Anon WhistleBlower

Native Android tip submission for our GlobaLeaks tip portal. Opens straight onto the form — no Tor Browser, no JavaScript engine, no fingerprintable browser. Embedded Tor routes the submission to our .onion, files are stripped of EXIF before upload, voice notes are run through forensic-grade voice distortion before they ever hit disk. Drafts encrypted at rest; PANIC button wipes everything. 39 MB.

Embedded Tor — same Guardian Project tor-android we ship in Anon XMPP / Mail / Mumble. Bootstraps on app start, binds SOCKS5 on 127.0.0.1:9050. Every byte of your submission travels through Tor; the tip portal's .onion hostname resolves inside the Tor circuit. 5-step authenticated submission flow — /api/auth/token → Argon2id proof-of-work → /api/auth/receiptauth → second PoW → attachment uploads → submission POST. The PoW is solved on-device with pure-Java BouncyCastle Argon2id (no JNI). Receipt is generated client-side (16-digit numeric, SecureRandom) and displayed once — we never see it in cleartext. EXIF auto-strip — image attachments run through androidx.exifinterface in-place: GPS group (24 tags), camera Make/Model/Software, lens + body serials, all datetimes, owner/artist/copyright, image-unique-id, XMP. Orientation is deliberately preserved so receivers don't see sideways photos. Voice notes — ROBOT mode, irreversible — same DSP as Anon Voice in ROBOT mode (random phase per FFT bin per frame + 47 Hz ring modulation). The DSP runs before the WAV writer; the on-disk file is always the distorted version. No raw mic samples ever land on disk, no toggle to disable. PIN + biometric lock — PBKDF2-HMAC-SHA256 (100k iter, 32-byte salt) in EncryptedSharedPreferences. Class 3 (strong) biometric only. 60 s grace on background. Same lock pattern as Anon PGP / Mail / VPN. PANIC wipe, two flavors — in-app: clears draft + attachments + voice notes (keeps your PIN). Lock-screen panic: also clears the PIN so the app looks like a fresh install — no "this user had a PIN configured" signal on a seized device. FLAG_SECURE always — screenshots + Recent Apps thumbnail blocked on every activity, independent of lock state. No analytics, no FCM, no Google Play Services. No READ_EXTERNAL_STORAGE — SAF for every file pick. No ACCESS_FINE_LOCATION permission declared at all. Free software under GPLv3

F-Droid repo: https://anonymous.gratis/fdroid/repo Tip portal: http://ieyezgeojxw73hv4szrkbreea3rd6ri7xfbevngi63uabothn226euyd.onion