GrapheneOS vs CalyxOS vs Stock Android Privacy

The phone is the largest hole in most privacy setups. People who run Tor on a laptop, encrypt their mail, and think carefully about metadata still carry a device that knows their location continuously, holds every account they own, and runs an operating system built by an advertising company. The desktop question has a well-worn answer — Tails, Whonix, and Qubes each map to a different adversary — but the phone question is different in kind, because a phone has a cellular radio you cannot audit and a subscriber identity you cannot rotate.

This is a comparison of the three realistic options, drawn from each project’s own documentation: GrapheneOS, CalyxOS, and stock Android on a Pixel. It also covers the part most comparisons skip, which is what none of them fix.

The Short Version

	GrapheneOS	CalyxOS	Stock Pixel Android
Primary aim	Hardening against exploitation, plus privacy	Reducing Google dependence, usable defaults	Vendor security, vendor data collection
Google services	Optional, fully sandboxed Play	microG (reimplementation)	Integrated and privileged
Notable controls	Network and sensors permissions, storage scopes	Datura per-app firewall, Seedvault backups	Standard Android permissions
Memory hardening	Hardened allocator, memory tagging	Stock Android baseline	Stock Android baseline
MAC randomisation	Per-connection, on by default	Standard Android randomisation	Standard Android randomisation
Devices	Pixel 6 generation and newer	Pixels plus Fairphone, moto g, SHIFTphone	Pixel only
Verified boot after install	Yes, bootloader relocked	Yes, bootloader relocked	Yes, factory state
Best for	A capable, targeted adversary	Getting off Google without friction	Everyone else, honestly

GrapheneOS: Hardening First

GrapheneOS is best understood as a security project that produces privacy benefits, rather than a de-Googling project. Its documented features are mostly about making exploitation harder:

• A hardened memory allocator. The project describes hardened_malloc as providing “substantial defenses against the most common classes of vulnerabilities (heap memory corruption)” through out-of-line metadata, zero-on-free, delayed reuse, and hardware memory tagging for slab allocations. Memory-corruption bugs are the mechanism behind most real-world phone exploitation, so this is the load-bearing part.
• Sandboxed Google Play. Official Play releases can be installed and used “in the standard app sandbox”, where Play receives “absolutely no special access or privileges”, and apps in the same profile must explicitly choose to use it. This is the single most practical difference from other de-Googled systems: apps that genuinely require Play mostly work, and Play holds no privileged position while they do.
• Network and sensors permissions. GrapheneOS adds toggles Android does not have. The network permission blocks both direct and indirect network access; the sensors toggle disallows access to sensors beyond camera and microphone, which are already permission-gated.
• Storage scopes and contact scopes. Instead of granting an app broad storage or contact access, you grant it a defined slice while the app believes it has what it asked for.
• Per-connection MAC randomisation, enabled by default, which the project notes is stronger than a persistent random MAC per network.
• Seamless automatic updates that install in the background without disrupting use, with automatic rollback if the new build fails to boot.

The device restriction is the tradeoff people argue about, and the reasoning is documented rather than arbitrary. GrapheneOS supports Pixels from the 6th generation onward because its stated hardware requirements are specific: verified boot with rollback protection for both OS and firmware, hardware memory tagging (ARM MTE or equivalent), isolated cellular, Wi-Fi, Bluetooth and NFC radios, A/B updates with automatic rollback, a StrongBox keystore with hardware key attestation, and at least five to seven years of security updates from launch. The FAQ is blunt that “broad device support is counter to the aims of the project,” because supporting many devices would mean “mainly supporting very badly secured devices unable to support our features.” When a manufacturer stops shipping firmware updates, support ends.

If your adversary is capable and specifically interested in you — the profile discussed in threat modelling for journalists and activists — this is the option whose design goals match that threat.

CalyxOS: Getting Off Google With Less Friction

CalyxOS aims at a different problem: reducing dependence on Google without demanding that you rebuild how you use a phone. Its documented approach is “private by design”, and the pieces are practical rather than adversarial:

• microG, described as “a Google Play Services alternative to use core services, such as notifications, while maintaining much more anonymity and privacy.” It is a reimplementation, not the real thing, which is the essential distinction from GrapheneOS’s sandboxed Play — broader freedom from Google, narrower app compatibility.
• The Datura firewall, giving “fine-grained control over network access for all of your apps.”
• Seedvault encrypted backups, so leaving Google’s backup service does not mean having no backups.
• F-Droid and Aurora Store preinstalled for free-software and Play-catalogue apps respectively, plus Tor Browser and Signal integration in the dialer.
• Automatic monthly over-the-air security updates.
• Verified boot including bootloader relocking, which the project states keeps the Android security model intact. CalyxOS is explicit that it is meant to run with the bootloader relocked so the OS “cannot be tampered without your knowledge,” and that this requirement is why it only targets devices whose manufacturers permit relocking with a custom OS.

Device support is wider than GrapheneOS: current builds cover Pixel 6, 7, 8, and 9 series alongside Fairphone 5, several Motorola moto g models, and SHIFTphone 8, with extended support for some older hardware. That breadth is the appeal, and it is also the cost — the hardware guarantees vary across that list in a way they do not on a single supported Pixel line.

Stock Pixel Android: The Honest Baseline

Stock Android on a Pixel is not a joke option, and privacy writing that treats it as one is misleading. It has verified boot, a dedicated security chip, prompt monthly patches from the manufacturer that builds the hardware, and the largest install base to hide in. Against phishing, malware, theft, and an opportunistic attacker, it is a strong device.

Its weakness is precise and is not a bug: the vendor is the data collector. Account, location, app-usage, and advertising signals flow to a company whose business is advertising. No permission toggle changes that relationship, because the relationship is the product.

So the choice is not “secure versus insecure”. It is which adversary you are optimising against. Stock Android defends well against everyone except Google. GrapheneOS defends against a targeted attacker and against Google, at the price of device choice. CalyxOS defends against Google’s data collection on more hardware, at the price of the deepest hardening.

What None of Them Fix

This is the section that matters most, and it is missing from most comparisons.

• The cellular network. Your SIM ties a subscriber identity to a person and a payment method, and the carrier records which towers your phone talks to. That happens below the operating system. No custom ROM changes it.
• The baseband. The cellular modem runs its own proprietary firmware. Isolating it from the main system, as these projects do, limits the damage it can do — it does not let you audit it.
• Hardware identifiers. IMEI is burned into the device. Rotating a MAC address per connection helps against Wi-Fi tracking; it does nothing about the identity your carrier already holds.
• Your accounts. An anonymised phone signed into a real-name account is a real-name device. This is the failure repeatedly documented in OPSEC mistakes that deanonymise people: the tooling was fine and a human link defeated it.
• What you install. A hardened OS running an app that uploads your contacts still uploads your contacts.
• Your browser. Mobile browsers leak the same signals covered in how to prevent browser fingerprinting, and a custom ROM does not change what a page can measure.

The practical implication is that a hardened phone OS is a platform for good decisions, not a substitute for them. It removes the vendor from the middle of your device and it raises the cost of exploiting you. The identifiers that connect the device to a person mostly live elsewhere.

Choosing Between Them

Three profiles, matched to what each project actually optimises for:

A capable adversary who may target you specifically. GrapheneOS on a supported Pixel, bootloader relocked, sandboxed Play only in a secondary profile if you need it at all. The memory hardening and the extra permission toggles are the reason, and the narrow device list is the price you pay for the guarantees.

You want out of Google’s data collection and you want the phone to keep working. CalyxOS, on hardware from its supported list. Expect occasional friction from microG on apps with deep Play dependencies, and accept that hardening beyond stock Android is not its main goal.

Privacy matters but the realistic adversaries are advertisers, apps, and thieves. Stay on stock Android, disable ad personalisation, audit permissions honestly, and put the effort into the layers that will actually move the needle for you — the four tools in the minimal privacy stack will do more for this profile than a ROM flash will.

If you are not sure which profile is yours, that is the question to settle first. Start with what a threat model is, then run the interactive threat-model builder to turn your actual adversaries, assets, and constraints into a prioritised plan without any of it leaving your browser.

Bottom Line

GrapheneOS is the hardening choice, CalyxOS is the de-Googling choice, and stock Pixel Android is a defensible default for anyone whose adversary is not the vendor. All three relock the bootloader and keep verified boot intact, so none of them ask you to trade device integrity for privacy. What none of them do is dissolve the link between a SIM, a carrier, and a person — so pair the OS decision with a communications decision, using the metadata comparison in Signal, SimpleX, Session, and Matrix rather than assuming the phone alone settles it.