A private phone, ready before it reaches you.
A hardened Pixel with hybrid post-quantum messaging, current-pair ML-KEM-rooted voice and video frame protection, safety tools, and no Google account. Set up before it reaches you.
The Pixel underneath costs a fraction of this. You are paying for the build, the hardening, the apps, the mailbox and the support — not the hardware.
What GhostWire changes in your everyday life.
You use it like a phone. We remove the usual ways your device, account and conversations can be tied back to you. Built for founders, lawyers, journalists, crypto holders, travellers and anyone who needs a phone separated from their normal identity.
There is no key escrow and no equivalent server-side key store. GhostWire routes your messages, voice and video without holding the keys needed to decrypt them.
Messages and dead drops each carry a fresh hybrid X25519 + ML-KEM-768 encapsulation, mixed into the Olm double ratchet. Current GhostWire pairings add ML-KEM-rooted application-frame encryption above DTLS-SRTP for voice and video, derived from the pairing rather than renegotiated per call — that is the difference, and it is what allows a locked handset to answer. Sessions migrated from earlier builds remain DTLS-SRTP.
There is no GhostWire phone number or account to hand over. You pair by invitation and verify the other person directly.
The handset factory-resets itself on a locked USB data plug-in (GhostWire’s USB auto-wipe) and on GrapheneOS’s own duress PIN at the lock screen, which wipes the whole device including eSIMs. A separate GhostWire duress PIN removes just the private vault. All three are configured and checked before your phone is handed over.
A dead drop is a message the receiving handset consumes once. Every drop makes a fresh ML-KEM-768 encapsulation to the recipient's published mailbox and mixes it into the hybrid handshake, sent from a throwaway account so the drop does not name its sender. It expires after 1 hour, 24 hours or 3 days, or sooner under their conversation setting, and your side keeps only a delivery marker. It cannot stop someone copying what they can read, and the app says so before you send.
Current hybrid-authenticated GhostWire pairings derive ML-KEM-rooted application-frame keys and use them above DTLS-SRTP for voice and video. Any session negotiated without that frame layer remains DTLS-SRTP rather than being mislabelled post-quantum.
15-app customer flash set: ten first-party GhostWire apps plus five selected third-party apps.
The current customer flash set contains 15 pinned apps: ten first-party GhostWire product apps plus Signal, Molly, Telegram, Cake Wallet and Mullvad VPN. Every APK is version-, hash- and signer-pinned; the handset build refuses to complete if a required app is missing, undeclared or signed by anything else. LinkBond and Vehicle Scanner are included in the handset flash bundle; the GhostWire Router companion is separate and sent by download link to router buyers. Beyond the flash set, the GhostWire approved-app store on the handset offers six reviewed third-party apps for on-demand install — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN — served from our own repository at apps.ghostwire.co.uk. The catalogue is signature-verified on the handset before anything installs, each release is pinned to its publisher’s signing key, and nothing outside the catalogue can be installed through it.
GhostWire
The zero-identity messenger. Invite-paired, no accounts, no phone number. Hybrid post-quantum pairing on every session.
Estate certGhostMail PGP Mail
OpenPGP mail on the handset. One managed account ships with the kit; use our service or connect an existing IMAP/SMTP account.
Estate certGhostBrowser
Our own browser build. No Google services, no telemetry, no sync account, nothing phoning home.
Estate certGhostMaps
Offline-first maps. Routes and searches resolve on the handset; your location is never reported to us or anyone else.
Estate certGhostWire LinkBond
Wi-Fi intelligence for the handset: current-network checks, router handoff and dual-network research. Pinned into the handset flash bundle.
Flash bundle · vc15 / 0.3.0GhostWire Shield
Always-on mobile-network watch. It checks baseband anomaly signals and warns about suspicious cell-tower behaviour, including IMSI-catcher and STINGRAY patterns.
Mobile network watch · includedGhostWire SCARAB
On-device installed-app risk scanner. It scores apps already on the handset for spyware and malware indicators and shows those findings locally. It is not a network firewall.
App-risk scanner · includedGhostWire Privacy Audit
Your Room Scanner and Wi-Fi Scanner. It probes devices on the current local network for hidden-camera risks and unusual network devices. Analysis and results stay on the handset and are not uploaded.
Room + Wi-Fi scanner · includedGhostWire Safe Room
An RF and Bluetooth bug sweep for unexpected transmitters in a controlled space before a sensitive meeting.
RF + Bluetooth sweep · includedGhostWire Vehicle Scanner
Compares salted anonymous Wi-Fi and Bluetooth references outside and inside a vehicle. It does not claim to detect powered-off, wired, cellular-only, passive or non-radio devices.
Vehicle comparison · vc1 / 0.1.0And a platform of 37 components behind them.
The handset is the part you hold. It sits on a much larger engineering programme — a specified, numbered suite covering identity, transport, storage, device management and assurance. Not every component is a consumer app, and most of them you will never see. That is the point: they are the reason the ten apps above can make the claims they do.
- GhostCore — shared crypto + contracts
- GhostKey — key custody
- GhostIdentity — identity binding
- GhostTrust — device trust
- GhostDNS — resolution privacy
- GhostWire Messenger
- GhostMesh — off-grid transport
- GhostBeacon
- GhostWatch — monitoring
- GhostDrive
- Ghostwire Vault
- GhostCloud
- GhostBackup
- GhostArchive
- GhostOS — the hardened base
- GhostPolicy — policy decisions
- GhostCommand — fleet control
- GhostUpdate — signed OTA
- GhostScan · GhostSecure · GhostPulse
- GhostCompliance — audit trail
Current manufacturing truth: every handset ships on the live signed mandatory OTA release; its USB auto-wipe path was physically bench-proven on the release bytes. Pixel 9a and Pixel 10a factory bundles are retained in GhostWire-owned private R2 and passed downloaded-byte verification; Google Drive is not used for factory-bundle publication. Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner ship on every handset alongside GhostWire, GhostMail, GhostBrowser, GhostMaps and LinkBond. The first-party local USB auto-wipe control is inside GhostWire; the retired Wasted APK and link-distributed Costa Alert are not preloaded. The wider programme is at varying stages of completion, and several components are infrastructure we run rather than software you install. GhostMail ships on the handset with one managed OpenPGP account included. Its Mac client is also available for personal, team and company use; extra managed accounts are £39/year, five for £149/year, or ten for £249/year. We would rather show you the programme honestly than pretend the box contains all of it.
One kit. Two ways to keep it alive.
The kit is the complete device, GhostWire service and suite. After your first six months, a recharge continues the relay, updates and suite. Hybrid post-quantum messaging and current-pair ML-KEM-rooted voice/video frame protection are included; calls are unmetered while service is active. Optional roaming-data SIM plans are renewed separately.
- Pixel 7a £2,300 · Pixel 8a £2,400 · Pixel 9 / 9a £2,500
- Pixel 10a £2,650 · out of stock, not orderable yet
- Priced by device: Pixel 7a £2,300 · Pixel 8a £2,400 · Pixel 9 or 9a £2,500
- Case + screen protector, fitted
- GhostWire secure messaging pre-installed
- GhostWire LinkBond Wi-Fi diagnostics ships in the handset flash bundle
- GhostWire Vehicle Scanner anonymous outside/cabin comparison ships in the handset flash bundle
- GhostWire approved-app store on the handset: SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN install on demand from our own repository, catalogue signature-verified
- SIM clarity: the phone works without SIM. Optional roaming data starts from £250; physical SIM supply is confirmed before payment and never treated as part of the core phone price.
- Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner
- GhostMail — private email, two ways: a managed mailbox on our own mail service (one included, set up for you by our operators after handover — never created automatically), or connect a mailbox you already have over standard IMAP/SMTP at no charge. Full OpenPGP either way. Extra managed mailboxes £39/year each (5 for £149, 10 for £249)
- Duress-PIN wipe armed and tested before handover
- Worldwide, dispatched within 24h of payment · secure checkout, crypto or bank transfer
- Spread the cost with Klarna or Clearpay · shown by Stripe where eligible · subject to provider approval
- Fleet discount: 10% off orders of 5 units or more
- Router bundle: Pixel 9a kit + GhostWire Router for £2,970 after the 10% bundle discount
- Full service renewal for your unit
- Roaming-data SIM renewal quoted separately when required
- Relay service + security updates
- Shield suite kept current
- GhostMail ships on every handset with one managed OpenPGP account included
- 1 extra account £39/year · 5 accounts £149/year · 10 accounts £249/year
- GhostMail for Mac is available for personal, team and company use with the same managed-account plans
- Set up for you by our operators once payment is verified — never created automatically
- Prefer your own provider? GhostMail also connects to any existing IMAP/SMTP mailbox at no charge
- Current-pair ML-KEM-rooted application-frame call protection
- No per-minute billing while service is active
- Sessions without the current frame layer remain DTLS-SRTP and are labelled accurately
- Secure Stripe checkout ready as a standalone router order
- PayPal, Klarna and Clearpay are enabled on the live Stripe checkout and shown where eligible; finance is subject to provider approval
- Pixel 9a bundle: kit + router for £2,970 after the 10% bundle discount
- GhostWire Shield, SCARAB, Privacy Audit and Safe Room ship on the handset, not the router
- GhostWire Router companion app is delivered by buyer download link for read-only gateway checks and router-panel handoff
- Router owners get six months of Mullvad VPN and secure mobile Wi-Fi
Every handset is boxed only after these checks pass.
- Current release installed from signed OTA bytes
- GrapheneOS relocked and verified boot checked
- GhostWire message and call path checked
- USB auto-wipe armed for locked data plug-in
- GhostMail managed mailbox or buyer IMAP route prepared
- Hardware case, screen protector and dispatch condition checked
Support included: setup and handover support are included with the kit. Statutory rights are unchanged; hardware warranty and replacement handling follow the device source and condition confirmed on the order.
A protected LTE connection for every device you carry.
A GhostWire-configured GL.iNet Mudi-family portable router. Phones, laptops and tablets join its secured Wi-Fi and use its Mullvad WireGuard tunnel without installing a VPN app on each client.
- Tested pilotGL.iNet GL-E750 Mudi V1
- FirmwareGL.iNet 4.3.28 / OpenWrt 22.03.4
- VPNPreconfigured Mullvad WireGuard profile
- AppGhostWire Router companion for read-only gateway checks
- Kill switchBlock-non-VPN configured and acceptance-tested
- DNS policyDNS override and rebinding protection
- Remote accessGoodCloud and DDNS disabled
Optional data: add a six-month prepaid physical SIM for this router, or an eSIM or physical SIM for a GhostWire handset, covering 160+ countries. Each option starts at £250 for the basic data plan; higher-data plans cost more and the final price is confirmed before payment. Router eSIM is not advertised until the physical-eSIM-card route passes acceptance on the exact hardware. Every router is configured and connectivity acceptance-tested before dispatch. The Android router companion is sent as a private buyer download link with router orders and currently performs read-only reachability checks until the write contract is fully measured.
GhostWire
Mail
Browser
Maps
LinkBond
VehicleThe handset stays off the mobile network. The router carries the connection.
With no physical SIM, no active eSIM and cellular disabled, the GhostWire handset does not register to mobile towers. It joins the GhostWire router over secured Wi-Fi, while the router carries the data connection and wraps connected-device traffic in its fail-closed Mullvad WireGuard tunnel.
No handset cellular identity.The mobile session uses the router SIM/IMSI and router modem IMEI. The SIM-free handset does not supply an IMSI, and its IMEI is not transmitted through its Wi-Fi connection to the router.
No personal VPN login.Each router receives its own Mullvad numbered account and WireGuard profile. Mullvad requires no customer name, email address or phone number for that account.
The SIM and public Internet identity are separated.The carrier sees an encrypted WireGuard connection from the router, while websites and services see the Mullvad exit IP rather than the SIM connection. If the VPN stops, the router kill switch blocks Internet traffic instead of exposing it.
Calls and messages remain data services.GhostWire messaging, voice and video work over the router Wi-Fi. Native carrier calls and SMS are not used; emergency calling requires another available route while handset cellular is disabled.
Security boundary: zero identity here means no GhostWire account identity, no handset SIM identity, no handset tower registration and no personal Mullvad login. The carrier still operates the router SIM session, but that transport identity is isolated on the router rather than attached to the GhostWire handset or messenger. Keep handset cellular disabled in this mode.
Every layer, specified.
No mystery hardware, no "military-grade" hand-waving. This is exactly what ships, layer by layer, as verified on our own field fleet. Together they are a combination we have not seen assembled on one handset before: an on-device post-quantum hybrid handshake, IMSI-catcher detection, hidden-camera sweeps, relocked verified boot and an instant duress vault-wipe, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
resists harvest-now, decrypt-later
zero identity by architecture
forced to unlock? the vault is already gone
handset eSIM or physical SIM · each from £250
01 Hardware
- DeviceGoogle Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a, hardened and relocked; Pixel 10a out of stock
- Security chipTitan M2 tamper-resistant element, every model
- PricingPixel 7a £2,300 · Pixel 8a £2,400 · Pixel 9a £2,500 · Pixel 10a £2,650 when back in stock
- Reference buildPixel 9a: Tensor G4, 6.3-inch 120 Hz pOLED
- Memory8 GB RAM, 128 GB storage (9a build)
- Battery5,100 mAh, all-day (9a build)
- BuildIP68 water and dust rated (9a build)
02 Operating system
- OSGrapheneOS, hardened Android, no Google services
- Verified bootGrapheneOS verified boot with a locked bootloader · OS integrity enforced at boot
- Key storageStrongBox hardware-backed keys
- Memory safetyHardware memory tagging (Pixel 8a and newer GhostWire models)
- Duress PINInstant GhostWire vault + key wipe on entry — app data, not the whole handset
- App isolationPer-app sandbox, permission scopes
- USBLocked down while the screen is locked
03 GhostWire messenger
- IdentityNone. No number, no email, no account
- EncryptionOlm double ratchet with hybrid post-quantum message epochs
- Key exchangePost-quantum hybrid: ML-KEM-768, signature-bound
- Local vaultAES-256 database, Argon2id PIN key
- PairingSingle-use QR or link invites, burned at the relay
- VerificationSafety numbers bind both identities
- Messaging1:1 and groups, voice notes, photos
- Screen privacyScreenshot-proof, blanked in app switcher
- DuressSecond PIN wipes the GhostWire vault and keys instantly
04 Calls + wake
- CallsEncrypted voice and video, peer-to-peer
- Cross-networkWiFi to cellular, secure TURN relay
- RingingRings locked; ring survives reboot
- Hang-upPropagates in 1 to 2 seconds
- WakeContent-free push from our own server; no Google, no Apple
- Push channelOur own wake channel, held by the app itself · no Firebase, no Apple, no companion app, no public relay. Delivery is managed within GhostWire's own service layer.
- Closed-appMessages and calls arrive with the app closed
05 Network + service
- DataOptional prepaid handset eSIM, or physical SIM for handset/router · six months · 160+ countries · each from £250 for the basic plan; more data costs more
- RelayManaged GhostWire store-and-forward service
- Key custodyCommunication keys stay on the GhostWire handsets · no escrow service
- VPNMullvad pre-installed
- UpdatesSigned builds from our own channel · no Google Play; approved third-party apps come from GhostWire’s own store on the handset
06 In the box
- HandsetProvisioned Pixel 9a, case + protector fitted
- CommsGhostWire with one-shot dead drops; Signal, Molly and Telegram, hardened configs
- Browser & mapsGhostBrowser and GhostMaps — our own builds, release-signed by us
- Safety suiteRoom reader, WiFi reader, IMSI-catcher alert, AV guard · GhostWire SCARAB · Privacy Audit · Safe Room · Vehicle Scanner
- ShieldGhostWire Shield threat detection, always on
- WalletCake Wallet: XMR, BTC, USDT — plus virtual and physical spending cards, ordered from inside the app
- NetworkMullvad VPN pre-installed · GhostWire first-party local USB auto-wipe
- AppsGhostWire approved-app store — our own on-handset repository: SimpleX Chat, Session, Threema Libre and Briar install on demand · no Google account and no third-party store needed
- HandoverDuress PIN armed and tested, onboarding included
Order online. Pay now or on confirmation.
Placing the order reserves your allocation and locks your price. Secure Stripe checkout offers card, PayPal, Klarna and Clearpay where eligible. If you would rather arrange payment, your order still stands: we reply within one business day and invoice you for crypto or bank transfer.
Keep this reference. You can pay now — or wait for our reply (within one business day) confirming allocation, shipping or in-person handover first.
Pay now in Bitcoin: scan the code or send the £ total in BTC at today's rate to bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q — then email your reference and transaction id. Dispatch within 24 hours of on-chain confirmation. Monero and Ethereum are also accepted — addresses below.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Questions in the meantime? info@pharoahtechnology.co.uk, quoting your reference. Or message us on Telegram: @ghostwireuk.
Questions, answered straight.
How do I pay? +
Stripe checkout, finance, crypto or bank transfer. Card, PayPal, Klarna and Clearpay are enabled on the live checkout, handled by Stripe, and shown where the buyer and order are eligible. Apple Pay, Revolut Pay, Amazon Pay and Bizum can also appear where supported by the buyer's device and country. Finance is subject to provider approval and the methods Stripe displays. Or reserve first and pay by crypto (BTC, XMR or ETH) or bank transfer against a proper invoice from Pharoah Technology Ltd once we confirm your allocation.
BTC: bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
If you are paying in crypto rather than by card, send it once we confirm your allocation and email your order reference with the transaction id so we can match it. Monero and Ethereum addresses are published below — no need to ask.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Can I pay in instalments? +
Yes — Klarna and Clearpay are enabled on the live Stripe checkout for both handset kits and the router. Stripe shows either option only where the buyer and order are eligible.
The finance provider is the lender, not us. They decide whether to approve you, they set the instalment plan and any interest, and we are not told why an application is declined. Nothing changes at our end: your kit is built and dispatched exactly the same way.
If finance is declined, is not displayed, or you would rather not use it, card, PayPal, crypto and bank transfer are still available.
What details do you actually need? +
The minimum an order needs: a name or alias, an email to reach you on, and a shipping country for kits. The device itself has no account and is never linked to your order details after handover.
Which Pixel should I choose? +
The current range is Pixel 7a, Pixel 8a, Pixel 9 and Pixel 9a. Pixel 10a is priced at £2,650 and listed as out of stock, so it cannot be ordered until stock arrives.
Where do you ship, and how fast? +
Worldwide. Kits dispatch within 24 hours of confirmed payment, tracked and discreetly packaged. In-person provisioning and handover can also be arranged; tell us in the order notes.
I already have a unit. How does a recharge work? +
Order the recharge and include your unit reference if you have it. GhostWire relay service, security updates and the Shield suite continue for another six months. Encrypted calls stay included and unmetered throughout. Any prepaid handset eSIM or physical SIM is renewed and priced separately.
Is GhostWire independently audited? +
Not yet, and we say so plainly. The architecture is no-backdoor by design, built on audited primitives, and we are migrating to fully audited cryptography. Design-partner pilots run today; we scale with formal assurance. We sell privacy and sovereignty; we do not sell "police-proof".
What can the relay see? +
The relay receives delivery envelopes, not communication keys. GhostWire runs no Key Management Server, key escrow or equivalent server-side key store. Encryption keys stay on the GhostWire handsets, so the delivery layer has no path to decrypt communications. See the privacy policy for the data-handling terms that apply to your service.
Contact, payment and product information.
✉ Contact
We answer within one business day.
Email: info@pharoahtechnology.co.uk
Telegram: @ghostwireuk
In-person provisioning and handover by arrangement. Government and fleet enquiries: mark your message "sovereign" and it goes to the top of the pile.
Sales via Telegram
Scan to start an order or delivery conversation with @ghostwireuk.
Open Telegram salesɃ Payment
Card, PayPal, Klarna or Clearpay at checkout — plus Apple Pay, Revolut Pay, Amazon Pay, and Bizum in Spain, each shown where your device, order or country supports it. Or pay by crypto or transfer once we confirm your allocation.
Pay in instalments. Klarna is offered at checkout on every kit in the range, £2,300 to £2,500. Approval, the instalment plan and any interest are entirely Klarna's — they are the lender, not us, and we are not told why an application is declined. Paying by card, crypto or transfer is always available instead.
Bitcoin (scan or copy):
bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Bank transfer to Pharoah Technology Ltd — account details are issued on your invoice, never published here.
Card payment at checkout, handled by Stripe. Email your order reference with any crypto payment. Dispatch within 24 hours of confirmed payment, worldwide.■ Product
One kit, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
Priced by device: £2,300, £2,400 or £2,500. Pixel 10a will be £2,650 when it is in stock. Recharge £750 per 6 months. Encrypted calls are included and unmetered while service is active.
Every kit: GrapheneOS relocked with verified boot, zero-identity comms with an on-device post-quantum handshake, the counter-surveillance suite, and a duress PIN armed at handover. An optional six-month prepaid roaming eSIM for a handset, or physical SIM for a handset or router, covers 160+ countries and starts at £250 for either option's basic plan; higher-data plans cost more.
An open invitation
Think you can break GhostWire? Come and try.
We will hand you the keys: a device on the table, the full spec sheet, and our undivided attention. Get in, show us how, and we will fix it and shake your hand. That is how confident we are in what ships.
Take the challenge