GETTING STARTED
No marketing in the way. Each step is here because skipping it has consequences — and we say so explicitly when it does.
We only ship images we have actually tested. If your model is not on the supported list yet, please wait — running a half-tested build on the wrong hardware is exactly the kind of risk this project exists to avoid.
We collect a one-time random token your browser generates locally, plus a broad region. No email, no IMEI, no IP, no phone number. You will receive a push to this device when a slot opens — usually two weeks before units ship.
Each release is a signed bundle plus a manifest. The manifest is signed by three independent roles (release, security, ops). If any signature fails to verify, our tool refuses to flash — no exception.
lyd-flasher is the open source flashing tool — written in Rust, no telemetry. It verifies signatures, hash-checks the bundle, locks the bootloader at the end, and writes nothing to your machine outside the working directory.
After first boot, open Sovereign Status and tap “Verify build hash.” The phone will show a hash. Compare it to the public release hash. If they match, you can trust the image. If they do not — alarm.
SUPPORTED DEVICES
If your model is missing, we either have not finished testing it or we have not received the vendor source we need. We say which.
JOIN THE LIST
Your browser generates a 32-byte random token locally. We store the token’s fingerprint and the broad region you told us. That is the entire database row. We have no way to email you, locate you, or correlate this signup with any other account you have.
To recognize you on launch day we ask for two things only: a random one-time token your browser generates locally, and the broad region you’re in. No email, no IMEI, no IP. Ever.
▸ 32-byte random token generated in your browser · payload is the token + region only · no other data leaves your device
QUESTIONS PEOPLE ASK BEFORE JOINING
We are running geographically phased waves. People in Türkiye and the EU come first because of our regulatory base. North American and APAC waves follow. Typical wait at the moment is 4–8 weeks from list-join.
Not for the stable Pixel 8 Pro image. Beta images do require some comfort with fastboot. We are working on a one-click flasher with a guided UI — but only after the underlying steps are simple enough to fail safely.
Yes. Google Play Services run sandboxed, exactly the way GrapheneOS handles it. You decide which apps see them, per-profile.
Setup is local. No account, no cloud key, no telemetry. If you choose to use Google Play or carrier services later, those have their own privacy terms — outside our control by design.
Your private key is generated on the device and never leaves it. We have no way to recover it for you — that is the security property.
Every release is hash-published. You can build it yourself and verify the device matches before you trust it.
Updates require three independent signatures and an explicit user prompt. The phone will not flash a new image without you noticing.