Hardware SKU Never Enable Enabled Disabled Exploit protection App exploit protection Scramble PIN input layout Sandboxed Google Play Sandboxed Google Play (work profile) Send notifications to current user Your lock screen notifications will be forwarded to the current user if you are active in the background. Only the user\'s name, the app\'s name, and the time received will be shown. Allow Sensors permission to apps by default Sensors is a non-standard permission, apps may malfunction if it’s denied. A permission prompt will be shown when an app tries to access sensors. Note that some apps may need to be manually restarted after allowing the Sensors permission. Allow camera access when locked Auto reboot Automatically reboot the device if it hasn\'t been unlocked within the selected duration of time. Save screenshot timestamp to EXIF Enables adding a timestamp to screenshot EXIF metadata Secure User Plane Location (SUPL) A-GNSS (assisted satellite geolocation) based on nearby cell towers. GrapheneOS proxy Standard server Off Will make acquiring location lock significantly slower, especially if PSDS is turned off too eSIM support A device restart is required to enable this setting. Warning "Turning off eSIM support will break the following functionality: • adding new eSIMs • turning existing eSIMs on or off • removing eSIMs, including from the lock screen (e.g. when eSIM is locked with a forgotten PIN) • wiping eSIMs during factory reset Device will be automatically restarted." Restart Proceed Attestation key provisioning GrapheneOS proxy Google server Off Special access to hardware accelerators for Google apps Access granted Access not granted Grant special access to hardware accelerators to Google apps "Some Google apps expect to be able to access hardware accelerators in a special, more capable way than regular apps do. Examples of such apps: • Pixel Camera • Google Photos • Google Recorder This setting applies to all users on the device." Predicted Satellite Data Service (PSDS) "If PSDS is turned on, static PSDS information files will be downloaded periodically to improve location resolution speed and accuracy. No query or data is sent to the server. These files contain orbits and statuses of satellites, Earth environmental data and time adjustment information." GrapheneOS server Standard server Off Will make acquiring location lock significantly slower, especially if SUPL is turned off too Contact Scopes Storage Scopes GrapheneOS server Standard (Google) server Off Internet connectivity checks "Connectivity check is a special empty server request that is made to find out whether the current network has internet connection. There are HTTP, HTTPS, DNS, DNS-over-TLS and DNS-over-HTTPS connectivity checks. Turn off Wi-Fi automatically If Wi-Fi is disconnected, it will be turned off after the selected timeout. Turn off Bluetooth automatically "If there are no connected devices, Bluetooth will turn off after the selected timeout." Secure app spawning Use secure app spawning A device restart is required to change this setting. Restart Launch apps in a more secure way than Android which takes slightly longer and increases memory usage by app processes. Widevine provisioning GrapheneOS proxy Google server The provisioned certificate will be used for accessing DRM protected content. App installs and updates Enabled Enabled for first party sources Disabled Enable app installs and updates Enable app installs and updates from first party sources only Disable app installs and updates Allow running in background Automatic exploit protection compatibility mode "Allow automatically disabling exploit protections for apps that are known to need it" "Warning: enabling this setting might cause some apps to stop working. Allow access to Android/obb folder Required for installation of some large apps (mostly games) that use OBB expansion files Charge other devices by placing them on the back of your phone Battery share Notify about system process crashes Such crashes may indicate exploitation attempts View logs USB-C port Off Turns off the USB-C port. Doesn’t impact the separate charging mode, which is activated by turning off the device and plugging it in to a charger. Charging-only Turns off all non-charging USB-C port functionality. Charging-only when locked Enables the charging-only mode when the device is locked and disables it when the device becomes unlocked. If the port is already plugged-in at the time when the device becomes locked, then the activation of charging-only mode will be delayed until the port is disconnected. Charging-only when locked, except before first unlock This mode has the same behavior as the “%1$s” mode, except for an additional exemption for before-first-unlock connections. On Does not add any restrictions. USB-C port and pogo pins USB-C port off, pogo pins used only for charging Turns off the USB-C port and turns off all non-charging pogo pins functionality. Doesn’t impact the separate charging mode, which is activated by turning off the device and plugging it in to a charger. Turns off all non-charging USB-C port and pogo pins functionality. Enables the charging-only mode when the device is locked and disables it when the device becomes unlocked. If the port is already plugged-in at the time when the device becomes locked, then the activation of charging-only mode will be delayed until the port is disconnected. The same behavior applies to pogo pins. Duress password "Duress password can be entered instead of the user password in any place that asks for it, such as the lock screen of any user and any user or work profile password prompt. Submitting the duress password will immediately make the storage contents permanently inaccessible, delete all eSIMs and then power off the device. GrapheneOS will remain installed. Duress PIN works the same way duress password does." Enter duress PIN Confirm duress PIN Enter duress password Confirm duress password Add duress PIN and password Add Added duress PIN and password Updated duress PIN and password Update Cancel Proceed Delete Update duress PIN and password Delete duress PIN and password Delete duress PIN and password? WARNING "Submitting the duress PIN/password instead of the user PIN/password will immediately make the storage contents permanently inaccessible and will delete all eSIMs." Duress PIN and password were not saved.\n\nDetails:\n%1$s Duress PIN and password were not deleted.\n\nDetails:\n%1$s Dismiss Alternative touchscreen mode This mode is less susceptible to ghost touches. Don’t enable it unless you are experiencing touchscreen issues. Confirm that the touchscreen is working. Without confirmation, alternative touchscreen mode will be disabled after several seconds. Confirm Play Integrity API The Play Integrity API allows services to verify properties of a device through their app. Most services check for the device or strong integrity level which requires having the unmodified stock OS on a device licensing Google Mobile Services. Not every app using it will ban using GrapheneOS. GrapheneOS passes the basic integrity level and the miscellaneous checks for licensing, Play Protect, etc. work fine. We recommend leaving feedback for apps using it to ban GrapheneOS asking them to stop banning using a much more secure OS. Apps can use the standard Android hardware attestation API to verify the hardware, OS and app with GrapheneOS. Contact app developer Show usage notifications Block usage attempts Play Integrity API usage attempts will fail with the “API is not available” error code Blocked Not blocked Show apps that used the Play Integrity API Network location "Network location is a method of determining your device’s location by using various nearby signals, such as Wi-Fi networks, Bluetooth devices, and cell towers. Your device scans for these signals and sends their identifiers to a server, which then provides positioning data that your device uses to estimate its location. Currently, Wi-Fi networks and cell towers are used. This method can be particularly useful when GNSS is unavailable or unreliable, such as indoors or in areas with poor satellite reception. Network location provides a quicker way to determine your location before a GNSS lock is acquired or when GNSS signals are weak." GrapheneOS Apple proxy Apple server Apple China server (required for China data) Off Cross-profile shared clipboard Follow defaults Allow system defaults sharing the clipboard from and to the parent user and its other child profiles. Follow import defaults Allow system defaults sharing the clipboard from the parent user and its other child profiles. Follow export defaults Allow system defaults sharing the clipboard to the parent user and its other child profiles. Disallowed Disallow sharing the clipboard from and to the parent user and its other child profiles. This setting provides an option for users to allow or disallow sharing clipboard to and from other profiles of the same parent user including itself. Once disallowed, future clipboard content updates between user profiles of the same parent user, such as between private space profile and parent user, or between private space profile and work profile, will not be accessible. Clipboard contents shared with other profiles prior to selecting a stricter option remain accessible until clipboard contents have been updated. End session immediately on lock Disallow delayed locking of storage when stopping or locking the current private profile. This allows locking to work like end session to full secondary users where strong authentication is required to unlock the storage. Geocoder "Forward and reverse geocoding are processes used to convert between geographic coordinates and human-readable addresses, respectively. Forward geocoding returns the coordinates for a given address, while reverse geocoding returns the address or addresses near a given set of coordinates. Apps can choose to use the geocoder selected here, which performs these lookups using a network-based service." GrapheneOS proxy Nominatim server Off Carrier settings overrides Override device carrier settings for this SIM. Choose your overrides first before enabling. These local overrides may reveal hidden IMS options for your SIM, but functionality depends on carrier support and provisioning. May cause unreliable service. Use at your own risk. Expand Collapse Error Unable to connect to subscription service (%1$s) Cannot enable overrides No overrides are active. All settings are at their defaults. Enable overrides Overrides active Unknown overrides Warning These carrier config overrides are not set from this screen. Disable overrides to make changes Apply carrier config override Clear all carrier config overrides Available Unavailable Unknown Forced available Forced unavailable No override (Default: %1$s) VoLTE / Vo4G availability Depends on carrier provisioning, availability, etc. VoNR / Vo5G availability Depends on carrier provisioning, availability, etc. 5G capabilities Override carrier 5G NR availability for the non-standalone (NSA) and the standalone (SA) modes of 5G NR Force NSA and SA NSA and SA Force NSA NSA Force SA SA Force disabled Disabled Wi-Fi calling availability Depends on carrier provisioning, availability etc. VoLTE / Vo4G should be set to available to use this. Includes Wi-Fi calling while roaming Available but state uneditable Available but roaming not editable Cross SIM calling / backup calling availability Only for dual SIM setups. If enabled, then when the SIM is roaming or out of service and Wi‑Fi isn\’t available, calls can be made over another SIM’s data connection. Wi-Fi calling should be set to available to use this.