GrapheneOS + Cape: The Complete Mobile Privacy Setup

If you’re running GrapheneOS, you already know more about mobile privacy than most people. You’ve hardened your device, sandboxed Google Play Services, locked down app permissions, and killed off most of the telemetry that stock Android phones send home. That puts you ahead of 99% of smartphone users.

But there’s a whole layer of tracking that GrapheneOS can’t touch. And it happens before your phone even boots up.

What GrapheneOS actually protects

GrapheneOS is the gold standard for mobile operating system security. It runs on Pixel phones and takes Android’s security model further than Google does. You get verified boot, hardened memory allocation, reduced attack surface, and fine-grained permission controls. Apps can’t secretly access your microphone, camera, or location without you knowing about it.

It also strips out the constant data reporting that stock Android does. No location history going to Google. No usage analytics. No advertising ID following you around the web. If your threat model is “I don’t want my phone spying on me,” GrapheneOS handles that side of things really well.

What it cannot do is change how your carrier sees you. GrapheneOS runs on top of the cellular network. It doesn’t control the network itself.

The gap GrapheneOS can’t close

Every time your phone connects to a cell tower, your carrier logs it. That’s not something any phone OS can prevent because it’s how cellular networks work. Your phone has to identify itself to the tower to get service. That identification creates a record of where you are, when you were there, and how long you stayed.

Your carrier also logs every call and text you make. Not the content of encrypted messages sent through Signal, but the fact that you made a call to a specific number at a specific time for a specific duration. That metadata alone reveals a lot about your life and relationships.

Then there’s the SS7 problem. SS7 is the protocol that carriers use to route calls between networks, and it has security holes that have been public knowledge for over a decade. Anyone with access to the SS7 network can track your location in real time, intercept your calls, and read your SMS messages. Your phone’s operating system has zero ability to defend against this because the attack happens at the network level, between towers, not on your device.

How Cape fills that gap

Cape is a privacy-focused carrier that operates its own core network layer. That’s what allows them to implement protections that no other US carrier offers and that no phone OS can replicate.

IMSI rotation changes your network identifier every 24 hours. On a normal carrier, your IMSI stays the same forever, which means anyone with tower data can follow your movements across days, weeks, and months. Cape breaks that chain automatically, and you can trigger a manual rotation any time you want.

Network Lock is Cape’s defense against SS7 attacks. It detects and blocks suspicious signaling requests at the network level, which is exactly where those attacks happen.

SIM swap protection stops someone from convincing your carrier to port your number to their SIM. This attack vector has burned a lot of people, especially anyone holding crypto or using SMS-based two-factor authentication.

Cape also deletes call logs after one day, doesn’t build advertising profiles, and supports private payment so you don’t need a name or credit card on your account.

Two layers, one stack

Think of it this way. GrapheneOS protects everything that happens on your device. Cape protects everything that happens between your device and the network. Together they cover the full path your data takes.

With just GrapheneOS, your phone is locked down but your carrier still knows where you are, who you call, and can be exploited through SS7. With just Cape, your network connection is private but your device might still be leaking data through apps and OS-level telemetry. You need both layers to actually close the loop.

Cape sells GrapheneOS phones directly

Cape actually partners with the GrapheneOS project. If you buy a Pixel through Cape’s store, you can have GrapheneOS pre-installed for an extra $50. That means you can get a hardened phone and a private carrier in one purchase without needing to flash anything yourself.

For people who want the full setup but don’t want to deal with the technical process of installing GrapheneOS manually, this is a straightforward option. You get a phone that’s ready to go out of the box with both layers of privacy already in place.

The realistic cost

Cape is $70 a month, which is their early adopter rate locked in permanently for anyone joining before the end of 2026. GrapheneOS itself is free. The only hardware cost is a Pixel phone, which you might already own.

If you’re the type of person running GrapheneOS, you probably already pay for a VPN, maybe Proton Mail, maybe a password manager. Adding Cape to that stack is the equivalent of patching the last major hole in your setup. Your carrier has been the one service in your life that you couldn’t really make private until now.

Get $20/month off Cape

If you want to try Cape, grab a free referral code at cape.rip before you sign up. It takes $20 off your monthly bill permanently, and the person who shared the code saves $20 too. No signup, no tracking. Just pick a code and use it at cape.co. With the referral program stacking up to 5 times at $20 each, you only need 4 referrals to get your plan for free.