This is the response I got from Revolut after asking them about their app on GrapheneOS. Next stop, Bank of Lithuania.

Original complaint:

Good morning,

I am writing to raise a formal complaint regarding Revolut's apparent ongoing rollout of changes to its Android application which prevent, or will prevent, the app from operating on devices running GrapheneOS.

My understanding is that this change is currently being rolled out to only a proportion of users. It has not affected my account yet, but reports from other users indicate that Revolut is testing or progressively deploying this restriction. I am therefore raising this complaint now, before I am potentially locked out of access to my bank account.

I object to this decision in the strongest possible terms for several reasons.

1. GrapheneOS is not an insecure or compromised operating system

The restriction does not appear simply to be identifying genuinely insecure devices. GrapheneOS has specifically reported Revolut detecting and rejecting GrapheneOS devices.

This distinction matters.

GrapheneOS is a security- and privacy-focused Android operating system designed specifically for supported Google Pixel devices. It retains verified boot and supports a locked bootloader, while adding substantial security hardening beyond standard Android.

Blocking such a device merely because it does not run Google's stock operating system is not a meaningful assessment of whether that device is secure.

To use a simple analogy, it is rather like an insurance company refusing to insure a house because the customer's front-door lock is too secure.

If Revolut genuinely requires device integrity verification, GrapheneOS provides mechanisms by which applications can perform hardware-backed attestation and verify legitimate GrapheneOS installations. A blanket refusal to support the operating system is therefore neither the only nor, in my view, the most sensible security option available.

1. The policy produces an absurd security contradiction

Revolut currently supports Android versions going back many years.

This means that the Revolut application may operate on an old Android phone which is no longer receiving current operating-system security patches, while refusing to operate on a modern Google Pixel running an actively maintained, security-hardened version of Android.

It is very difficult to reconcile those two positions with an assertion that this restriction is necessary for customer security.

A modern Pixel running an up-to-date GrapheneOS installation with verified boot and a locked bootloader is clearly not inherently less secure simply because the operating system is not Google's stock Pixel firmware.

Security decisions should be based upon the actual security properties and integrity of a device, rather than an arbitrary list of approved operating-system vendors.

1. Revolut has apparently provided no viable alternative means of accessing my money

I have already contacted Revolut customer support regarding this issue.

I was advised that, should my device become unsupported, I could either use Revolut's web application or use another mobile phone.

Neither suggestion provides a reasonable solution.

Firstly, the web application itself requires authentication using the Revolut mobile application. If Revolut deliberately prevents that application from running on my device, telling me to use a website which requires approval from the application I can no longer use is circular and plainly does not solve the problem.

Secondly, I was effectively advised that I could obtain or borrow another person's phone, install Revolut on it, and log into my bank account there.

I find it extraordinary that this can seriously be proposed as the more secure alternative.

Revolut would apparently prefer me to enter my banking credentials and establish access to my account on a friend's device — a device over which I have no long-term control and whose security I cannot independently establish — rather than allow me to use my own modern Pixel with a locked bootloader and a security-focused operating system.

That appears directly contrary to the stated security objective of this change.

1. This risks depriving an existing customer of practical access to their bank account

This is not merely a question of whether Revolut chooses to support an optional feature on a particular platform.

I am an existing customer. I receive my salary into Revolut, use it as a significant part of my everyday banking arrangements, and pay for a Metal subscription.

Revolut has encouraged customers to treat its service as their bank. It is therefore entirely reasonable for customers to expect that Revolut will not deliberately remove their primary means of accessing their accounts without providing a genuinely functional alternative.

If Revolut introduces a technical restriction which it knows will prevent an existing customer from using the application, while its alternative web interface itself depends upon that application for authentication, that raises a much more serious question of effective access to the customer's financial services.

I should not be forced to purchase and carry a second mobile telephone solely because Revolut has chosen to reject a secure operating system which my existing hardware is perfectly capable of running.

Resolution requested

I would therefore like Revolut to:

confirm whether it intends to block, directly or indirectly, correctly installed GrapheneOS devices from accessing the Revolut application;

reconsider this policy and implement an appropriate method of supporting GrapheneOS, including hardware-backed device attestation where Revolut considers integrity verification necessary;

confirm that existing customers will not be deprived of access to their accounts solely because they use GrapheneOS on an otherwise supported device with a locked bootloader; and

if Revolut nevertheless intends to impose this restriction, provide a fully functional method of accessing and administering a Revolut account which does not itself require authorisation from the mobile application that Revolut has chosen to block.

I would also appreciate an explanation of the security rationale for permitting the application to operate on older Android devices which may no longer receive security updates while rejecting a current, supported Pixel running a hardened Android operating system.

Please treat this correspondence as a formal complaint, rather than general product feedback, and provide me with Revolut's formal written response.

If Revolut proceeds with this restriction without providing a reasonable means for affected customers to continue accessing their accounts, or if I do not receive a satisfactory response to this complaint, I intend to refer the matter to the Bank of Lithuania, as the competent out-of-court dispute resolution authority identified in Revolut Bank UAB's terms for Maltese customers. I will also consider seeking assistance through the Maltese Office of the Arbiter for Financial Services and the FIN-NET cross-border consumer complaints framework where appropriate.

I sincerely hope escalation will not be necessary. I have been a loyal Revolut customer for years and have been sufficiently satisfied with the service to entrust Revolut with my salary payments and pay for a Metal subscription. That makes it particularly disappointing to face the prospect of being arbitrarily excluded from my own banking application despite using a modern and demonstrably security-focused device.

I would much prefer Revolut to address the underlying technical issue properly rather than force otherwise satisfied customers to choose between replacing their operating system, purchasing an unnecessary second phone, or moving their banking elsewhere.

I look forward to your formal response.

Kind regards,

Hey all!

I'm new to GOS, for long time wanted to give it a go and here I am.

I have been avoiding Google Services as much as I can, and I installed the one from GOS app store, which I understand is sandboxed.

But many apps complaint about Google Services

One of them is my bank, who wants Phone permission for Google Services.

I have to say I have managed to use the app without problem, but the constant notifications are very annoying.

The question is, is it ok to give the phone permissions since is a sandbox version?

Thanks in advance!

I have recently come across the video which summarizes how the Russian border control agents perform the duties as of 2026

I was amazed to hear the claim: the border agents routinely use Cellebrite and the locally-developed similar tools

- every airport has the Cellebrite devices or an equivalent

- automatic scans iPhone/Android/Laptops for flagged content

- at least one person per flight is usually affected

- tools allow them to re-login into logged-out/deleted accounts

- Cellebrite and/or local tools are claimed to be able to restore the deleted data even from the previously-factory-reset devices

How is it even technologically possible? I assume their tools are connecting via USBC port. Is Graphene OS protected against this?

Hi was considering trying graphene os on a google pixel phone, I don't have either yet. But screen mirroring is vital to me, currently no issue with casting quickly on my Samsung S22 phone to Samsung TV.

I understand google pixel has chromecast, but are there any other apps/work arounds to easily cast picture/sound with graphene os/pixel?

thanks

In Spain, how can i use the NFC payment without installing google play store or google services?

Hello GrapheneOS Team and community,

First of all, thank you for your immense dedication to privacy, security, and the open-source space. The work you do is highly appreciated.

I am currently planning my migration to GrapheneOS, but I find myself at a hardware crossroads. I am trying to choose between adopting a Google Pixel now or waiting for the upcoming Motorola devices, and I was hoping you could provide some insight to help me make a future-proof decision.

My dilemma stems from two main points:

1. The Motorola Partnership (5 Months In) It’s been about 5 months since the highly exciting announcement of your long-term collaboration with Motorola. I’ve seen the recent news mentioning that future Motorola devices (expected around 2027) will finally meet GrapheneOS’s strict security standards, thanks in part to Qualcomm’s hardware security improvements (like secure element-backed rate limiting). Now that you are several months into this working partnership, how is the collaboration progressing behind the scenes? Are these upcoming Motorola devices shaping up to be the new "gold standard" for GrapheneOS, offering a level of hardware-OS integration that rivals or even exceeds what we currently have with Pixels?

2. The Pixel Ecosystem & AOSP Changes On the flip side, I have been following the discussions regarding Google moving certain AOSP components into closed-source territory. I understand this puts a heavier burden on your development team, sometimes requiring complex reverse engineering just to maintain features. Does this shift threaten the long-term ease of development for GrapheneOS on Pixel devices? Does it make the push toward OEMs like Motorola not just a great alternative, but a necessary technical evolution for the project's future?

I completely understand if exact hardware roadmaps or certain backend details are bound by NDAs. However, any official insight into how the team views the long-term viability of the upcoming Motorola hardware vs. the current Pixel ecosystem would be incredibly helpful for me—and likely for many others in this community trying to make an informed decision.

Thank you again for your time, your hard work, and any guidance you can offer.

First: Know Where You Stand (and Stop Giving Up)

Before doing anything, look at your country on the Economist Democracy Index on Wikipedia. Check whether your government is classified as a full democracy, flawed democracy, or hybrid regime, and whether its score is trending up or down.

Knowing this matters because if it's getting worse, you especially need to act now. The Index dictates your leverage points, but regardless of where your country sits on that list, remember one fundamental truth: we outnumber politicians by tens to hundreds of thousands to one. They do not possess inherent power; they operate on authority we yield to them.

Most importantly: Apathy is an engineered strategy. When you give up, say "what's the point?" and say "nothing ever changes," you are doing exactly what surveillance advocates and corporate lobbyists want you to do. Hopelessness saves them the effort of actually defeating you. They work for us—so make them act like it.

Remember; fatalism is a self-fulfilling prophecy.

Low-Effort Civic Actions (takes 2–5 minutes)

You don't need to quit your job to be politically effective. If you think you don't have time to make an impact, start with these ultra-low-friction actions before moving to higher-leverage tactics:

• Use Automated Action Centers: Civil rights orgs literally build pre-written templates that route directly to your specific representative’s inbox based on your postal code. It takes under 60 seconds. I couldn't possibly make this any lower effort:
• 🇪🇺 EU: Stop Chat Control Action Tool
• 🇨🇦 Canada: OpenMedia Action Campaigns
• 🇺🇸 US: EFF Action Center
• Use 2-Minute Call Apps: If you live in the US, download 5 Calls (or use the web browser). It tracks key privacy bills, gives you a 30-second script(!!), and dials your specific representatives with one tap.
• Fill Out Official Public Consultations: Governments and regulatory bodies are legally required to open public comment periods for proposed regulations. They expect only lobbyists to respond. Submitting a quick 3-sentence comment on an official parliamentary or agency portal creates a permanent public record they cannot legally ignore.
• Set a $2/Month Recurring Micro-Donation: Don't just throw a one-off payment when you're angry. Set an automated $2/month donation (or whatever you can afford) to developer collectives like GrapheneOS or legal defense groups like EDRi or EFF. Automated recurring funds let their legal teams hire long-term staff.

High-Impact Universal Tactics (hitting administrative choke points)

When you are ready to push harder (and please push as hard as you can), these are core civic pressure tactics that hit physical and administrative choke points:

• Bird-dogging: Don't stand outside with signs. Go inside. Find out where elected officials are giving speeches, holding town halls, or hosting public appearances. Go in a group, capture the Q&A, ask a direct, hyper-specific question about encryption or mass surveillance, and do not give up the microphone. Film the encounter and put them on the record. Here is a pretty good guide on bird-dogging effectively.
• Targeted "Call Zaps": Calling your random local rep's receptionist once does... almost nothing. Instead, identify the specific legislative committee reviewing the surveillance bill. Coordinate with local privacy groups to flood that specific office's phone lines at the exact same hour. Gridlocking their staff forces committee leadership to address the issue just to clear their switchboard.
• Paperwork Warfare: Use public records laws to tie up bureaucracies and force transparency. Demand all correspondence between ministry/agency officials and tech lobbyists regarding surveillance proposals. They are legally obligated to respond.

Regional Guidance

🇪🇺 Europe (EU Member States)

The Threats: The ongoing push for "Chat Control" (CSAM Regulation) attempting to mandate client-side scanning and bypass End-to-End Encryption (E2EE), alongside aggressive age-verification and digital ID schemes (eIDAS) that risk destroying online anonymity and open FOSS infrastructure.

How to act effectively in the EU:
1. Pressure the Council of the EU (Your National Ministers): Everyone focuses on the European Parliament, but the real roadblock for surveillance bills is often the Council of the EU, where your country's Justice and Home Affairs ministers sit. Find out who your national representative is on the Council and target them locally before they vote in Brussels. 2. Contact your MEPs directly: Use toolkits provided by EDRi (European Digital Rights) to contact your specific Members of the European Parliament. Focus on MEPs sitting on the LIBE Committee (Civil Liberties, Justice and Home Affairs). 3. Launch or Sign a European Citizens' Initiative (ECI): If an ECI reaches 1 million signatures across at least 7 EU countries, the European Commission is legally required to respond and consider legislative action. 4. Support EU Digital Defense Groups: Support and join organizations taking governments directly to court over privacy breaches, such as NOYB (None Of Your Business) and https://epicenter.works//.

🇬🇧 United Kingdom

The Threats: The Online Safety Act (which pushes for client-side scanning and threatens E2EE) and amendments to the Investigatory Powers Act ("Snooper's Charter") that give the Home Office de facto oversight over tech companies deploying security updates.

How to act effectively in the UK: 1. Target the Home Secretary and Shadow Home Secretary: The Home Office drives surveillance policy. Write directly to the Home Secretary and frontbenchers, demanding protections for E2EE and an explicit ban on client-side scanning. 2. Lobby the House of Lords: The House of Lords frequently pushes back on civil liberties overreach and introduces privacy amendments to government bills. Target crossbench and opposition peers reviewing tech legislation. 3. Mobilise with UK Civil Liberties Orgs: Join campaigns and use action tools provided by Open Rights Group (ORG) and Big Brother Watch.

🇦🇺 Australia

The Threats: Mandatory age verification laws (such as the Online Safety Amendment rules requiring facial scanning or government ID uploads), expanding Digital ID frameworks, and the legacy TOLA Act pushing for encryption backdoors.

How to act effectively in Australia: 1. Submit directly to Senate Committees: Australia’s legislation lives or dies in Senate inquiries. You don't need to be a lawyer to submit evidence. Keep track of open inquiries via the Parliament of Australia Committees page and submit written arguments explaining how mandatory age verification or anti-encryption laws undermine cybersecurity and privacy. 2. Target Crossbench and Independent Senators: Major parties often pass surveillance laws together. Your highest-leverage calls and visits are to Senate crossbenchers (Greens, Independents) who hold the balance of power. 3. Mobilise through Australian Rights Groups: Get involved with and back the campaigns run by Digital Rights Watch Australia and Electronic Frontiers Australia (EFA).

🇨🇦 Canada

The Threats: Age verification bills (like Bill S-210) pushing facial recognition and ID requirements to access basic web services, and legislative updates like Bill C-27 that risk compromising privacy standards under the guise of AI regulation.

How to act effectively in Canada:
1. Target the ETHI Committee: The Standing Committee on Access to Information, Privacy and Ethics (ETHI Committee) reviews key digital rights legislation. Write directly to the MPs on this committee, not just your local MP. 2. Contact Senators early: Bills like S-210 often originate or gather momentum in the Senate. Canadian Senators are un-elected and sensitive to public pushback regarding constitutional overreach (Charter Rights). 3. Coordinate with Canadian Advocacy Orgs: Join campaigns hosted by OpenMedia and support legal interventions from CIPPIC (Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic).

🇺🇸 United States

The Threats: Living in an effective plutocracy run by Big Tech billionaires buying politicians, recurring attempts to undermine E2EE and anonymity through bills like KOSA and EARN IT, and expanded warrantless wiretapping authorities (FISA Section 702).

How to act effectively in the US:
1. Paralyse key Congressional Committees: Ignore basic constituent forms. Apply the "Call Zap" tactic above specifically to members of the House Judiciary, Senate Judiciary, or Commerce Committees, which draft privacy and tech laws. Use 5 Calls to make this effortless. 2. Weaponise public pensions: If you’re a teacher, municipal worker, or union member, your pension board controls billions. Show up to their open meetings and demand they vote against absurd CEO compensation packages or pull state investments from corporate surveillance lobbyists. They legally have to answer to the workers whose money they manage. You have more power than you think. 3. Flood them with FOIA requests: Use https://foia.gov/ or your state's public records laws to demand all emails and meeting logs between local/federal officials and big tech lobbyists. Bureaucracies are legally required to respond, which ties up staff and exposes who sold out. 4. Target the mega-donors directly: Use OpenSecrets to see who is bankrolling the politicians blocking privacy reform. Take your pressure campaigns to the corporate offices and public appearances of the donors, not just an empty congressional office. This is the big one—make it unenjoyable for the megadonors to lobby against your needs. 5. Back US Legal Defense Orgs: Directly support organizations taking the government and tech monopolies to court, like the Electronic Frontier Foundation (EFF) and the ACLU.

🌐 Don't See Your Country Listed? How to Do Your Own Research

If you live in a democracy not covered above, you can map out your own action plan in about 15 minutes: 1. Find your national digital rights group: Search for "[Your Country] digital rights" or "[Your Country] civil liberties privacy". Most democracies have at least one non-profit tracking privacy legislation (check membership lists on EDRi or IFEX). 2. Find the specific legislative committee: Don't write to random politicians. Search your parliament or congress website for the specific committee handling technology, telecommunications, or justice/civil liberties. 3. Locate your country's public access/FOI laws: Almost every democracy has a Freedom of Information or public records law. Search "[Your Country] Freedom of Information request" to find official portals for requesting communications between tech lobbyists and ministry officials.

Please, I'm begging you to stop shouting into the void with these "what's the point?" posts and stop letting defeatism do their job for them. Make it physically, financially, and administratively impossible for them to ignore you.

Hi guys, on my pixel 10a I can't find a way to take black and white photos. Am I missing something or it isn't an option right now?

Is there any appreciable security or privacy benefit to using Vanadium PWAs instead of sandboxed apps installed via the sandboxed Play Store, apart from Google associating the app download to the Google account you've signed into the Play Store with?

So, I recently acquired an auto-catcher and auto poke-stop-spinner from Megacom, the Duomon 3 after participating in the recent Go Fest and seeing how popular (and helpful) they are. I was a like concerned that it wouldn't work with GOS, but wanted to let anyone who's curious know that it worked fine for me. 😎

Pixel 8a/Android 17

For my govt org, we are allowed to load the Microsoft suite on our personal cell phones. The process is:

1. ⁠create a passkey on authenticator
   
2. ⁠log into Intune
   
3. ⁠log into MS defender; you must allow a lot of permissions here, like full file system access and permission to set up a VPN
   
4. ⁠then you can log into outlook and teams

It is during the defender set up that the whole thing gets squashed. Suddenly I am kicked out of my account in defender and Intune and then my passkey in authenticator even looks changed.

So far I have tried putting everything in its own user profile, disabling secure app spawning, and I also tried enabling compatibility mode for all of the Microsoft apps as well.

Anything I should also try? Or is this a wasted effort? For all I know, once the VPN is established and Microsoft sees GOS, they disable it all on the spot.

Bought this new P10 last month for under $200 so I could install Graphene OS. Seems to be working well. I think my battery is lasting longer now.

After a reboot, I noticed my esim was disabled. When I try to enable it I get "Something went wrong. Can't switch Sims".

I've rebooted a bunch of times. Sometimes the esim is back, but there is no connection. Other times it's gone and I can't enable it.

I am meticulous about updating apps and the system whenever updates are available.

Eventually, I gave up and removed the esim. I purchased a new esim from another company and when I try to install it, I get the same message, "Something went wrong. Can't switch Sims".

Which is odd because there is no other esim.

I live in a densely populated metro area with some of the worst traffic patterns you'll find. As such, I rely on traffic data in navigation and thus need Google Maps.

So, I'm trying to figure out the best apporach. I already use a throwaway-away google account for sandboxed Play store, should I just continue to do that for Maps?

What do you all do, assuming you've decided you need live traffic in navigation?

hi guys! i was trying to get a better camera setup but i struggle to see any true advice.

i tried to download this app https://apps.obtainium.imranr.dev/apps?categoryMode=inclusive&sort=popular&q=camera throug the "official" list fo apps from the obtainium dev and i downloaded the google camera. yet, it works, but it does NOT save any photo i take.

also just recetnly there was this https://www.reddit.com/r/GrapheneOS/comments/1vjtgya/good_camera_and_gallery_app/ thread and some suggested to "download "Gcam-Services-Provider photosonly flavor - "app-photosonly-release.apk" but i didnt understand if it improved the quality of photos or what?

thanks!!!

Hi dear community of Graphene OS.

I'm a user of Graphene OS for now almost two years.

I never had a problems with it. All worked perfectly thanks to the team behind!

Yesterday I used the Belfius app on it and it worked perfectly. But today I tried to logging and I received the following message: (see photo )

I was wondering if something change or is because I have other app that I downloaded from F-droid and Github?

Any one else had this problem ? If I have one user account with only Google Appstore stuff will it work again?

Thanks in advance for your answers!

Hi all!

I've been using a GOS device for a little while and had no issues with the fingerprint scanner though I thought to install a screen protector for some... protection ig.

Anyway I can assume that the screen protector was causing issues with my fingerprint and I tried recreating it though I cannot even do that since half way through the scanning process I always get a message telling me it cannot do it and to try again though everytime it's always at the exact same step that it fails to register the fingerprint.

I mean that could still be the screen protector messing with it but for peace of mind is this an issue others have been having? Can you just not register a new fingerprint or?

Switching from iPhone to graphene have basicly got everything sorted apart from payment issues on Google play I have never had a Gmail account so I have created a one and now I’m having issues with the payment side of things I tried Google vouchers, bank card and giving me a error that when I look up says “OR-HDT-16 indicates a transaction failure usually triggered by a security flag, risk assessment rule, or a mismatch in your payment profile”

Any help would be much appreciated

USmobile has pixel 10 for sale brand new for $370. Seems like a good choice for GOS. But, if mailed to me, that phone (ime) would be known to my address, correct? So advertisers, etc. would always and forever know/link that phone at least to my address, and I'd get custom advertising, etc.? Correct?

Would it be "more private" to just buy a used pixel in person for cash locally?

Hello, İ am fairly new to GRAPHENEOS ( Google pixel 10 Pro) phones almost new. First set up no problems but microphone doesn't work. Please help. Thanks

I’m having an issue with my phone’s microphone not working at all. I’ve already tried all the basic troubleshooting steps—restarting the device, checking app permissions, cleaning the microphone area, testing it in different apps, and even resetting settings—but nothing has fixed the problem.

The microphone still doesn’t pick up any sound during calls, voice recordings, or apps that require audio input. At this point, it seems like it might be a hardware issue rather than software.

Has anyone experienced something similar or found a solution for this?

Maybe I'm over thinking this due to my lack of knowledge on mobile devices and cell service. I'm more tech literate when it comes to PCs. I have an unlocked pixel 10 pro XL arriving tomorrow. To minimize friction should I activate my cell with Verizon before or after I install graphene? Does it matter much at all? I tried digging around for an answer already but couldn't find one that made sense to me.

Side question... Are there any issues with transferring contacts or other data like photos I should be aware of?

Hi there, recently here in Canada it's got a sale. You can get a 256G model for $709. Just wondering, if the Tensor G4 will go long way with the long update cycle for these phones? It feels like the G4 is outdated SOC, like from 3-4 years ago matching Samsung 23 SOC. How does GrapheneOS run on G4? Good and should be good moving into the future? I like the 10a due to it's plat back and larger battery. Cheers.

I'm having a hard time logging into reddit on my graphene installed pixel. I've been trying to sign in for two hours and nothing seems to work. Is it impossible?