Ghostline
Build yours

Privacy phones, ready out of the box

A Pixel that keeps your secrets.

Every Ghostline phone ships with GrapheneOS installed, a chatr SIM with 3 months of top-up included, 3 months of Mullvad VPN, Signal and Threema set up, and the F-Droid open-source app store instead of Google Play. Want it to go further? We can physically remove the camera or microphone before it ships.

Build your phone See what's included

Pixel 8, 9 or 10 · from $849 CAD · all taxes & shipping included

GrapheneOSKill switchF-Droidchatr SIM + 3 mo top-upMullvad VPN · 3 moSignalThreema (paid)

Choose your Pixel

Three models, same privacy setup

In the box

Everything set up before it reaches you

Open the box, turn it on, and you're private from the first minute. No flashing, no app hunting, no signing up for a plan.

Hardware

Google Pixel 8, 9 or 10

Grade A refurbished: like-new condition with no scratches, unlocked, tested and completely erased. GrapheneOS is installed fresh and the bootloader re-locked.

Operating system

GrapheneOS

A hardened, Google-free version of Android with automatic security updates.

Service · 3 months

chatr SIM + top-up

A new chatr SIM, unopened in its original sealed packaging, plus a top-up gift card covering 3 months. You activate it in a few minutes and pick your own number.

VPN · 3 months

Mullvad VPN

No email or personal info needed. Installed and set to always on.

Messaging

Signal + Threema

Two end-to-end encrypted messengers, installed and ready to register. Threema licence included, no phone number needed.

App store

F-Droid

An open-source app store with no Google account, tracking or ads. Mullvad and Threema come from F-Droid, and Signal from signal.org.

Protection

Phone case

A slim protective case in black or grey, fitted before shipping.

Protection

Privacy screen protector

The screen goes dark from the side, so only you can read it. Try tilting the phone on the home page.

Kill switch · duress PIN

One PIN wipes everything

If your phone is lost or stolen, or someone forces you to unlock it, enter the kill switch PIN instead of your real one. The phone instantly and permanently erases all its data, including any eSIMs, and shuts down.

Every Ghostline phone ships with the kill switch PIN set to 1234. Never type 1234 on your phone unless you want to erase everything. We strongly recommend changing it to your own secret PIN on day one: Settings → Security & privacy → Device unlock → Duress Password.

A wipe can't be undone, and we can't recover anything. If your phone is wiped by accident, we won't set it up again for you. Keep the cards from your box so you can reinstall your apps and log back in yourself.

Compare models

Pixel 8, 9 or 10?

All three ship with the same GrapheneOS setup. The differences are battery, cameras, size, and how many years of security updates each one has left.

Phone ratings out of 10. The same scores are in the table below.

Ghostline's ratings out of 10, based on the specs below and published reviews. Tap or hover a point to see its score.

Full specs

● marks the best of the three. GrapheneOS can only update a phone while Google still releases firmware for it, so each model's end date is different.

Build yours

Choose your phone and what stays inside

Software can be hacked. A part that isn't there can't be. Watch the phone change as you pick what we remove.

Model

All three run GrapheneOS and come with the same apps, service and VPN.

Camera

Removing a camera means no photos, video calls or QR code scanning from that side. Any removal means opening the phone, so it will no longer be water resistant, and custom builds can't be returned (defects are still covered).

Microphone

Without built-in mics, calls and voice notes need a wired USB-C headset with a mic. That includes 911 calls, so keep the headset with the phone.

Case colour

Both are slim with a matte finish.

Verify your phone

Don't take our word for it

GrapheneOS lets you check for yourself that your phone runs genuine, untampered GrapheneOS. It takes a few minutes, and you don't need to trust Ghostline to do it.

Method 1 · works on every Ghostline phone

Check the boot key

No second phone needed. Works even if the cameras were removed.

  1. Restart your phone.
  2. A yellow screen appears saying the phone is loading a different operating system. This is normal for GrapheneOS. It shows an ID: a long string of letters and numbers.
  3. Compare that ID with the official value for your model below. Every character must match.
  4. The screen only stays up for a few seconds. Restart again as often as you need, or photograph it with another device.
Pixel 8cd7479653aa88208f9f03034810ef9b7b0af8a9d41e2000e458ac403a2acb233
Pixel 99e6a8f3e0d761a780179f93acd5721ba1ab7c8c537c7761073c0a754b0e932de
Pixel 103f7415ea26f5df5b14ea6d153256071a7a1af9ce7b0970b7311cc463c7ea02c7

Always double-check against GrapheneOS's own page at grapheneos.org/install/web under "Verifying installation". If someone ever tampered with this website, the official page is the one to trust.

Method 2 · strongest check

Hardware attestation with Auditor

Needs a second Android phone (Android 13 or newer) with a camera, and a working camera on your Ghostline phone. If your cameras were removed, use Method 1.

  1. On the second phone, install Auditor by GrapheneOS from the Play Store or the GrapheneOS app store. Your Ghostline phone already has it.
  2. Open Auditor on both phones. Choose Auditor on the second phone and Auditee on your Ghostline phone.
  3. Your Ghostline phone scans the QR code on the second phone. Then tap the second phone's QR code to continue, and let it scan the code your Ghostline phone shows.
  4. The second phone shows the result. It checks the phone's security chip, so a fake operating system can't pretend to be GrapheneOS.
  5. Run it again any time. After the first pairing, Auditor also flags changes since the last check.

Optional: GrapheneOS's attestation.app can check your phone on a schedule and email you if a check fails. Tap "Enable remote verification" in Auditor and scan the QR code from your attestation.app account.

Our story

Why I started Ghostline

Canadians shouldn't have to give up their privacy to own a phone.

I'm not doing anything illegal, and most people who care about privacy aren't either. That's the point. Privacy isn't about having something to hide. It's about deciding for yourself who gets to see your messages, your photos, where you've been and who you talk to.

Over the last few years I've watched the rules around our phones keep shifting. Bills in Ottawa have proposed new ways for authorities to get information about Canadians with less court oversight. The latest would require some providers to keep records about their users for up to a year. Each change is explained as a small, reasonable step. Put together, they move the line a long way.

Meanwhile, most phones are built to collect as much as they can. Ad companies, data brokers and apps build profiles of us every day, and those databases get breached.

So I started building the phone I wanted for myself: a Pixel running GrapheneOS, set up properly, with private messaging and a VPN ready from the first minute. For people who want to go further, I can physically remove the camera or microphone. Software can be changed. A part that isn't there can't be switched on.

Ghostline is a small, online-only business. I build and check every phone myself before it ships.

What I promise you

  • I delete your name, contact details and address once your order is delivered and the 30-day return window ends.
  • I never record your phone's serial number or IMEI.
  • This site has no ads, analytics or tracking.
  • You can pay with cash by mail, with nothing but an order number.
  • I'll be honest about what I can't protect: e-Transfers show your name to the banks, and Bitcoin payments are public on the blockchain.

The founder, Ghostline

Reviews

From verified buyers

Every review here comes from a real Ghostline order, checked against our sales records before it's published.

Write a review

Rating
How reviews work

Verified orders only. Your order number is checked against our records. It is never shown publicly.

Approved by hand. Every review is read before it goes up, which stops spam and fake reviews.

Honest, good or bad. We publish critical reviews too. We only reject reviews that aren't from a real order, are abusive, or include someone's personal information.

One review per order. Only your alias, phone model, rating and review are shown.

Returns & warranty

Clear terms, before you buy

Unopened phones can be returned within 14 days. Every phone has a 30-day warranty against defects, custom builds included.

Returns

14 days, seal intact

  • Return an unopened phone within 14 days of delivery for a refund, as long as the numbered tamper seal on your package is unbroken.
  • Opened phones can't be returned for a change of mind. Problems are covered by the warranty instead.
  • Custom builds (cameras or microphones removed) are made to order and can't be returned, but defects are covered by the warranty.
  • Refunds go back by your original payment method. We don't mail cash, so cash orders are refunded by e-Transfer or Bitcoin, your choice. Bitcoin refunds are for the dollar amount you paid. Cash mailed to us is sent at your own risk until it arrives.
  • You pay return shipping on change-of-mind returns.
Warranty

30 days on every phone

  • Covers hardware defects and our workmanship for 30 days from delivery, including camera and microphone removals.
  • We repair or replace the phone. If we can't do either, we refund you.
  • For defects, we pay shipping both ways.

Not covered

  • Water or liquid damage. Custom builds have been opened, so they are not water resistant.
  • Phones opened or repaired by anyone other than Ghostline.
  • Drops, cracks and other accidental damage.
  • Phones wiped with the kill switch. We won't set them up again.
Damaged in shipping

Report within 48 hours

If your phone arrives damaged, email us within 48 hours of the time tracking shows it was delivered. Include your order number and photos of the box and the phone. We'll replace or repair it at no cost.

Sending a phone back

Your data stays yours

  1. Email with your order number and the problem. Wait for our reply before sending anything.
  2. Factory reset your phone before you ship it (Settings → System → Reset options → Erase all data).
  3. Ship it to the address in our reply.
  4. When it arrives, we erase it and install a fresh copy of GrapheneOS straight away, without looking at anything on it.

This policy doesn't limit any rights you have under British Columbia law.

Privacy policy

What we collect, and what we don't

Last updated October 13, 2026. Ghostline collects only what it needs to build and ship your phone, and deletes your personal details once the order is complete.

Who we are

Ghostline is a small online business in British Columbia, Canada. For any privacy question, or to ask what we hold about you, email .

What we collect

  • Orders: the name or alias, contact details and shipping address you enter, your phone build, shipping choice, referral code, payment method and total.
  • Reviews: your order number, optional alias, phone model, rating and review text.
  • Messages you send us by email, Signal or Threema.

What we don't collect

  • No analytics, advertising trackers or tracking cookies on this site.
  • We never record your phone's serial number or IMEI.
  • We don't ask for your real name. An alias is fine if your parcel can still be delivered.

How orders are protected

Your order is encrypted on your own device, before it leaves this page, using our OpenPGP public keys. It's delivered to us through Formspree, a form-delivery service, which only receives the order number and encrypted text. Only Ghostline can decrypt it.

How long we keep it

  • Your name, contact details, address and order messages: deleted once your order is delivered and the 30-day warranty period ends, unless an open warranty claim needs them.
  • A sales record (order number, date, items, price, tax, province, payment method and payment reference) is kept for 6 years because Canadian tax law requires it. It doesn't include your name or address.
  • Phones sent back to us are erased and reinstalled with GrapheneOS on arrival, without anyone looking at their contents.

Who else sees information

  • Canada Post sees the name and address on your parcel, as needed to deliver it.
  • Banks: with Interac e-Transfer, your bank and ours see the sender's name. That payment isn't anonymous.
  • Bitcoin payments are permanently public on the Bitcoin blockchain.
  • Cash by mail is the only fully anonymous option.
  • Service providers that handle web traffic: our host, Cloudflare, processes visits to this site, including your IP address, to deliver pages and block attacks. The encryption and QR code tools load from jsDelivr and cdnjs. If you pay with Bitcoin, your browser asks CoinGecko or Kraken for the current price. These services see your IP address the way any website you visit does. We don't receive any of this data.

We don't sell, rent or share your information with anyone else. If we receive a valid court order, we can only provide what we still hold, which after delivery is the anonymous sales record.

Your rights

Under Canadian privacy law (PIPEDA), you can ask what personal information we hold about you, ask us to correct it, or ask us to delete it early where the law allows. Email us with your order number.

Terms of sale

The terms of every order

Last updated October 13, 2026. By placing an order you agree to these terms and to our Returns & warranty policy.

The seller

Ghostline, an online business based in British Columbia, Canada. Contact: . We sell online only and have no physical store.

The phones

  • Phones are Grade A refurbished Google Pixel devices with GrapheneOS installed. Google and Pixel are trademarks of Google LLC. Ghostline is not affiliated with Google or GrapheneOS.
  • Bundled services (chatr, Mullvad VPN, Threema and Signal) are provided by those companies under their own terms. We're not responsible for changes to their services, including a service becoming unavailable in Canada.

Prices and payment

  • Prices are in Canadian dollars and include all taxes and Expedited shipping. Priority shipping is a $50 add-on.
  • Your order is accepted once payment is received. e-Transfer and Bitcoin payments must arrive within 48 hours, and cash by mail within 10 days, or the order is cancelled.
  • Bitcoin amounts are locked for 15 minutes from when they're shown. A payment sent after that is matched to the dollar price at the time it arrives.

Order limits

  • Each order is for one phone. Each customer can buy up to 3 phones in any 30-day period. For more, email us first.
  • We can refuse or cancel any order before it ships. If we do, we refund anything you've paid in full.

Delivery

Delivery times are estimates, not guarantees. Each phone takes 1–3 business days to build, then Canada Post's delivery times apply. The phone is your responsibility once tracking shows it was delivered. Report shipping damage within 48 hours, as set out in our Returns & warranty policy.

Custom builds and emergency calls

  • Camera and microphone removals are permanent and can't be reversed.
  • A phone with its microphones removed cannot make voice calls, including 911 calls, unless a headset with a microphone is plugged in. Keep the included headset with the phone, or keep another way to call for help.
  • Any phone we open is no longer water resistant.

Kill switch and delivery PIN

  • Phones ship with GrapheneOS's duress PIN (the "kill switch") set to 1234. Entering it permanently erases the phone. You're responsible for changing it and for any wipe it causes. We can't recover data, and we don't set wiped phones up again.
  • Phones ship locked with a temporary PIN. We send it only after tracking shows delivery and you confirm your order number and tamper seal number.

Acceptable use

Ghostline phones are sold for lawful personal privacy. We refuse or cancel any sale where the buyer tells us they intend to use the phone for illegal activity. We don't provide remote wiping, private networks or other services after a phone is delivered.

Liability

To the extent the law allows, our total liability for any order is limited to the price you paid for it, and we're not liable for third-party services. Nothing in these terms limits any rights you have under British Columbia consumer protection law.

Governing law

These terms are governed by the laws of British Columbia and the federal laws of Canada that apply there.

Questions

Before you buy

Which model should I pick?

All three run the same GrapheneOS setup. GrapheneOS can only update a phone while Google still releases firmware for it, so updates end in October 2030 for the Pixel 8, August 2031 for the Pixel 9 and August 2032 for the Pixel 10. See Compare models for battery, cameras and size.

Can I buy more than one phone?

Each order is for one phone, and each customer can buy up to 3 phones in any 30-day period. For more than that, email us first.

What is your return policy?

Unopened phones with the tamper seal intact can be returned within 14 days. Opened phones and custom builds can't be returned, but every phone has a 30-day warranty against defects. See Returns & warranty.

How long does delivery take?

Each phone takes 1–3 business days to build, test and seal. Free Expedited shipping then takes 1–4 business days within BC and 2–8 to the rest of Canada. Priority is a $50 upgrade at checkout: next-business-day delivery to most major cities, so usually 2–4 business days in total. Delivery times start once payment arrives.

How can I pay?

Interac e-Transfer, Bitcoin, or cash by mail. After you place your order you get an order number and payment instructions. Your phone is built once payment arrives.

How anonymous is each payment method?

Cash by mail is the most private: we only see your order number. Bitcoin is pseudonymous, so the payment isn't tied to your name but is visible on the blockchain. An e-Transfer shows your name from your bank. Whichever you choose, we only need a shipping address, and a PO box works.

What is the kill switch?

It's GrapheneOS's duress PIN. Entering it anywhere the phone asks for your PIN permanently erases everything on the phone and shuts it down. Ghostline phones ship with it set to 1234, so never type 1234 unless you mean to wipe the phone, and change it to your own PIN as soon as you can. If you wipe your phone by accident, it can't be undone, and we won't set it up again for you. See What's included.

Why is my phone locked when it arrives, and how do I get the PIN?

Every phone ships locked with its own temporary PIN, so nobody can use or tamper with it in transit. Once tracking shows your phone was delivered, message us with your order number and the number on the tamper seal on your package. We reply with your PIN through the contact method you chose at checkout, ideally Signal or Threema. Change the PIN as soon as you unlock the phone, and make sure your new PIN isn't 1234, which is the kill switch.

How do I know my phone hasn't been tampered with?

You can check it yourself in a few minutes, without trusting us. See Verify your phone.

How do referral codes work?

Your order number (it starts with GL-) is also your referral code. When a friend enters it at checkout, they get $25 off their phone.

How do I activate my chatr service?

Your phone arrives with a new chatr SIM, unopened in its original sealed packaging, and a top-up gift card covering 3 months. Put the SIM in the phone, activate it on chatr's website or by phone, choose your plan and phone number, and redeem the gift card for your first 3 months. The account is yours, in whatever name you give chatr. The phone is unlocked, so you can use any carrier instead.

Could the SIM card be cloned or tampered with?

The SIM ships unopened and untouched in chatr's original sealed packaging. We never open, activate or register it. If you'd still rather not use it, a new chatr SIM costs about $10 at most phone retailers. The top-up gift card works on any chatr account, so you can activate a SIM you bought yourself and use the gift card on that instead.

What happens after the 3 months?

Your phone keeps working. You can top up your chatr account and renew Mullvad yourself, or switch to any carrier or VPN you like. The phone is unlocked.

Can I put the camera or microphone back later?

No. Removal is permanent, which is the point. If you're unsure, keep them and use GrapheneOS's camera and mic toggles instead.

Where do I get apps?

Your phone comes with F-Droid, an open-source app store that needs no Google account. If you need an app that's only on Google Play, GrapheneOS can run Google Play in a restricted sandbox, but it's off by default and only installed if you choose to.

Does removing parts void the warranty?

Yes, the manufacturer's warranty no longer applies after we open the phone. Ghostline covers your phone with its own warranty instead.

Checkout

Ready when you are

Review your build, choose how to pay, and we'll confirm your order. Shipping anywhere in Canada is free. Questions first? Message us on Signal or Threema.

Signalghostline.01
Threema IDXXXXXXXX
Email (Proton Mail)
1 · Your phone
Pixel 9Customize $0
Free tracked Expedited shipping across Canada, in plain packaging. Priority upgrade available below. All taxes are already included in the price.

Unopened returns within 14 days · 30-day warranty on every phone. Returns & warranty

2 · Shipping

3 · Payment

4 · Contact & address

Kill switch warning: your phone ships with the kill switch (duress PIN) set to 1234. Entering 1234 anywhere the phone asks for a PIN permanently erases everything on it. Change it to your own secret PIN on day one.

Your phone arrives locked. We lock every phone with a temporary PIN before it ships, so nobody can access, hijack or tamper with it on the way to you.

By placing an order you agree to our Terms of sale and Returns & warranty, and our Privacy policy explains how your details are handled.