SecureCall FAQ

SecureCall is an Android app for end-to-end encrypted voice calls. Every call is encrypted using XChaCha20-Poly1305 with X25519 key exchange and Double Ratchet forward secrecy. The cryptographic engine is written in Rust, and the complete source code is publicly available on GitHub.

No. Calls are encrypted end-to-end. Encryption keys are generated on your device and never sent to our servers. We are technically unable to decrypt your calls, even if compelled by a court order. Our signaling server only sees encrypted payloads and temporary identifiers.

No. SecureCall generates an anonymous ID on your device. No phone number, email address, or personal information is required. You share your SecureCall ID with contacts through any channel you choose.

Currently, SecureCall is Android-only. An iOS version is planned but not yet under development. The Rust crypto engine is cross-platform, so the core security will be identical. The planned iOS client will support external device VPNs but will not provide its own VPN tunnel.

The Google Play edition intentionally contains no built-in VPN service so the listing meets Google Play's VpnService distribution requirements. It follows a VPN managed by Android or another trusted app and shows a green status LED while SecureCall uses that route. The separately distributed Premium APK adds an optional, app-managed WireGuard tunnel after Android VPN consent. Its provider configuration remains local and its private key is protected by Android Keystore.

Transparency builds trust. By publishing our source code, we allow security researchers, journalists, and privacy advocates to verify that our encryption works as claimed. Any backdoor would be visible in the public code. Security through obscurity is no security at all.

It depends on your tier. Free: optional anonymous crash reports and ads. Pro & Premium: no ads, no crash reporting. All tiers use Firebase Cloud Messaging for push notifications and STUN/TURN for WebRTC connectivity. No call content or recordings are stored server-side. No persistent call logs, no contact uploads. See our Privacy Policy for detailed tables.

SecureCall is designed for GDPR-aligned data minimization. It avoids call content, contact uploads, and persistent server-side call history. Operational services such as FCM, STUN/TURN, Free-tier ads, and crash reporting where enabled are documented in the Privacy Policy. StealthX is operated by Vendetta Labs, based in Greece (EU).

No. We cannot provide call content because we do not have it. End-to-end encryption means only the two call participants possess the decryption keys. We cannot comply with wiretap requests because it is technically impossible for us to decrypt calls.

XChaCha20-Poly1305 for symmetric encryption (256-bit AEAD with 192-bit nonce), X25519 for key exchange (ECDH on Curve25519), and the Double Ratchet protocol for perfect forward secrecy. Keys are derived using HKDF-SHA256. See our Security Architecture page for full details.

Pro and Premium tiers include active protection against call recording attempts: FLAG_SECURE prevents screen capture, exclusive audio focus blocks other apps from recording, and continuous monitoring detects screen recording apps, microphone hijacking, and known spy/surveillance apps. Pro blocks threats; Premium auto-terminates the call.

Rust guarantees memory safety at compile time, eliminating buffer overflows, use-after-free, and data races — the most common sources of security vulnerabilities in cryptographic code. The Rust crypto engine is compiled to a native library and accessed from Android via JNI.

SecureCall Free is free forever with ads. Pro: €3.49/month or €15 lifetime (limited). Premium: €4.99/month or €25 lifetime (limited). IFR holders can verify a browser wallet for the seller-set discount displayed at checkout, not an in-app wallet unlock. Full comparison: Pricing

SecureChat Free is free forever. Pro: €9 lifetime (launch price, max €14.99). Elite: €19 lifetime (launch price, max €23.99). IFR holders can verify a browser wallet for the seller-set discount displayed at checkout. Chameleon uses the same tiers and prices. Details: SecureChat Pricing

The StealthX Suite is not currently available for checkout. Individual SecureCall, SecureChat and Chameleon products may offer a browser-only IFR holder discount when their secure checkout is available.

A Forever License is a one-time purchase for the named SecureCall tier. The giftable Premium Activation Code is currently listed at €25 in the VLABS shop. Access, supported versions, refunds, and updates follow the terms shown at checkout.

One-time license: Pay once for the tier and supported versions stated at checkout. Activation follows confirmed payment.
Subscription: Pay monthly (€3.49 Pro / €4.99 Premium) or yearly (€34.99 Pro / €49.99 Premium). Cancel anytime. Always available.

Monthly and yearly subscriptions are managed through Google Play. Stripe activation-code purchases are one-time codes delivered after checkout. To cancel a subscription, go to Google Play > Subscriptions > SecureCall > Cancel. Your Pro/Premium features remain active until the end of the billing period. Lifetime purchases never expire.

No. Card and wallet details are handled by Google Play Billing or Stripe checkout. We do not receive your full card number or payment credentials.

Open SecureCall Settings > Delete All Data, then uninstall the app. Since we don't store data on our servers, uninstalling removes all traces. Your encryption keys, contacts, and call history are stored only on your device.

StealthX is a privacy platform consisting of three products: SecureCall (encrypted voice calls), SecureChat (decentralized encrypted messaging), and Chameleon (context-aware privacy OS for Android). All three share the same XChaCha20-Poly1305 crypto stack. IFR holder benefits are available as browser-based wallet verification with the seller-set discount displayed at checkout instead of in-app wallet unlocking.

SecureChat is the messaging app in the StealthX platform. The Android APK is available now with core encrypted messaging, QR contact exchange and StealthX activation tiers. Relay and identity expansion remains documented on the SecureChat roadmap. Learn more →

Chameleon is a context-aware privacy layer for Android. It intercepts text in any app via AccessibilityService, encrypts it with XChaCha20-Poly1305, and injects the ciphertext back — transparently. Features include encrypted file storage (Private Zone), location-based rules (Geofencing), and dual profiles (Decoy). Source available for transparency and security review. View on GitHub →

Not in the current app releases. WalletConnect and in-app IFR unlocking have been removed from the public app path. IFR holder benefits are available as browser wallet verification with the seller-set discount displayed at checkout.