Network privacy

WraithLink tries to leak as little as possible about who and where you are, at every layer the phone controls: DNS, hardware addresses, cellular radios, and routing.

Encrypted DNS

By default your DNS lookups travel over plain UDP to whatever resolver the network hands you - your carrier, an airport, a cafe. Anyone on the path sees every domain you visit. WraithLink's setup wizard configures DNS-over-TLS to Mullvad (dns.mullvad.net) in one tap, so lookups are encrypted and go to a no-logs resolver instead of the local one.

Captive portals. Strict encrypted DNS can stop a Wi-Fi login page from loading, because the portal wants to hijack your DNS. If a network won't let you online, switch Private DNS off briefly in Settings, sign in, then turn it back on. You can also point it at any other DoT provider you prefer.

Per-connection MAC randomization

Your Wi-Fi adapter has a hardware address that, left alone, is broadcast to every network and can be used to track you between them. WraithLink uses a fresh, random MAC for each network you join - there is no persistent hardware address to follow you from the coffee shop to the office. This is the "no MAC address" behaviour: not literally absent, but never the same twice.

Disable 2G and anti-IMSI-catcher

Fake cell towers ("IMSI catchers" or "stingrays") work best by forcing your phone down to 2G, an ancient protocol with essentially no mutual authentication. WraithLink lets you turn 2G off entirely from the wizard, which removes the downgrade path those devices rely on. It also exposes timers to switch Wi-Fi and Bluetooth off automatically when idle, shrinking your radio footprint.

Tor routing

For the times you want your traffic to leave no IP trail at all, WraithLink includes Orbot and Tor Browser and supports a dedicated Tor "Ghost" profile that routes everything through Tor, kept isolated from your everyday identity. The WraithLink messenger and X47 pairing both run over Tor onion services for the same reason.

VPN

Mullvad VPN is bundled for a straightforward always-on tunnel. Unlike Android's "private space", the WraithVault profile honours the VPN rather than leaking around it, so your sensitive profile's traffic is covered too.