Privacy-focused operating systems for phones and computers
The operating system on your phone or computer decides two things: how much information about you leaves the device, and how hard the device is for an attacker to break into. Those are the same question seen from two sides. A system that collects less has less to leak, and a system that is harder to attack keeps what it holds safe. This article introduces the main free and open-source options: GrapheneOS, CalyxOS, /e/OS and LineageOS for phones, and Debian, Fedora, Linux Mint, Ubuntu and Qubes OS for computers, with links to each project's own download and installation pages.
Why the operating system matters
Apps get most of the attention, but the operating system sits underneath all of them. It decides which apps can reach the network, the camera and your files, how quickly security fixes arrive, and what it reports back to its maker by default. A well-built system also limits the damage when something does go wrong, for example by keeping each app in its own sandbox so one bad app cannot read another's data.
A different operating system does not replace good habits. Strong, unique passwords, two-factor authentication, updates and care with links matter on every system.
Phones: Android without the extras
All four phone systems below are built on the open-source core of Android, so most Android apps work on them.
GrapheneOS
GrapheneOS is a non-profit, open-source project focused on security and privacy. It runs only on Google Pixel phones, because those offer the hardware security features it relies on, and it recommends the Pixel 8 or later, which carry at least seven years of support and hardware memory tagging, a feature that blocks a whole class of attacks.
What it adds:
- A permission to block an app's network access entirely, and another for its sensors.
- Storage and Contact Scopes, so an app sees only the files or contacts you choose.
- Automatic reboot after a set time locked, which puts your data back into its fully encrypted state.
- No Google services built in. If you need Google Play, you install it as an ordinary app, kept in the same sandbox as any other.
GrapheneOS provides a web installer that it recommends for most people; see its installation page and FAQ.
CalyxOS
CalyxOS is made by the Calyx Institute, a non-profit in New York. It supports Pixel phones and also some Fairphone, Motorola and SHIFT phones, and makes Google-compatible services through microG entirely optional. CalyxOS paused updates in August 2025 after a change in how Android's source code was published, resumed full maintenance on 1 July 2026, and began its Android 17 release in October 2026. See its installation page and about page.
/e/OS
/e/OS, from the non-profit e Foundation, removes Google's services and connections from Android and uses microG in their place. Its app installer shows which trackers and permissions each app uses, and it lets you block app trackers. It runs on a long list of phones; check the device list for yours.
LineageOS
LineageOS is the long-standing free Android distribution, supporting phones from more than 20 manufacturers with monthly security updates. Its strength is giving an older phone a longer, cleaner life without Google apps. Its own FAQ is honest about the limits: it cannot update a phone's closed firmware, and most phones cannot have their bootloader relocked afterwards, so it is less hardened than GrapheneOS. See the device list and install guides.
Computers: GNU/Linux you can check
Every GNU/Linux system below is free and open source, so anyone can check what it does. They differ in their defaults.
| System | What it collects by default | Security defaults | Support |
|---|---|---|---|
| Debian 13 | Nothing unless you install the popularity-contest package, which reports installed packages anonymously | AppArmor enabled by default; encrypted disk offered at install | About five years per release |
| Fedora Workstation 44 | Fedora says there are no ads and your data belongs to you | SELinux in enforcing mode by default | Two releases a year |
| Linux Mint 22.3 | No statement found either way | Update Manager and system snapshots; Canonical's Snap Store switched off by default | Until April 2029 |
| Ubuntu 26.04 LTS | Canonical says its telemetry is strictly opt-in, and the reports are stored locally in plain text so you can read them first | Five years of free updates, up to 15 with Ubuntu Pro, free for personal use | Long-term support |
Debian is the conservative choice, run by a volunteer project that commits in its social contract to staying entirely free and keeping its bug reports public. Fedora, backed by Red Hat, brings newer software and SELinux, which strictly limits what each program may do. Linux Mint builds on Ubuntu (or, in its LMDE edition, on Debian) with its own desktop and update tools. Ubuntu has the largest community and the longest support.
Qubes OS: security by separation
Qubes OS takes a different approach and calls itself "a reasonably secure operating system". It splits your work into separate virtual machines, called qubes, on the Xen hypervisor: one for banking, one for work email, a throwaway one for opening an attachment you are unsure of. If one is compromised, the others are not. It needs a modern computer with hardware virtualisation and at least 6 GB of memory, and it takes some learning. It suits people whose work carries high risk. See the downloads page, the installation guide and the system requirements.
Before you switch
- Back up everything first. Installing a new operating system replaces the old one and erases the device.
- Check your hardware is supported, using the project's own device or requirements list.
- Download only from the project's own site, and verify the download with the checksums and signatures it publishes.
- Follow the project's own instructions. GrapheneOS warns that third-party guides are often out of date.
- Keep your habits. Two-factor authentication, unique passwords and prompt updates still matter. Our article on infostealer malware shows why.
Where Noiz helps
Noiz runs its own hosting on GNU/Linux. Whichever system your team uses, the VPN service encrypts the connection from each desktop, laptop and phone, which matters most on public and untrusted networks, and the managed Backup service covers workstations and servers under terms agreed with you. If you run servers, Noiz Cloud offers Debian and Ubuntu, and our Linux administration looks after them, once or on a monthly basis; ask about it in a support ticket. Our Linux help articles are a good place to start.
Sources
Checked 19 October 2026.
Phones
- GrapheneOS, installation, FAQ and features
- CalyxOS, installation, about and news
- /e/OS and supported devices
- LineageOS, devices and FAQ
Computers
- Debian, download, installation manual, popularity contest and Social Contract
- Fedora Workstation, download and SELinux
- Linux Mint, download, installation guide and 22.3 release notes
- Ubuntu Desktop, download and Ubuntu Insights telemetry
- Qubes OS, downloads, installation guide and system requirements
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
