Your GrapheneOS Phone — Quick Start

Ships with every Pixel, and pairs with the 15-minute handoff orientation you got when you picked it up.

Welcome to GrapheneOS — the most secure and private version of Android there is, on your Pixel. It looks and works like a normal phone; the differences are underneath, working for you.

Step 0 — Verify it (we insist)

At handoff we ran the Auditor app together to cryptographically prove your phone is running genuine, untampered GrapheneOS with a locked bootloader. Re-run it anytime: Auditor app → self-verify, or pair with a friend's Auditor. Never skip this on any used privacy phone — even ours. That's why we make it step 0.

Browser

Vanadium — hardened Chrome without the Google. Keep it as default; it's a security component, not just an app.

Installing apps

Accrescent and F-Droid Basic are your app stores for open-source apps. Signal, Organic Maps, etc. install from there.

Updates

Install automatically in the background. Just reboot when asked — GrapheneOS updates are how the security keeps working.

"But I need a Google app…"

Fine — GrapheneOS does this better than anyone. Install Sandboxed Google Play (Apps app → Google Play), ideally in a separate profile: Settings → System → Users → Add user. Google apps run caged there with no special powers, and can't see anything in your main profile. Bank apps, Maps, Uber — most work fine this way. Message us if one doesn't.

Features worth knowing

Per-app permissions
Deny Network or Sensors to any app — apps can't tell they've been cut off.
Storage/Contact Scopes
App demands all your photos/contacts? Show it only what you choose.
Auto-reboot
Phone reboots after 18h locked, returning to strongest encryption state.
Duress PIN (optional)
A second PIN that wipes the phone if entered — high-risk users only, set up with care.
PIN scrambling
Keypad shuffles so smudges/shoulder-surfers learn nothing.

Three habits

  1. Strong unlock

    6+ digit PIN or passphrase. Fingerprint is fine day-to-day (GrapheneOS requires PIN after restarts anyway).

  2. Reboot when prompted

    It applies updates and re-locks encryption fully.

  3. Review permissions monthly

    Settings → Privacy → Permission manager. Deny anything an app doesn't obviously need.

What we set up / what we never do

We installed your chosen apps, app stores, and profiles per your order. We never: log into accounts for you, keep any of your PINs/passwords, or leave the bootloader unlocked. The phone re-locked in front of you at handoff.

Questions? Message us — end-to-end encrypted like every other conversation on the site. See our warranty page for coverage details. Community docs: grapheneos.org/usage — excellent and current.