. Keep Owner. Give them a limited profile, and control what’s in it.

-> Shop Privacy Phones

-> See all FAQs

Every Privacy Phone arrives with four app stores already set up. You can browse and install without a Google or Apple account.

Pick a store. Install what you need. The phone still feels like Android.

How to install apps on a Privacy Phone

• Install from GrapheneOS Apps, Accrescent, F-Droid or Aurora.
• Most Android apps run on GrapheneOS.
• If a bank or a government app asks for Google Play, turn on sandboxed Play in that profile. The User Manual walks through it.
• Use the stores first. A random APK file is the last resort.
• A normal phone puts a Google or Apple login at the door of every install. This one does not.

The four app stores on a Privacy Phone

1. GrapheneOS Apps is the project’s own store. The camera, Vanadium, and the other first-party tools, signed by GrapheneOS.
2. Accrescent is a small, high-trust store for this system. Apps are checked against pinned signing keys. The catalogue is shorter on purpose.
3. F-Droid is free and open-source apps. Listings note trackers, so you can see them before you install.
4. Aurora Store is the Google Play catalogue without signing in with your own Google account. Use it when the app only lives on Play. A paid purchase still needs a Google account for that transaction.

Common questions about installing apps

Will the apps I need work on a Privacy Phone?

• For most people, yes. Major Australian banks generally run once sandboxed Play is on in the profile that needs them. We leave Play off at dispatch, so the default stays private. You add it only if a specific app asks.
• Sandboxed Play is an ordinary app. It is isolated from the rest of the system. It does not get the system access Play Services has on a stock Android phone. See details in De-Googled Phones Australia: Switching in 2026.

Do I need a Google or Apple account to install apps?

• No. The four stores work without one. The exception is a paid Play purchase through Aurora. That transaction needs a Google account.

Can I install an APK file directly on GrapheneOS?

• GrapheneOS allows it. Prefer a store with signed apps when you can. The User Manual covers the safer path, and when a website is enough without an app at all.

What about Maps, YouTube or my bank apps?

• Most banks work with sandboxed Play. Maps and video already have private alternatives on the phone. See apps that come pre-installed. You can add the official apps from Aurora or sandboxed Play if you choose to.

What about the September 2026 Android install rule?

• From 30 September 2026, certified Android phones in four countries only install apps from registered developers, with a wider rollout planned for 2027. A GrapheneOS phone is not a certified Play device, so it does not enforce that rule. The stores above keep working.

-> Shop Privacy Phones

-> See all FAQs

Every Privacy Phone arrives with a vetted set of apps installed and ready. You are not assembling a privacy stack from scratch.

How pre-installed apps work on a Privacy Phone

• Essential and Pro share the same foundation: private browsers, Proton, encrypted messaging, maps, notes and the day-to-day tools.
• No Google or Apple account is required to use them.
• Pro Bundle adds a year of Proton Unlimited with the account set up, three profiles ready, and extra tools in the Ghost profile.
• Sandboxed Google Play is available. It is not switched on at dispatch. How to add an app is in install apps on a Privacy Phone.

A stock phone arrives already tied to a platform account and a store that profiles you. This set works on day one without that.

Apps on every Privacy Phone (Essential and Pro)

• Browsing: Vanadium (GrapheneOS’s hardened browser), plus Brave and Tor Browser. Private ways to play podcasts, music and video offline.
• Proton Free: Mail, Drive, Calendar, VPN on one device, Pass and Authenticator. You create the account. Swiss-hosted.
• Day to day. Documents, encrypted notes, encrypted calls and messages, offline maps and weather, and a tool to strip location data from photos before you share them. A private assistant that does not keep your prompts.

Extra apps on the Pro Bundle

Everything above, plus:

• Proton Unlimited for 12 months. About $200 at current Proton pricing: 500 GB of Drive, VPN on up to 10 devices, more addresses, Pass vaults, Sentinel and dark-web alerts. After the year you renew with Proton. Already paying for Unlimited? Contact us before purchase for a $200 discount coupon so you are not paying twice.
• Three profiles ready: Owner, Daily and Ghost. You can add more, up to 32. How those rooms work is in isolation features. Which tier to buy is in Essential or Pro.
• Ghost profile tools: Tracker detection (bluetooth and network scanners), rogue hotspot identification, secure peer-to-peer communication tools, location spoofing, Proton + Tor/Orbot hybrid VPN configurations, secure document shares, and the extra notes in the Pro manual.

Why these apps are pre-installed

Unlike others, we provide a complete, ready-to-use privacy-first ecosystem. Our detailed User Manuals include an overview of each app, Pro-tips, video links, alternatives, etc.

This approach helps you avoid a steep learning curve while maximising privacy from day one.

-> Shop Privacy Phones

-> See all FAQs

-> How to Protect Your Privacy in Australia

Yes. The Proton app set is on every Privacy Phone.

Mail, VPN, Drive, Calendar, Pass, Authenticator, Wallet, Meet and Lumo are installed on Essential and on Pro Bundle. The difference is the plan. On Pro Bundle we also set the account up.

We are a Proton Partner. The apps are Swiss-hosted. Mail and Drive are end-to-end encrypted. The VPN is no-logs. They sit inside GrapheneOS’s sandbox, so they do not get a free look at the rest of the phone.

How Proton apps work on a Privacy Phone

• Same apps on both tiers.
• Essential runs Proton Free. You create the account. Looking to upgrade? As a Proton Partner we can offer up to 38% off: https://go.getproton.me/SH30e.
• Pro Bundle includes 12 months of Proton Unlimited, about $200 at current pricing, and we complete the account setup before it ships.
• Already paying for Unlimited? Contact us before you order. We send a $200 coupon so you are not paying twice.
• Gmail, Outlook and a consumer VPN keep the account inside the same companies that already profile the phone. Proton is the account layer we put on GrapheneOS instead.

What Proton apps are on the phone

• Mail: Encrypted email instead of Gmail or Outlook.
• VPN: Routes the connection through Proton’s no-logs network. Hides your IP from the sites you visit.
• Drive: Encrypted files and photos, with sharing links when you need them.
• Calendar: Private calendar on the same login as Mail.
• Pass: Password manager with aliases and a built-in 2FA option.
• Authenticator: Standalone codes for accounts that need an extra step.
• Wallet: Self-custodial Bitcoin wallet in the Proton account.
• Meet: Encrypted video calls without a Google or Zoom account.
• Lumo: Proton’s private AI for drafts and questions, no login / account needed.

Essential

Proton Free. One Mail address, up to 1 GB and 150 messages a day. Drive up to 5 GB. VPN on one device. Calendar, Pass, Wallet, Meet and Lumo on their free tiers. No ads. You create the account after the phone arrives. The User Manual has the steps.

We are a Proton Partner, and offer up to 38% off: https://go.getproton.me/SH30e.

Pro Bundle

The same apps, on Unlimited for 12 months (~$200 value), account ready:

• 500 GB shared Mail + Drive
• 15 Mail addresses, unlimited aliases and 3 custom domains
• VPN on 10 devices, full server list (including Australia), Secure Core, Tor-over-VPN, split tunnelling, NetShield, streaming
• Proton Sentinel and dark-web monitoring
• Pass vaults, Authenticator, Wallet extras and priority support
• Lumo on the plan’s included AI tier.

See the Proton website for full specs.

After the year you renew with Proton, or step down to Free. The apps stay on the phone either way.

Which tier to buy is in Essential or Pro.

One Swiss login covers mail, files, calendar, passwords, VPN and a private assistant. That is the account layer we want on GrapheneOS. Essential is the working free set. Pro Bundle is the same set with the paid room, and the account already done.

-> Shop Privacy Phones

-> See all FAQs

Yes. Every Privacy Phone ships with three privacy-focused browsers, ready to use.

How the secure browsers work on a Privacy Phone

• Vanadium is GrapheneOS’s hardened daily browser. No Google telemetry. It updates with the system.
• Brave blocks ads and trackers, and can sync bookmarks to a computer and other devices.
• Tor Browser sends the session through the Tor network when you want that extra hop. It is slower. Some sites block it. It is not the all-day browser.
• Chrome is not installed. A normal phone opens Chrome or Safari already tied to an account. These three keep that out of the default path.

The three browsers on a Privacy Phone

• Vanadium is the one to live in. It is based on Chromium, with site isolation, a strong sandbox, and memory protections on supported Pixels. It does not send your browsing to Google. Security updates arrive with GrapheneOS.
• Brave is the one with built-in ad and tracker blocking, and encrypted sync if you want the same bookmarks on a computer. The User Manual has the steps and a sync guide for your PC and other devices. It also has a Tor window for a tighter session, without opening a separate app.
• Tor Browser is the one for a session you do not want tied to your normal browsing. Traffic goes through the Tor network. Use it when that matters more than speed. Do not use it for the bank.

Common questions about the secure browsers

If I log into Gmail or Facebook, am I still private?

• The browser leaks less. The account still knows it is you. That is the account layer. Proton Mail instead of Gmail. A private browser instead of a logged-in Chrome profile. See Proton apps on Privacy Phones.

Can I install Chrome on a Privacy Phone?

• Yes, from Aurora or sandboxed Play. We do not recommend it as the daily browser. How to add an app is in install apps on a Privacy Phone.

Does a private browser hide me from my carrier?

• No. It cuts what the tab sends. It does not hide a SIM, and it does not replace GrapheneOS. Use Vanadium or Brave for the day. Reach for Tor when the session needs the extra hop.

-> Shop Privacy Phones

-> See all FAQs