GrapheneOS: Take Back Control of Your Android

There is a difference between owning a smartphone and having meaningful control over how it behaves. GrapheneOS is an open-source mobile operating system built on the Android Open Source Project (AOSP), with substantial security and privacy enhancements designed for supported Google Pixel hardware.

This guide brings together official GrapheneOS documentation and the Irish Tech Connect de-Googling research into one practical roadmap. It is designed for everyday users, privacy enthusiasts, technical learners and anyone who wants to understand their phone rather than simply accept its defaults.

What is GrapheneOS?

GrapheneOS is a privacy and security-focused operating system based on AOSP. The project concentrates on making the supported device platform more resistant to exploitation, improving privacy defaults and giving users more control over app access.

GrapheneOS is not a cosmetic launcher or a set of privacy-themed settings. It is a complete operating system with its own release process, security work and device requirements.

Security and privacy: the features that matter

Security is strongest as a system: supported hardware, up-to-date firmware, the current OS release, a locked bootloader after installation, a strong screen lock and thoughtful app permissions all contribute.

Which phone should you buy for GrapheneOS?

GrapheneOS officially supports selected Google Pixel phones and the Pixel Tablet. For a new purchase, the project recommends Pixel 8-generation devices and newer, with the Pixel 9 and Pixel 10 families offering particularly long remaining support horizons. Check the official list before buying because support status and update timelines change.

*Support end dates are the device maker’s minimum guarantee listed by GrapheneOS, not a promise of additional updates beyond that date. Check the live official device list before making a purchase.

Official reference: GrapheneOS — recommended devices and support dates ↗.

The official installation roadmap

The recommended installation route for most people is GrapheneOS’s browser-based WebUSB installer. It guides you through the installation without requiring a separate flashing application. Follow the live official instructions for your exact device and browser.

Open official installation hub ↗

Watch the GrapheneOS walkthrough

Prefer seeing it in action? Watch the full walkthrough right here on Irish Tech Connect — the install flow, the first-boot setup and the settings that matter most. The video sits inside the article, so you can follow along without leaving the page.

Apps, app stores and a practical privacy stack

App choice is personal. The strongest starting point is to choose trustworthy sources, install only what you use, review permissions and keep apps updated. GrapheneOS includes its own App Store for GrapheneOS components and supported app delivery, including the sandboxed Google Play components.

Explore the ITC starter app stack

Search by category or app name. The entries below are starting points for research; always review current publisher details, permissions, maintenance and the features you personally need.

The app list is deliberately searchable and designed to be extended as ITC validates app versions and installation sources. No app is universally “best” for every threat model.

Will your everyday apps work?

Many Android apps work normally. Some apps rely on Google Play services for notifications, maps, authentication, in-app purchases or licensing. For these, installing sandboxed Google Play in the same user profile can provide broad compatibility while keeping it within the standard app sandbox.

The ITC post-install checklist

Start with a clean baseline, then tune settings around your actual use. The goal is a phone that is both well protected and enjoyable to use.

Profiles: give different parts of your digital life their own space

Android user profiles let you separate apps and data into different environments. On GrapheneOS, profiles can also help you decide where sandboxed Google Play is available. Think of profiles as separate workspaces on one device.

This is an example architecture, not a mandatory setup. Some people prefer one profile for simplicity; others benefit from separation. Choose the smallest structure that meaningfully supports your routine, and remember that profiles still share the same physical device and its overall security state.

The ITC De-Googled Android Sovereign Stack

Your existing research has a clear guiding idea: functional sovereignty — an Android setup that stays useful while giving you more say over data, permissions, software sources and connectivity.

Functional sovereignty: the principle behind the whole build

Your original ITC Sovereign Stack Blueprint puts the mission clearly: a clean, fast, low-noise Android ecosystem with minimal telemetry, reduced dependency on Google services, open-source alternatives where practical, offline-first capability, local ownership of files, reduced background network activity and long-term maintainability.

This is not about turning Android into an unusable bunker-phone. It is about constructing an ecosystem where the device serves its operator. Privacy should support your day-to-day life: messages still arrive, maps still guide you, passwords remain recoverable, photos are backed up, and the phone stays maintainable over time.

The stack has layers

GrapheneOS is the hardened foundation. The apps, profiles, DNS choices, backup routines and everyday habits above it determine how well the overall system matches your own priorities.

Ghost-Build candidates: four routes to a more independent phone

Your original research included a broader device comparison than a GrapheneOS-only buying list. We are preserving that distinction. These are four different paths, each with its own balance of security, repairability, ROM choice, cost and hands-on involvement.

GrapheneOS route

🥇 Google Pixel 6a / 7a — legacy value candidates

Your notes singled out the Pixel 6a and Pixel 7a as lower-cost Ghost-Build candidates. Both appear in the official GrapheneOS supported-device list, but they do not have the same remaining support runway as newer recommended models.

• Pixel 7a minimum support end: May 2028.
• Pixel 6a minimum support end: July 2027.
• Pixel 8-generation and newer devices are the current recommended purchase class.
• Best use: an already-owned device or a low-cost learning/deployment device, with its support date factored into the decision.

Check the live official device list ↗

Repairability route

🥈 Fairphone 4 / 5 — modularity and repairability

Fairphone is a separate route for people who value repairable hardware, parts availability and a device designed around longevity. Fairphone publishes bootloader-unlocking guidance, and LineageOS lists Fairphone 4 and Fairphone 5 device pages.

• Useful for repairability and hands-on ownership.
• Can be paired with supported alternative operating systems such as LineageOS.
• Not an official GrapheneOS target.
• Check the exact ROM’s current release, device support, update cadence and verified-boot model before choosing it.

Fairphone bootloader guidance ↗ · LineageOS Fairphone 5 page ↗

Custom-ROM route

🥉 OnePlus 8T / 9 Pro — enthusiast experimentation

Your research identifies OnePlus devices as a power-user route. LineageOS has device pages for the OnePlus 8T and 9 Pro. The right choice depends on the exact variant, bootloader-unlock eligibility and the current ROM build.

• Useful for learning custom-ROM workflows and Android internals.
• Not official GrapheneOS devices.
• Verify model number and regional/carrier variant before purchase.
• Compare update cadence, hardware-backed security, integrity verification and app compatibility rather than assuming all ROMs offer the same security model.

LineageOS OnePlus 8T page ↗ · LineageOS OnePlus 9 Pro page ↗

🧪

Model-specific route

⚙️ Moto G Power / Edge 2023 — research before purchase

The Motorola candidates from your notes belong in a model-specific custom-ROM investigation. Unlocking availability varies by exact model, region, carrier and Motorola’s eligibility process. LineageOS install instructions for some Motorola devices direct users to Motorola’s official unlock workflow, but that does not establish support for every Moto G Power or Edge 2023 variant.

• Confirm the exact model code, not just the marketing name.
• Check Motorola’s current bootloader eligibility page before purchasing.
• Check the official ROM device list for that exact model.
• Treat this as a learning or secondary-device candidate only after support is verified.

Motorola support ↗ · LineageOS device directory ↗

Compare the routes

App acquisition: the source is part of the security decision

Your deep-research report correctly treats app acquisition as its own security layer. A trustworthy operating system cannot tell you everything about the code you choose to install. The source, signing identity, update path, publisher and app’s permissions all matter.

Where Aurora Store fits

Your original notes list Aurora Store as an anonymous Play Store frontend and a bridge during transition. Preserve that as a documented option, but do not present “anonymous” as “invisible” or as the default safest acquisition method. Aurora is an unofficial client that communicates with Google Play infrastructure; the F-Droid listing itself notes that app lists and system details may be sent to Google Play servers. For apps that require Play, GrapheneOS documents sandboxed Google Play as the supported compatibility path.

Aurora Store listing and disclosures ↗

Direct APKs and Obtainium

Direct downloads can be useful when the developer publishes the app and its update information directly. Obtainium can follow releases from developer sources. This workflow is most appropriate when you can identify the genuine project, understand its signing/update path, and notice when a project changes release channels.

Repository selection checklist

• Identify the real developer and official project page.
• Check whether the app is actively maintained and how releases are announced.
• Prefer a consistent signing identity and a clear update mechanism.
• Review permissions against the features you actually use.
• Look for source availability, reproducible-build information and independent audits where relevant; these are useful evidence, not universal guarantees.
• Keep the source and update path consistent when possible. Avoid mixing sources casually for the same app.

DivestOS end-of-project notice ↗ · Archived Mull project ↗

The full ITC De-Googled Android stack

This expands the original Sovereign Stack Blueprint rather than replacing it with a generic list. The recommendations are role-based: choose one primary tool for each job, add a second only when it solves a real problem, and re-check current maintenance before installation.

Browser reality check

Your archive recommended Vanadium as the primary browser, Mull as a secondary browser and Cromite for compatibility. Keep Vanadium as the primary GrapheneOS-native choice. Because the old Mull project is archived, replace that recommendation with an actively maintained browser selected from current project status and your needs. Cromite should likewise be checked for current release cadence and official distribution before inclusion in a maintained app list.

Messaging choices

Signal is the practical mainstream choice when your contacts already use it and you need voice/video calling. Session belongs in the stack when pseudonymous communication without a phone-number-based identity is a priority. These serve different social and operational models; the app you can use consistently with your intended contacts is usually the practical starting point.

Media, files and local workflow

Aves gives a feature-rich local media library; Fossify Gallery offers a lighter alternative. Fossify File Manager suits straightforward local file work, while Material Files is worth evaluating for network shares. VLC handles a broad range of local audio/video formats, and Auxio is aimed at local music libraries. For video editing, the archive lists Fossify Video Editor and FFmpeg-based tools; verify active maintenance and app provenance before installing them.

Profiles, workspaces and the Ghost Phone architecture

Your GrapheneOS Bible uses a three-part structure: Owner, Daily Driver and Sandbox. The idea is to give different app groups different data and Google Play boundaries, while keeping the administrative profile quiet and predictable.

Optional: a Play-enabled profile

If a small set of apps needs Google Play, consider placing those apps and sandboxed Play components in a dedicated profile. This can keep Play-dependent workflows separate from the rest of your app environment. The trade-off is convenience: notifications, contacts, shared files and account switching may need extra setup between profiles.

Profile design rules

• Start with the fewest profiles that solve a clear separation goal.
• Remember that each profile has its own installed apps and app data; install and configure apps in the profile where they will be used.
• Choose how contacts, calendar entries, files and notifications should move between profiles before creating many boundaries.
• Keep account recovery, backups and critical communication available when a profile is not running.
• Revisit the structure after a week of real use; simplify anything that adds more friction than value.

NextDNS, RethinkDNS and the network layer

The ITC research includes two complementary network tools. NextDNS offers a configurable DNS filtering service. Rethink DNS + Firewall adds per-app network controls and traffic visibility through Android’s VPN interface. Neither should be treated as a magic privacy switch; they address different parts of the network path.

A practical network rollout

Remember that a VPN-based firewall and a commercial VPN generally compete for Android’s single active VPN interface unless the app’s own design supports another arrangement. Check each tool’s current documentation before combining them.

Backups, authenticator migration and recovery planning

Your archive correctly treats recovery as infrastructure, not an afterthought. A privacy-focused phone is only practical when you can recover accounts and restore the files you care about.

Aegis migration sequence

1. Install Aegis from its trusted official source.
2. Export the existing authenticator vault using the source app’s supported process.
3. Import into Aegis and test several entries, including a critical account.
4. Create an encrypted Aegis backup and store it in more than one appropriate place.
5. Verify you can unlock and restore the backup before removing the old app or wiping the previous device.
6. Update recovery codes and emergency access instructions where required.

KeePassDX and password database care

If you use KeePassDX, treat the database file and its key material as separate critical assets. Keep encrypted backups, test opening a copied database on another device, and make sure the recovery secret is available independently of the phone. A local vault gives you ownership, but that ownership comes with responsibility for backup and restoration.

Syncthing is synchronisation, not the whole backup plan

Use Syncthing for phone-to-desktop, phone-to-Linux and phone-to-NAS transfers of photos, documents, music and selected backup files. Consider file versioning or an additional offline copy so that an accidental deletion or unwanted change is not instantly mirrored everywhere.

Pixel 7a (Lynx): the ITC installation and offline-kit notes

Your archive contains a dedicated GrapheneOS Installation Bible for the Pixel 7a (codename lynx), including Windows and Linux device detection, Fastboot, the common “waiting for any device” problem, bootloader unlocking, Web installer flow, bootloader relocking, initial configuration and return-to-stock planning.

Pre-flight

• Confirm the handset is the exact supported model and can unlock its bootloader.
• Back up the phone because unlocking and flashing wipe user data.
• Use an updated supported browser and operating system.
• Use a reliable USB data cable connected directly to the computer rather than through a hub.
• Have sufficient free storage and battery power.
• Download only from the official GrapheneOS installation site.

Web installer route

1. Prepare the phone and enter Fastboot mode according to the official instructions.
2. Connect the phone and confirm that the browser detects the device.
3. Unlock the bootloader only after confirming the backup.
4. Download and flash the official factory release through the guided installer.
5. Lock the bootloader when the installer directs you to do so.
6. Complete first boot, verify the installation and apply updates.

Device-detection troubleshooting

• Fastboot not found on Linux: verify platform-tools installation and the command path.
• Waiting for any device: check cable data capability, direct USB port connection, Fastboot mode and browser permission.
• Windows driver: current Windows 10/11 includes a generic driver for recent Pixel devices; if detection fails, check Windows Update and Device Manager against the current installer guide.
• Browser/storage issue: use an officially supported browser and avoid private-browsing mode for the web installer, which can limit storage needed to unpack releases.

Offline installation archive: what it means

Your notes correctly distinguish an offline copy of installer assets from a fully manual Fastboot deployment. These are different workflows. For a manual install, the relevant package, factory images, platform-tools and verification information must match the exact device and release. Do not assume an “Install Zip” alone contains everything required for manual flashing. Build and test the archive from the official instructions for the specific release rather than reusing an old file bundle.

Official WebUSB installer ↗ · Official installation hub ↗

Three deployment profiles: practical, balanced and advanced

Choose the profile that matches your current needs. You can move from A to B or C in stages; there is no need to deploy every advanced component at once.

Threat models: build the right level of privacy for your life

A threat model is simply a practical description of what you want to protect, from whom or what, and what trade-offs you are willing to make. It prevents the stack from turning into a pile of tools chosen just because they sound technical.

Use the tool that addresses the actual layer

DNS filtering cannot replace app permissions; a VPN cannot make an untrusted app trustworthy; a password manager cannot restore a lost vault without a backup; and profile separation is not a substitute for updates. The best stack combines layers that solve different problems.

App evaluation matrix: provenance, maintenance and privacy fit

The original deep-research report used columns for FOSS status, audit/provenance, telemetry, censorship resistance and a risk rating. That is a useful framework, but audit dates and project status must be current, and a blanket “low risk” label can hide important differences. Use the matrix below as a decision aid rather than a permanent security certification.

How to interpret audit and provenance claims

“Open source” means code can be inspected under its licence; it does not automatically mean the installed binary was built from that code. “Audited” should be accompanied by the audit date, scope and auditor. “Reproducible builds” provide a way to compare builds, where the project supports it. “No telemetry” should only be used when the claim is grounded in current implementation and network behaviour. An app’s privacy profile can also change with updates, optional features and service configuration.

The archived deep-research report contains historic audit references, including older Cure53 assessments. We have not treated those as current audits without checking the original report, scope and date. This prevents old credentials from being mistaken for a current security endorsement.

What came from the ITC archive — and what was updated

This flagship is designed as a living resource. Device support, security features, app maintenance and compatibility change. The most important operational habit is to revisit primary sources at the point of installation, purchase or major configuration change.

GrapheneOS FAQ

Official references and trusted starting points

This article combines ITC’s existing de-Googling and GrapheneOS notes with current official project documentation and selected app project pages. Official GrapheneOS documentation takes priority for device support, installation and OS behaviour.

• GrapheneOS — official project homepage
• GrapheneOS FAQ — supported and recommended devices, support dates
• GrapheneOS — features overview
• GrapheneOS — usage guide
• GrapheneOS — official installation hub
• GrapheneOS — WebUSB installer
• Rethink DNS + Firewall — official app page
• F-Droid — app repository
• Organic Maps — official project
• Signal — official messaging project
• Vanadium — GrapheneOS project repository
• GrapheneOS app drawer screenshot reference
• DivestOS project end-of-development notice
• Mull project archive status
• F-Droid security model
• Aurora Store package details and disclosures
• Fairphone official bootloader unlocking guidance
• LineageOS Fairphone 5 device page
• LineageOS OnePlus 8T device page
• LineageOS OnePlus 9 Pro device page

Editorial note: App features, support dates and compatibility change over time. This guide is intended to be maintained as a living ITC resource; revisit the linked official pages before publishing revisions or making device-purchase decisions.