{"id":20236654,"url":"https://github.com/celenityy/grapheneos-settings","last_synced_at":"2026-06-08T15:32:29.068Z","repository":{"id":244890131,"uuid":"816569827","full_name":"celenityy/grapheneos-settings","owner":"celenityy","description":"My recommendations for the ultimate GrapheneOS Configuration :)","archived":false,"fork":false,"pushed_at":"2024-12-17T07:30:06.000Z","size":31,"stargazers_count":17,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-11-30T21:01:30.758Z","etag":null,"topics":["android","anti-tracking","grapheneos","hardened","hardening","privacy","privacy-protection","security","tracking"],"latest_commit_sha":null,"homepage":"https://codeberg.org/celenity/grapheneos-settings","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/celenityy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"custom":["https://celenity.dev/donate"]}},"created_at":"2024-06-18T02:28:38.000Z","updated_at":"2025-11-21T18:34:28.000Z","dependencies_parsed_at":"2024-09-07T04:56:29.088Z","dependency_job_id":"92224506-7af8-42e7-84ae-d287707c81a8","html_url":"https://github.com/celenityy/grapheneos-settings","commit_stats":null,"previous_names":["retold3202/grapheneos-settings","celenityy/grapheneos-settings"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/celenityy/grapheneos-settings","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/celenityy%2Fgrapheneos-settings","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/celenityy%2Fgrapheneos-settings/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/celenityy%2Fgrapheneos-settings/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/celenityy%2Fgrapheneos-settings/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/celenityy","download_url":"https://codeload.github.com/celenityy/grapheneos-settings/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/celenityy%2Fgrapheneos-settings/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34069490,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-08T02:00:07.615Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","anti-tracking","grapheneos","hardened","hardening","privacy","privacy-protection","security","tracking"],"created_at":"2024-11-14T08:22:21.623Z","updated_at":"2026-06-08T15:32:29.049Z","avatar_url":"https://github.com/celenityy.png","language":null,"funding_links":["https://celenity.dev/donate"],"categories":[],"sub_categories":[],"readme":"# grapheneos-settings\n\nMy recommendations for the ultimate GrapheneOS Configuration :)\n\n**NOTE:** This project can be found on both [Codeberg](https://codeberg.org/celenity/grapheneos-settings), which will act as the main \u0026 preferred way to contribute, and [GitHub](https://github.com/celenityy/grapheneos-settings).\n\n# Network \u0026 internet\n\nInternet -\u003e **Wi-Fi** -\u003e ❌ *when not using*\n\nInternet -\u003e Network preferences:\n\n* **Turn on Wi-Fi automatically** -\u003e ❌\n\n* **Notify for public networks** -\u003e ❌\n\n* **Turn off Wi-Fi automatically** -\u003e Your choice, the lower the better, I leave mine at `1 minute`\n\n\u003cbr\u003e\n\nSIMs -\u003e *Select your carrier* -\u003e **Preferred network type** -\u003e `LTE only`\n\nSIMs -\u003e *Select your carrier* -\u003e **Allow 2G** -\u003e ❌\n\nSIMs -\u003e *Select your carrier* -\u003e **Vo5G** -\u003e ❌\n\n**eSIM support** -\u003e ❌ *if not using*\n\n**Airplane Mode** -\u003e ✅ *when not using cell data*\n\nHotspot \u0026 Tethering:\n\n* **Wi-Fi hotspot** -\u003e ❌\n\n* **USB tethering** -\u003e ❌\n\n* **Bluetooth tethering** -\u003e ❌\n\n* **Ethernet tethering** -\u003e ❌\n\n\u003cbr\u003e\n\nVPN -\u003e *Select your VPN if you use one (you should)* -\u003e **Always-on VPN** -\u003e ✅ *(Should be default)*\n\nVPN -\u003e *Select your VPN if you use one (you should)* -\u003e **Block connections without VPN** -\u003e ✅ *(Should be default)*\n\nPrivate DNS -\u003e **Private DNS provider hostname** -\u003e Pick a private/secure DNS provider of your choice, I would recommend setting up your own [NextDNS](https://nextdns.io) configuration if you are able to (See my recommendations for NextDNS [here](https://codeberg.org/celenity/nextdns-settings)), otherwise I would recommend [Quad9](https://quad9.net/): `dns.quad9.net`\n\n**Internet connectivity checks** -\u003e `Off` *(You can re-enable when necessary to connect on public networks with captive portals)*\n\n**Attestation key provisioning** -\u003e `GrapheneOS proxy` *(Should be default)*\n\n**Widevine provisoning** -\u003e `GrapheneOS proxy` *(Should be default)*\n\n# Connected devices\n\nConnection preferences:\n\n* Bluetooth -\u003e **Use Bluetooth** -\u003e ❌ *when not using*\n\n* Bluetooth -\u003e **Device name** -\u003e Keep this generic, I recommend setting it to `Device` *(You will need to temporarily turn on Bluetooth for this option to appear, don't forget to disable Bluetooth again after)*\n\n* Bluetooth -\u003e **Turn off Bluetooth automatically** -\u003e Your choice, the lower the better, I leave mine at `1 minute`\n\n* NFC -\u003e **Use NFC** -\u003e ❌ *when not using*\n\n* NFC -\u003e **Require device unlock for NFC** -\u003e ✅ *(You will need to temporarily turn on NFC to toggle this option, don't forget to disable NFC again after)*\n\n* Printing -\u003e Default Print Service -\u003e **Use print service** -\u003e ❌ *if not using* *(Also do the same for your Work profile if you have one)*\n\n* **Ultra-Wideband (UWB)** -\u003e ❌ *(You will need to temporarily turn off Airplane Mode to toggle this option, don't forget to enable Airplane Mode again after)*\n\n# Apps\n\nGo through all apps and remove permissions that are unneeded\n\nI would also recommend removing the `Sensors` permission from `Apps`, `Calculator`, `Clock`, `Contacts`, `Files`, `Gallery`, `Keyboard`, `Messaging`, `PDF Viewer`, `Vanadium`, \u0026 `Vanadium System WebView` *(For `Vanadium System WebView` to appear, you must select the 3 dots on the top right corner and select `Show system`)\n\n**App battery usage** -\u003e This is a great option to take advantage of, I would recommend disabling background usage for any apps that don't need to run in the background, as this can heavily improve battery life \u0026 privacy. You can also allow unrestricted access here to any apps that do need to run in the background, like Signal or Molly without Google Play.\n\n**Special app access** -\u003e Go through the options here and make sure nothing is granted any of these permissions that doesn't 100% need it\n\nSpecial app access -\u003e **Special access to hardware accelerators for Google apps** -\u003e `Access not granted` ❌\n\n# Notifications\n\n**App notifications** -\u003e Go through and disable notifications for any apps that don't need it\n\nNotification history -\u003e **Use notification history** -\u003e ❌ *(Should be default)*\n\n**Device \u0026 app notifications** -\u003e Make sure this isn't granted to any apps that don't actually need it besides i.e. the launcher\n\n**Notifications on lock screen** -\u003e `Hide silent conversations and notifications`\n\n**Sensitive notifications** -\u003e ❌\n\n**Sensitive work profile notifications** -\u003e ❌\n\nFlash notifications -\u003e **Camera flash** -\u003e ❌ *(Unless needed)*\n\nFlash notifications -\u003e **Screen flash** -\u003e ❌ *(Unless needed)*\n\nWireless emergency alerts:\n\n* **AMBER alerts** -\u003e ❌\n\n* **State and local tests** -\u003e ❌\n\n\u003cbr\u003e\n\n**Hide silent notifications in status bar** -\u003e ✅\n\n**Enhanced notifications** -\u003e ❌\n\n# Battery\n\n**Battery percentage** -\u003e ✅\n\n**Battery share** -\u003e ❌\n\n# Display\n\n**Adaptive brightness** -\u003e ❌ *(Annoying and better for battery)*\n\n**Lock screen** -\u003e `Show sensitive content only when unlocked`\n\n**Screen timeout** -\u003e Your choice, the lower the better, I leave mine at `After 1 minute of inactivity`\n\n**Dark theme** -\u003e ✅\n\nNight Light -\u003e **Schedule** -\u003e `Turns on at custom time`\n\nNight Light -\u003e **Start time** -\u003e `9:00 PM`\n\nNight Light -\u003e **End time** -\u003e `6:00 AM`\n\n**Colors** -\u003e `Natural`\n\n**Screen resolution** -\u003e `Full resolution` *(You could set this to `High resolution` if you need to conserve battery)*\n\n**Smooth Display** -\u003e ✅ *(You could disable this if you need to conserve battery)*\n\n**Increase touch sensitivity** -\u003e ✅ *(if you use a screen protector)*\n\n# Wallpaper \u0026 style\n\nLock screen -\u003e More lock screen options:\n\n* **Use device controls** -\u003e ✅ *(harmless)*\n\n* **Dynamic clock** -\u003e ❌\n\n* **Always show time and info** -\u003e ❌\n\n* **Tap to check phone** -\u003e `Off` ❌\n\n* **Lift to check phone** -\u003e `Off` ❌\n\n* **Wake screen for notifications** -\u003e ✅ *(You could disable this if you need to conserve battery)*\n\n* **When work profile is locked** -\u003e `Hide sensitive work content`\n\n\u003cbr\u003e\n\nHome screen -\u003e **Themed icons** -\u003e ✅\n\n# Accessibility\n\nPlease do **NOT** grant any apps the accessibility permission unless you actually need to. This is a very dangerous permission, very concerning from a privacy \u0026 security stand-point, so please be mindful.\n\n# Security\n\n**Screen lock** -\u003e I would recomend using a strong `Password` and avoiding fingerprint, face, or PIN if possible.\n\nScreen lock -\u003e **Lock after screen timeout** -\u003e Your choice, the lower the better, I leave mine at `5 seconds after timeout`\n\nScreen lock -\u003e **Power button instantly locks** -\u003e ✅\n\n**Auto reboot** -\u003e Your choice, the lower the better, I leave mine at `8 hours`\n\n**Duress password** -\u003e This is a great setting, make sure to enable and take advantage of it.\n\n**USB-C port** -\u003e `Charging-only when locked` *(If you don't use any USB devices at all with your device, you should set this to `Charging-only`)*\n\nSecure app spawning -\u003e **Use secure app spawning** -\u003e `Enabled` ✅\n\n**Automatic exploit protection compatibility mode** -\u003e ❌ *(If you're not willing to troubleshoot the very rare times an app has issues, then you could potentially leave this on)*\n\nNative code debugging -\u003e **Block for third-party apps by default** -\u003e ✅\n\n**Scramble PIN input layout** -\u003e ✅\n\n**Allow camera access when the device is locked** -\u003e ❌\n\n**Notify about system process crashes** -\u003e ✅\n\nMore security settings:\n\n* **Device admin apps** -\u003e Go through and remove this permission from any apps that don't absolutely need it\n\n* SIM lock -\u003e **Lock SIM** -\u003e ✅ *(You might have to find your carrier's default SIM PIN)*\n\n* Encryption \u0026 credentials -\u003e Trusted credentials -\u003e **User** -\u003e Remove any certificates you don't need/use\n\n* Encryption \u0026 credentials -\u003e **User credentials** -\u003e Remove any certificates you don't need/use\n\n* Work profile security -\u003e **Use one lock** -\u003e ✅\n\n* **Fingerprint unlock for work** -\u003e ❌ *(You should use a strong password instead)*\n\n# Privacy\n\n**Camera access** -\u003e ❌ *when not using*\n\n**Microphone access** -\u003e ❌ *when not using*\n\n**Allow Sensors permission to apps by default** -\u003e ❌\n\n**Save screenshot timestamp to EXIF** -\u003e ❌\n\n**Show passwords** -\u003e ❌\n\n**Show media on lock screen** -\u003e ✅ *(harmless)*\n\n**Show clipboard access** -\u003e ✅\n\n# Location\n\n**Use location** -\u003e ❌ *when not using*\n\nLocation services -\u003e **Wi-Fi scanning** -\u003e ❌ *(Should be default, make sure to also set for your `Work` profile if you have one)*\n\nLocation services -\u003e **Bluetooth scanning** -\u003e ❌ *(Should be default, make sure to also set for your `Work` profile if you have one)*\n\nSUPL is used to speed-up acquiring location, but it comes at the cost of potentially sending sensitive information to Google, such as your MCC, MNC, nearby cell towers, and the strength of those towers. While GrapheneOS does proxy this connection, which helps to improve privacy, this is still not ideal, as Google is still sent this data. I have personally not noticed any difference acquiring location with this off, so as long as you're on a newer Pixel, I would recommend just disabling this. You can read more about SUPL, as well as PSDS [here](https://divestos.org/misc/gnss.txt):\n\n**Secure User Plane Location (SUPL)** -\u003e `Off`\n\n**Predicted Satellite Data Service (PSDS)** -\u003e `GrapheneOS server` *(harmless)*\n\n# System\n\nKeyboard -\u003e On-screen keyboard -\u003e Keyboard:\n\n* Preferences -\u003e **Auto-capitalization** -\u003e ❌\n\n* Preferences -\u003e **Voice input key** -\u003e ❌ *if you don't use*\n\n* Text correction -\u003e **Block offensive words** -\u003e ❌\n\n* Text correction -\u003e **Personalized suggestions** -\u003e ❌ *(Should be default)*\n\n* Text correction -\u003e **Suggest Contact names** -\u003e ❌\n\n* Advanced -\u003e **Emoji for physical keyboard** -\u003e ✅\n\n\u003cbr\u003e\n\nKeyboard -\u003e Spell checker -\u003e **Look up contact names** -\u003e ❌\n\nGestures -\u003e **Navigation mode** -\u003e ✅ `Gesture navigation` *(I held out on `3-button navigation` for ages, but after finally switching, I can say it's a game-changer, so much better, please try it)*\n\nGestures -\u003e Navigation mode -\u003e Gesture navigation -\u003e **Swipe to invoke assistant** -\u003e ❌\n\nGestures -\u003e Navigation mode -\u003e 3-button navigation -\u003e **Hold home for assistant** -\u003e ❌\n\nDate \u0026 time -\u003e **Set time automatically** -\u003e ✅ *This is very important for security*\n\nDate \u0026 time -\u003e Time zone -\u003e **Set automatically** -\u003e ✅\n\nDate \u0026 time -\u003e Time format -\u003e **Use 24-hour format** -\u003e ❌\n\nSystem updates -\u003e **Release channel** -\u003e `Stable` *(Should be default)*\n\nSystem updates -\u003e **Permitted Networks** -\u003e `Any` *(Should be default)*\n\nSystem updates -\u003e **Require battery above warning level** -\u003e ✅\n\nSystem updates -\u003e **Require device to be charging** -\u003e ❌ \n\nSystem updates -\u003e **Automatic Reboot** -\u003e ❌ *(Should be default, I found this way too annoying)*\n\n# Developer options\n\n**OEM unlocking** -\u003e ❌\n\n**Automatic system updates** -\u003e ✅ *(Should be default)*\n\n**USB debugging** -\u003e ❌ *when not using*\n\n**Wireless debugging** -\u003e ❌ *when not using*\n\n**Logger buffer sizes** -\u003e `Off`\n\n**Force peak refresh rate** -\u003e ✅ *(You could disable this if you need to conserve battery)*\n\n**Wi-Fi Scan Throttling** -\u003e ✅ *(Should be default)*\n\n**Mobile data always active** -\u003e ❌\n\n**Window animation scale** -\u003e `.5x`\n\n**Transition animation scale** -\u003e `.5x`\n\n**Animator duration scale** -\u003e `.5x`\n\n**Allow window-level blurs** -\u003e ❌\n\n**Always show crash dialog** -\u003e ✅\n\n**Suspend execution for cached apps** -\u003e `Enabled`\n\n**Force allow apps on external** -\u003e ✅\n\n**Predictive back animations** -\u003e ✅\n\n# About phone\n\n**Device name** -\u003e Keep this generic, I recommend setting it to `Device`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcelenityy%2Fgrapheneos-settings","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcelenityy%2Fgrapheneos-settings","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcelenityy%2Fgrapheneos-settings/lists"}