Triggers for a stolen or seized phone: remote wipe by SMS code (rate-limited, confirmed on device), shake-to-shutdown, duress PIN.
NoPwn OS · Google Pixel 10a
The Pixel 10a with NoPwn OS preinstalled.
NoPwn OS is built from GrapheneOS source and configured so the phone's security does not depend on a cloud account. Verified boot with a re-locked bootloader, per-app sandboxing, and signed monthly updates served from our own update server. Every phone is supplied with a licence for the Protect suite, VaultVPN and the microphone scrambler.
€1,600 with a 6-month licence included · €2,300 with 12 months · shipped worldwide, tracked
Pixel 10a · NoPwn OS boot
No Google servicesinstalled by default · sandboxed Play is optional
Bootloader re-lockedverified boot on every start
Updates we servesigned · verified on the device
1 licence = 1 phoneProtect · VaultVPN · microphone scrambler
In plain words
What this phone does differently.
An honest comparison between a normal “secure” phone and what is on the Pixel 10a you buy here.
The usual model
Security features that live on someone else's servers.
On most phones the features that protect you when the phone is lost — remote locate, remote wipe, cloud backup — are tied to a vendor account and run through the vendor's infrastructure.
Your data is also protected with a key that vendor can often recover for you, because they hold the account.
What that means
Your protection has a dependency.
If that account is compromised, blocked, or requested by a third party, the same infrastructure that can wipe your phone can be turned against you.
Staying safe means trusting a company's operations, not just the cryptography in the device.
The NoPwn model
Protection that runs on the phone.
The licence is verified on the device by HMAC — no activation server has to stay reachable. The VPN key pair is generated for your device. The wipe trigger is a message you send from your own number, confirmed on the phone.
The dashboard keeps your account number, balance and orders. It never receives data from the phone itself.
What you keep
The parts that need a big vendor.
Android security patches come from Google's Pixel programme — the Pixel 10a is supported for seven years — and reach you through our own signed update channel, so no carrier sits in the path.
The Titan M2 security chip, verified boot and the re-locked bootloader stay exactly as Google built them.
What's on the phone
The apps the licence covers.
One licence per phone, covering all three. They are not sold separately, and none of them asks you to sign in to a NoPwn account.
Protect
VaultVPN
WireGuard profile provisioned to your account. Relays in 36 countries, including multi-hop routes where entry and exit sit in different jurisdictions.
Microphone scrambler
Applied in the system audio path, so it covers the calls you make rather than one app's microphone permission.
Updater
Monthly OTAs from our own update server. The package is signature-verified on the device before it installs.
No telemetry
No analytics, no crash reporting, no Google services by default. Sandboxed Google Play can be installed if you decide you want it.
Activator
Activates the licence on the device and installs the current app bundle that comes with it.
8:03 ◉
Protect
NoPwn security suite
5
defenses armed
Protected
160 days remaining
All duress/wipe features below require an active license to function.
View Activation Key
Triggers 5 of 5 features active
Remote Wipe
Wipe the device remotely via SMS secret code
SMS Wipe CodeNo wipe code set
Enter secret codeApply
Duress Wipe
Second PIN that wipes instead of unlocking
Entering your Duress PIN or password anywhere the device asks for your normal PIN/password (lock screen, any profile) immediately, permanently destroys the storage encryption keys, deletes all eSIMs, and powers off the device. Configuration is handled by the same secure system component that enforces the device lock screen.
Change Duress credentials
Shake Shutdown
Shake phone violently up and down to trigger emergency shutdown
Sensitivity15 m/s² · fixed
Requires lockscreenyes — no accidental pockets
Inactivity Wipe
Wipes if not unlocked for the set time. Timer resets on successful unlock. Does not count down while phone is in use.
⚠ Going on holiday or won't use your phone for a while? Turn this off or
increase the timeout to avoid an accidental wipe.
Select timeout7 days (default) ▾
Airplane Mode Tile Wipe
While the phone is locked, tapping the Airplane Mode tile in Quick Settings wipes the device instead of toggling airplane mode. While unlocked, the tile works normally.
⚠ This is a non-recoverable full factory reset. Any locked-screen tap of the
Airplane Mode tile will wipe all data on this device with no confirmation prompt and no way to
undo it. Only enable this if you understand and accept that risk.
Protection
VPN Connection
Secure — VPN Active
Your connection is encrypted and routed through Multihop Albania→Estonia.
About
Configure NoPwn security features.
8:03 ◉
Microphone
NoPwn voice privacy
Ghost
voice disguise
Active
160 days remaining
All voice presets are available while your license is active.
Enable voice disguise
Subtle shift down with a darker timbre. Calm, unremarkable, not you.
Voice profiles 5 of 5 voices available
OriginalNo processing. Your real voice passes through unmodified.
OFF
Deep VoiceNoticeably lower pitch with warmth. Overt but natural.
OFF
DemonVery low, saturated growl. Unmistakably processed.
OFF
AliasSubtle shift up with softened sibilance. Sounds like a different, normal person.
OFF
GhostSubtle shift down with a darker timbre. Calm, unremarkable, not you.
ON
About
Mic Profile applies a system-wide voice effect to all apps that use the microphone. The processing happens in the OS audio server, before any app ever sees the audio — no app can bypass or detect it by re-recording.
8:03 ◉
VaultVPN
NoPwn private network
Secure connection
Exit IP: 213.232.112.95 · 🇪🇪 Estonia
Connected▾
Estonia
via Albania
Multihop Albania→Estonia · 103.124.165.2:3503
Switch location
Disconnect
Account
160days
160 days remaining
expires Mar 1, 2027
Kill switch
Off — traffic can leak if the tunnel drops
Mullvad-owned relays · WireGuard multihop
NoPwn OS · as it looks on the phone
Tap an app to see it on the phone — each screen scrolls, so you can read everything.
Security baseline
What the phone enforces.
These are properties of the hardware and the operating system — not of an app you have to trust.
Verified boot
Every start checks the system against signed images. The bootloader is re-locked after flashing, so this cannot be switched off quietly.
Per-app sandboxing
Apps run confined, with permission controls that can be revoked or limited per app — including sensors and network access.
Hardened memory allocator
GrapheneOS's hardened_malloc: guard pages, memory zeroing and allocation hardening against common exploit primitives.
Signed monthly updates
Delivered from our own update server and verified on the device before install — no carrier in the path.
Titan M2 security chip
Google's dedicated security chip holds the boot chain and the lockscreen secrets, and is the root the rest of the system is measured against.
Seven years of patches
Google supports the Pixel 10a with OS and security updates for seven years from launch — the upstream half of the update story.
Licence
One licence per phone.
Four phones means four licences — €750 each for six months, or €1,400 each for twelve. A licence covers Protect, VaultVPN and the microphone scrambler on one device. There is no way to buy those features separately, and nothing renews itself — you buy another licence when you decide to.
NoPwn licence · one phone
6 months
€750180 days · includes
Protect, VaultVPN and the microphone scrambler
- Extends from the current expiry if the phone is already licensed
- Activation key appears on your order page the moment you buy
- One key per phone — four devices need four licences
Best value
NoPwn licence · one phone
12 months
€1,400365 days · includes
Protect, VaultVPN and the microphone scrambler
- Extends from the current expiry if the phone is already licensed
- Activation key appears on your order page the moment you buy
- One key per phone — four devices need four licences
The device
Pixel 10a, supplied with a licence.
Google's hardware, our operating system, and a licence for the protection features. Six months included as standard, or choose twelve months for €700 more.
Standard
Pixel 10a · 128 GB · SIM-free
Pixel 10a · 6-month licence included
€1,600includes a
180-day licence — Protect, VaultVPN and the
microphone scrambler for one device
- NoPwn OS preinstalled, bootloader re-locked, verified boot
- 6.3″ Actua pOLED, Tensor G4, 8 GB RAM, 5,100 mAh
- Any nano-SIM or eSIM works — carrier-unlocked
- USB-C cable, SIM tool, and a recovery card with your account number
+700 € for 12 months
Pixel 10a · 128 GB · SIM-free
Pixel 10a · 12-month licence included
€2,300includes a
365-day licence — Protect, VaultVPN and the
microphone scrambler for one device
- NoPwn OS preinstalled, bootloader re-locked, verified boot
- 6.3″ Actua pOLED, Tensor G4, 8 GB RAM, 5,100 mAh
- Any nano-SIM or eSIM works — carrier-unlocked
- USB-C cable, SIM tool, and a recovery card with your account number
Connectivity · optional
Keep your own SIM, or buy an eSIM here.
The phone is SIM-free and unlocked. Use your current carrier's SIM or eSIM and nothing else changes — the licence and the VPN work the same either way. NoPwn data-only eSIMs start at €6.55 a month, for a data plan you can activate without handing a carrier your name.
Account
A number, not a profile.
Your account is a 16-digit number generated in your browser: no email, no name, no phone number. It is the only credential, so write it down when you create it — there is no reset link. With it you can browse the whole site and see exactly what you own.
What the dashboard knows
Your number, your balance, your orders.
Nothing about the phone itself: no location history, no usage data, no device telemetry. A phone order carries the shipping address, attached to that order and nothing else.
When you are logged in the site stays fully readable — the shop, the security pages, the help pages — and your own pages show licence status, your VPN profile, your eSIM and your orders.
Keep the number safe
Save it as a file.
Both the create-account page and your account page offer a recovery card — your number in plain text with the licence rules on it — that you can save as a file and keep in your password manager. Support cannot look the number up for you.
FAQ
Questions that come up before an order.
What exactly does the licence cover?
One phone's Protect suite (wipe triggers, shake-to-shutdown, duress PIN), VaultVPN and the microphone scrambler. One licence per device — four phones means four licences — and the three features cannot be bought separately.
What happens when a licence expires?
The licensed features stop working until you renew; the phone itself keeps working normally. Buying another licence extends from the current expiry date rather than restarting the clock, so renewing early costs you nothing.
Do I have to buy an eSIM from you?
No. The phone is SIM-free and carrier-unlocked — any nano-SIM or eSIM works, and the licensed features do not depend on the data plan. Our eSIMs are data-only and entirely optional.
How do I pay?
In cryptocurrency — BTC, LTC, BCH or XMR — into your account balance. Each invoice reserves one receive address and credits after 3 confirmations; the balance then pays for the order. An invoice is capped at €2,407.90.
Which updates does the phone get?
Two streams: Android security patches from Google's Pixel programme (the Pixel 10a is supported for seven years), and NoPwn OS updates from our own update server, signature-verified on the device before install.
Do I need a Google account to use it?
No. The system ships without Google services and without telemetry. If you want specific Play apps later, sandboxed Google Play can be installed as an ordinary app.
What if I lose my account number?
Nothing can recover it — there is no email on the account by design. It is printed on the recovery card in the box, shown in the device's About screen, and you can save it as a file when you create the account.
Where do you ship, and what about returns?
Worldwide, tracked, shipping included, dispatched within about 5 business days. 14 days' right of withdrawal on the device and 24 months' conformity — the process is on the Returns page.
Pixel 10a with NoPwn OS.
€1,600 with a 6-month licence included, or €2,300 with 12 months. Shipped worldwide from the same account number you use for everything else.