Frequently Asked Questions

SecureCall is an Android app for end-to-end encrypted voice calls. Every call is encrypted using XChaCha20-Poly1305 with X25519 key exchange: a fresh X25519 key pair per call (per-call forward secrecy); no Double Ratchet, no in-call rekeying. The cryptographic engine is written entirely in Rust for memory safety, and the complete source code is publicly available on GitHub. No accounts, no phone numbers, no personal data required.

No. Calls are encrypted end-to-end. Encryption keys are generated on your device and never sent to our servers. We are technically unable to decrypt your calls, even if compelled by a court order. Our signaling server only sees encrypted payloads and temporary connection identifiers — it cannot associate calls with real identities or read any content.

No. SecureCall generates an anonymous ID on your device. No phone number, email address, or personal information is required. You share your SecureCall ID with contacts through any channel you choose — in person, via messaging, or any other method you trust.

Not yet. SecureCall is currently Android-only (Android 7.0+ / API 24+). An iOS version is planned but not under active development. The Rust crypto engine is cross-platform, so the core security and encryption will be identical when the iOS version is built. The planned iOS client will support external device VPNs but will not provide its own VPN tunnel.

The Google Play edition intentionally contains no built-in VPN service so the listing meets Google Play's VpnService distribution requirements. It follows a VPN managed by Android or another trusted app and shows a green status LED while SecureCall uses that route. The separately distributed Premium APK adds an optional, app-managed WireGuard tunnel after Android VPN consent. Its provider configuration remains local and its private key is protected by Android Keystore.

Transparency builds trust. By publishing our source code, we allow anyone — security researchers, journalists, privacy advocates — to verify that our encryption works as claimed. Any backdoor would be visible in the public code. We believe that security through obscurity is no security at all. You don't have to trust us; you can verify.

It depends on your tier:

Free: Optional anonymous crash reports (opt-out) and ads.
Pro & Premium: No ads, no crash reporting.
All tiers use Firebase Cloud Messaging for push and STUN/TURN for connectivity. No call content or recordings stored server-side. No persistent call logs, no contact uploads.

See our Privacy Policy Custom Call ID for detailed data collection tables by tier.

SecureCall is designed for GDPR-aligned data minimization. It avoids call content, contact uploads, and persistent server-side call history. Operational services such as FCM, STUN/TURN, Free-tier ads, and crash reporting where enabled are documented in the Privacy Policy. StealthX is operated by Vendetta Labs, based in Greece (EU).

No. We cannot provide call content because we do not have it. End-to-end encryption means only the two call participants possess the decryption keys. We cannot comply with wiretap requests because it is technically impossible for us to decrypt calls. We also do not log call metadata, so we cannot identify who called whom or when.

SecureCall uses a modern, layered cryptographic stack:

Symmetric Encryption: XChaCha20-Poly1305 — 256-bit AEAD cipher with 192-bit extended nonce
Key Exchange: X25519 — Elliptic Curve Diffie-Hellman on Curve25519
Forward Secrecy: per-call ephemeral X25519 + HKDF session key — no Double Ratchet, no in-call rekeying
Key Derivation: HKDF-SHA256 — HMAC-based key derivation function
Implementation: Native Rust via JNI — memory-safe, zero buffer overflows

See the Security Design page for the full architecture.

Pro and Premium tiers include active protection against call recording attempts:

FLAG_SECURE prevents screenshots and screen recording of the call screen.
Exclusive audio focus blocks other apps from accessing the microphone.
Continuous monitoring detects screen recording apps, microphone hijacking, and known spy/surveillance applications.

Pro blocks the threat and shows an alert dialog.
Premium automatically terminates the call to ensure maximum protection.

Rust guarantees memory safety at compile time, eliminating buffer overflows, use-after-free, and data races — the most common sources of security vulnerabilities in cryptographic code. Unlike C/C++, Rust's ownership model ensures that memory is managed correctly without a garbage collector. The Rust crypto engine is compiled to a native library (.so) and accessed from Android via JNI, providing both safety and performance.

SecureCall has internal and community audit reports, but an audit is not a guarantee of security. The September 2026 consolidated audit recorded 62 findings, including 8 High findings; remediation and independent review are still in progress. See the Security Audit page and the public finding register for current status.

A Forever License is a one-time purchase for the named SecureCall tier. The accepted closed-gate direct prices are €15 Pro and €25 Premium; sales are not yet open. A positive verified IFR balance qualifies for the 50% browser prices of €7.50 and €12.50. Access, supported versions, refunds, and updates follow the terms shown at an approved checkout.

One-time license: Pay once for the tier and supported versions stated at checkout. Activation follows confirmed payment; statutory refund rights and the checkout terms apply.

Google Play subscription: A separate planned store contract. It is not currently available and will remain closed until Play purchase, restore, refund, revoke, and RTDN tests pass for the exact release.

Purchases are currently disabled. When a direct lifetime offer is approved, the website will display the exact price, terms, wallet-holder option, and checkout status. If a Google Play subscription is later enabled, purchase, restoration, and cancellation will be managed through Google Play. No current app control should be interpreted as an active offer.

No SecureCall paid checkout is currently active. Planned direct payments use Stripe through the VLABS finance boundary, while any future Google Play offer uses Google Play Billing. SecureCall should receive only the minimum purchase and entitlement facts required for fulfilment; card details and raw wallet proof must not enter the Android app.

Open SecureCall Settings > Delete All Data, then uninstall the app to erase its local keys, contacts, history, and settings. This does not automatically erase operational, entitlement, billing, security, or legally required records held by service providers. Server-side rights and deletion requests follow the current privacy policy.