A few weeks back I read a conversation between the team at It’s FOSS and Brian from iodé, a de-Googled Android project that has been getting more attention lately. The interview covered the usual ground for a privacy-Android project: no Google Play, no tracking, an alternative app store, a tracker blocker that shows you what is happening on the device. The part that made me stop and think was the bit about banking apps and the locked bootloader.
The dirty secret of de-Googled Android projects for the last decade is that they have been great for the people who can tolerate them, and bad for everyone else. Banking apps would not work, corporate MDM would not install, and the apps you actually needed required side-loading from sketchy sources. The projects that have survived the last five years are the ones that figured out how to make those apps work without giving up the privacy story. iodé is one of those projects.
Here is what it does, what it does not do, and whether it is ready for the audience the marketing claims.
What iodé actually is
iodé is an Android distribution that ships on a small set of supported phones. It is not a custom ROM in the LineageOS sense, where you flash your own device and hope for the best. It is closer to a fork of the Android Open Source Project (AOSP, the upstream source code Google publishes for everyone to build on, which is Android without any Google services baked in) that iodé maintains and ships as a complete phone experience.
The thing that makes iodé different from the better-known alternatives is the bundle. You get the OS, you get a tracker blocker, you get two app stores, and you get a hardware list of devices that are guaranteed to work. The combination is closer to “buy this phone and it does the thing” than “tinker with this ROM until it boots.”
The hardware list is short. As of 2026, iodé supports a handful of recent Samsung and Fairphone models. That is a real limitation. The privacy-Android market has had a chronic problem of supporting whatever device the maintainer happens to own, which is not a recipe for an audience that wants to buy a phone and use it.
There are four things that matter about the phone experience once you actually use iodé.
- The phone boots into a launcher that looks and feels like a standard Pixel-style launcher. The first-time setup is closer to a normal Android setup than to a Linux distro installer.
- The tracker blocker is on by default and shows you, on a per-app basis, which domains the app is talking to. You can allow, block, or investigate any connection.
- The app stores are F-Droid for free software and Aurora Store as a Google Play front-end. Aurora is the key piece for the banking apps story.
- Updates roll out on a regular cadence, and the security patches track the upstream AOSP patch level.
If you have ever used a de-Googled ROM and thought “this is cool but I am not giving this to my mother,” iodé is the project that is trying to make that sentence stop being true.
The banking apps problem
The single biggest reason people abandon de-Googled phones is that banking apps refuse to install. The apps detect that the device is not Play Protect certified, or they detect that the bootloader is unlocked, or they detect that the system is not running a Google-signed build, and they refuse to run. Sometimes you get a polite error message. Sometimes you get an infinite spinner. Either way, you cannot pay your rent.
Brian’s answer in the interview is that iodé has spent real engineering effort on this. The project ships a microG (a reimplementation of the Google services libraries that allows apps that depend on Google Play Services to run without contacting Google) compatibility layer that fakes enough of the Google services surface that banking apps cannot tell the difference. Combined with Aurora Store, which lets you download apps from the Play Store as if you were a logged-in user, the result is that most banking apps install and run.
This is the part where I want to be specific, because the difference between “most banking apps work” and “banking apps work” matters.
- Banking apps that only check for Google Play Services: usually work, because microG provides a compatible library surface.
- Banking apps that check for a Play Protect certification: usually work on iodé-supported devices, because the supported devices ship with a certified bootloader.
- Banking apps that do device attestation against Google’s hardware root of trust: do not work, because iodé does not ship the Google attestation key, and it should not, because that key is the privacy problem.
- Banking apps that use SafetyNet or the Play Integrity API: the situation is the same as device attestation, and the answer is the same. The apps that require Google-signed attestation will not run.
The third and fourth categories are real. They are also a small minority of the apps in the Play Store. For most people in most countries, the bank app they actually use falls into the first two categories, and iodé handles it.
The locked bootloader is the part of this story that is easy to misread. A locked bootloader is not the same thing as a Google-locked bootloader. The supported iodé devices ship with a bootloader that is locked against arbitrary firmware (you cannot flash anything you want) but is not locked against iodé itself (iodé can ship updates). The result is that the device passes the attestation checks most banking apps do, because iodé’s build chain is registered with the hardware vendor, and the vendor’s keys are the ones the apps trust.
This is a real engineering investment, and it is the reason the supported device list is short. A bootloader that ships registered keys for a specific build pipeline is a per-device engineering project. iodé has chosen a small number of devices and made them work well, instead of a long list of devices where the bootloader story is murky.
The tracker blocker
The piece of iodé that does not get enough attention is the tracker blocker. It is a per-app firewall that shows you which domains each app is talking to, and lets you block or allow them. The interface is a list of apps, each with a count of connections blocked, and a tap-through to the list of domains.
The reason this matters more than the usual “block trackers” pitch is that it is a teaching tool. When you open the banking app and see that it has tried to talk to ten analytics domains in the background, you learn something about the banking app. When you open the weather widget and see the same list, you learn something about the weather widget. The list is per-app, persistent, and exportable.
There are four practical things you can do with the tracker blocker that change how you use the phone.
- Audit a new app for a week before deciding whether to keep it. The connections log tells you more about an app’s actual behavior than the privacy policy does.
- Block a single domain across all apps. If a particular analytics domain is showing up in twenty apps, you can block it once and the block applies to every app that tries to contact it.
- Detect apps that are phoning home when they should not be. A weather app that tries to reach an ad network on launch is doing something the privacy policy does not mention.
- Show a non-technical friend what their data looks like in flight. The visualization is more persuasive than any argument about why tracking is bad.
The tracker blocker is the part of iodé that justifies the project for users who do not care about the rest. If you install iodé only for the tracker blocker, you still get an Android phone with working banking apps and a locked bootloader. The privacy story is layered, and you can take as much or as little of it as you want.
What iodé is not
A few things iodé is not, to set expectations correctly.
Daily-driver replacement for a Pixel: iodé is not one. The supported device list is small, the carrier compatibility is limited, and the apps in the Play Store that require Google attestation will not run. If your bank uses one of those apps, iodé will not work for you today.
Security hardening is a separate project. GrapheneOS does more aggressive security work, including a hardened memory allocator and a more restrictive app sandbox. iodé is a privacy-focused phone, not a security-focused phone. If your threat model is a nation-state adversary, GrapheneOS is the more sensible pick. If your threat model is “I do not want every app on my phone reporting back to a dozen ad networks,” iodé is the more sensible pick.
Linux phones are a different category. iodé runs Android, with all the assumptions Android makes about apps, sandboxes, and the file system. The Linux-phone projects (PinePhone, Librem 5, postmarketOS) are a different category with a different set of trade-offs.
The price is not subsidized. The phones cost roughly the same as the equivalent non-iodé model, because iodé is built on existing hardware. You are paying for the engineering and the supply chain, not for a subsidized device.
Trade-offs
iodé is not the answer for everyone. Here are the four trade-offs that matter.
Supported device list is the biggest single cost. If your current phone is not on the list, you are buying a new phone to use iodé. That is a real cost, and it is the single biggest reason people decide not to switch.
Banking apps that require attestation do not work today. The apps that require Google device attestation will not run, and they will not run until either iodé ships the attestation key (which would defeat the privacy story) or Google changes how the attestation works (which is not on the roadmap). If your bank is one of the apps that requires attestation, iodé will not work for you.
AOSP cadence, not Pixel cadence. You will get security patches on the AOSP cadence, not the Pixel cadence, which is usually a few weeks behind. For most users this is invisible. For users with a high threat model it matters.
The trade-off that matters most is whether the privacy story is worth giving up the convenience of a Pixel. For users whose main concern is the convenience of the Play Store and the latest Android builds, the answer is no. For users whose main concern is that every app on their phone is reporting their location and behavior to a dozen ad networks, the answer is yes.
Bottom line
Anyone who has been curious about de-Googled Android but skeptical that the projects can deliver a daily-driver experience should look at iodé before deciding. The project has done more than most to make the daily-driver story real, and the engineering investment in the bootloader and microG is the proof.
For users whose banks use attestation-based banking apps, iodé is not ready yet. The day those banks switch to a less hostile security model, iodé will be ready. Until then, those users should wait.
For everyone else, iodé is the most polished version of the de-Googled Android idea available in 2026. The tracker blocker alone is worth installing the OS for, even if you keep a second phone for the apps that need Google attestation.