SecureCall FAQ

SecureCall is an Android app for end-to-end encrypted voice calls. X25519 and HKDF-SHA256 derive per-call key material, and XChaCha20-Poly1305 protects application media frames. SecureCall does not implement a Double Ratchet. The cryptographic engine is written in Rust, and the complete source code is publicly available on GitHub.

Call audio is protected between the clients and is not sent to the signaling service. A P-256 Android Keystore identity authenticates registration and the per-call X25519 exchange. The service still processes connection metadata, public keys and routing data. Alias, custom-ID and phone lookup remain server-resolved.

No. SecureCall generates an anonymous ID on your device. No phone number, email address, or personal information is required. You share your SecureCall ID with contacts through any channel you choose.

Currently, SecureCall is Android-only. An iOS version is planned but not yet under development. The Rust crypto engine is cross-platform, so the core security will be identical. The planned iOS client will support external device VPNs but will not provide its own VPN tunnel.

The Google Play edition intentionally contains no built-in VPN service so the listing meets Google Play's VpnService distribution requirements. It follows a VPN managed by Android or another trusted app and shows a green status LED while SecureCall uses that route. The separately distributed Premium APK adds an optional, app-managed WireGuard tunnel after Android VPN consent. Its provider configuration remains local and its private key is protected by Android Keystore.

Transparency builds trust. By publishing our source code, we allow security researchers, journalists, and privacy advocates to verify that our encryption works as claimed. Any backdoor would be visible in the public code. Security through obscurity is no security at all.

It depends on your tier. Free: optional anonymous crash reports and ads. Pro & Premium: no ads, no crash reporting. All tiers use Firebase Cloud Messaging for push notifications and STUN/TURN for WebRTC connectivity. No call content or recordings are stored server-side. No persistent call logs, no contact uploads. See our Privacy Policy for detailed tables.

SecureCall is designed for GDPR-aligned data minimization. It avoids call content, contact uploads, and persistent server-side call history. Operational services such as FCM, STUN/TURN, Free-tier ads, and crash reporting where enabled are documented in the Privacy Policy. StealthX is operated by Vendetta Labs, based in Greece (EU).

No. We cannot provide call content because we do not have it. End-to-end encryption means only the two call participants possess the decryption keys. We cannot comply with wiretap requests because it is technically impossible for us to decrypt calls.

XChaCha20-Poly1305 for application-frame encryption, X25519 for key exchange, HKDF-SHA256 for per-call key derivation and P-256 signatures for identity authentication. Key material is discarded when the call ends. SecureCall does not implement a Double Ratchet or post-compromise security. See our Security Architecture page for details.

Pro and Premium tiers include active protection against call recording attempts: FLAG_SECURE prevents screen capture, exclusive audio focus blocks other apps from recording, and continuous monitoring detects screen recording apps, microphone hijacking, and known spy/surveillance apps. Pro blocks threats; Premium auto-terminates the call.

Rust guarantees memory safety at compile time, eliminating buffer overflows, use-after-free, and data races — the most common sources of security vulnerabilities in cryptographic code. The Rust crypto engine is compiled to a native library and accessed from Android via JNI.

SecureCall Free is free forever with ads. The accepted direct lifetime prices are Pro: €15 and Premium: €25. A browser wallet with any positive IFR balance qualifies for the 50% holder prices of €7.50 and €12.50. Sales remain closed until matching product and finance readiness are approved. Planned Google Play subscriptions are a separate store contract. Full comparison: Pricing

SecureChat and Chameleon remain separate products with their own release and finance gates. Their historical candidate prices are not active offers. Any future IFR-holder discount will use browser verification before an approved checkout, never an in-app wallet unlock. Details: SecureChat status

The StealthX Suite is not currently available for checkout. Individual SecureCall, SecureChat and Chameleon products may offer a browser-only IFR holder discount when their secure checkout is available.

A Forever License is a one-time purchase for the named SecureCall tier. The accepted closed-gate direct prices are €15 Pro and €25 Premium; sales are not yet open. Access, supported versions, refunds, and updates follow the terms shown at an approved checkout.

One-time license: Pay once for the tier and supported versions stated at checkout. Activation follows confirmed payment.
Google Play subscription: A separate planned store offer. It remains unavailable until Play purchase, restore, refund and RTDN tests pass.

Purchases are currently disabled. When a direct lifetime offer is approved, the website will display the exact price, terms, IFR-holder option, and checkout status. If a Google Play subscription is later enabled, purchase, restoration, and cancellation will be managed through Google Play.

No paid SecureCall checkout is currently active. Planned direct payments use Stripe through the VLABS finance boundary; any future Play offer uses Google Play Billing. SecureCall should receive only the minimum purchase and entitlement facts required for fulfilment, not full card details or raw wallet proof.

Open SecureCall Settings > Delete All Data, then uninstall the app to erase local keys, contacts, history, and settings. This does not automatically erase operational, entitlement, billing, security, or legally required records held by service providers. Server-side rights and deletion requests follow the current privacy policy.

StealthX is a privacy platform consisting of three separate products: SecureCall (encrypted voice calls), SecureChat (encrypted messaging), and Chameleon (an Android privacy utility). Each product has its own implementation, audit, distribution, and release gates. Planned IFR-holder benefits use browser verification before an approved checkout instead of in-app wallet unlocking.

SecureChat is the messaging app in the StealthX platform. The Android APK is available now with core encrypted messaging, QR contact exchange and StealthX activation tiers. Relay and identity expansion remains documented on the SecureChat roadmap. Learn more →

Chameleon is a context-aware privacy layer for Android. It intercepts text in any app via AccessibilityService, encrypts it with XChaCha20-Poly1305, and injects the ciphertext back — transparently. Features include encrypted file storage (Private Zone), location-based rules (Geofencing), and dual profiles (Decoy). Source available for transparency and security review. View on GitHub →

Not in the current app releases. WalletConnect and in-app IFR unlocking have been removed from the public app path. The planned IFR holder benefit uses browser verification before an approved checkout; it is not currently active.