Your GhostWire Setup Guide

Your GhostWire device arrives powered off. Press and hold the Power button on the right side for 3 seconds until the phone vibrates.

On the initial Android setup screens:

1. Select your Language and tap Start.
2. Connect to your home or office Wi-Fi network.
3. When asked to set up screen security, choose PIN. Enter a 6-digit or longer number that you will remember easily.
4. Do not sign into a Google account. GhostWire runs zero-telemetry GrapheneOS; no personal account is required to use your phone.

GhostWire does not store your communications on central servers. All encryption keys are held exclusively inside your phone's hardware keystore.

1. Find and tap the GhostWire icon on your home screen.
2. Tap Initialize Private Vault.
3. Enter a strong Master Passphrase. This passphrase encrypts your local database and keys.
4. GhostWire will generate your local cryptographic identity using Post-Quantum hybrid ML-KEM-768 encryption.
5. Your vault is now ready. No mobile number, credit card, or email address is linked to your vault identity.

Under coercion, an attacker or bad actor may force you to unlock your phone or your app. GhostWire provides two separate escape routes:

A. Setting Up the GhostWire Vault-Destruction PIN

1. Open the GhostWire app and tap Settings (gear icon).
2. Tap Duress Protection > Set Duress PIN.
3. Choose a 6-digit PIN different from your master passphrase.
4. How to use it: If coerced to open GhostWire, type this Duress PIN instead of your passphrase. GhostWire will immediately overwrite and delete your cryptographic keys and messages, and present a blank, fresh first-run screen.

B. Setting Up the System Factory-Reset Duress PIN

1. Open the phone's Settings app > Security > Duress PIN.
2. Enable Duress PIN and choose a distinct number.
3. How to use it: If typed at the phone's lock screen, the entire device immediately wipes all storage partitions, user profiles, and eSIMs to factory state.

GhostWire supports both traditional physical nano-SIM cards and digital eSIM profiles:

Option A: Physical nano-SIM

1. Locate the SIM tray on the edge of your device.
2. Insert the SIM ejector tool into the small hole and press gently until the tray ejects.
3. Place your nano-SIM into the tray with the gold contacts oriented as shown in the tray cutout.
4. Push the tray back in firmly until flush with the phone body. Your phone will connect to cellular data automatically.

Option B: Digital eSIM Activation

1. Connect to Wi-Fi.
2. Go to Settings > Network & internet > SIMs.
3. Tap Add eSIM (or the + icon).
4. Select Download a SIM instead.
5. Use the camera to scan the QR code provided by your carrier (or the prepaid GhostWire Roam QR voucher).
6. Follow the on-screen prompt to download the profile, then toggle Use SIM to ON.

Security is maintained through continuous, verified updates without surveillance:

Operating System Updates

Go to Settings > System > System update. Tap Check for update. Updates download securely in the background to an alternate partition. When complete, tap Restart to switch seamlessly to the updated operating system.

GhostWire & Approved Third-Party Apps

Open the GhostWire app and select the Updates tab. GhostWire monitors verified upstream releases for its approved suite:

• Mullvad VPN: High-anonymity encrypted network routing.
• Briar: Mesh-capable, zero-infrastructure peer-to-peer messaging.
• Cake Wallet: Non-custodial Monero and multi-currency private wallet.
• SimpleX Chat: Chat without user-facing identifiers or profile metadata.
• Session: Decentralized onion-routed messaging.
• Threema Libre: Independent, Google-free end-to-end messaging.

Tap Update next to any application. Cryptographic APK signatures and developer certificates are verified automatically before installation.

GrapheneOS equips your phone with granular privacy controls unavailable on standard commercial Android:

The Network Killswitch (Per-App Internet Control)

You can cut off Internet access for any individual app completely. For example, a calculator, document reader, or photo viewer never needs access to the web.

• Go to Settings > Apps > [App Name] > Network.
• Toggle Allow network access to OFF. The app is now strictly offline at the operating system level.

Sensors Permission Toggle

Commercial apps often use motion sensors (accelerometer, gyroscope) to fingerprint users or track steps. Go to Settings > Apps > [App Name] > Sensors and toggle OFF to block physical movement tracking.

Storage Scopes

Instead of granting an app permission to see your entire photo library or download folder, GrapheneOS lets you select Storage Scopes. You can choose to allow an app to see only 1 specific folder or 1 selected image.

Hardware Camera & Mic Privacy Indicators

Whenever an application activates the camera or microphone, a bright green dot appears in the top right corner of the status bar. Swipe down twice from the top of the screen to access Quick Settings and tap Camera Access or Mic Access to disconnect hardware access across all apps instantly.

Automatic 8-Hour Reboot (Data at Rest Protection)

Your GhostWire device is configured to automatically reboot after 8 hours of being locked without use. When rebooted, your data returns to the "Before First Unlock" (BFU) state, where all encryption keys are completely purged from device RAM. To resume use, simply enter your primary screen lock PIN.

Optional USB Auto-Wipe (Anti-Tamper Cable Defense)

For high-threat environments, GhostWire can trigger a factory reset if an unauthorized data cable is plugged into the device while locked.

Connecting with Peers on GhostWire

1. Open the GhostWire app.
2. Tap the + button to add a contact.
3. Scan your contact's QR code or paste their public key token.
4. Voice calls and messages are end-to-end encrypted with ML-KEM-768 post-quantum key exchange and routed across sovereign network relays.

GhostMail (Included PGP Mailbox)

Every ready unit includes onboarding support and access to a managed OpenPGP mailbox. Open the GhostMail app to access your sovereign PGP email address. All cryptographic key pairs remain safely contained in device hardware.