# Wolfden Phone Secure

Disappearing data, Burn Phone, forensic unlock, number swaps and rooms on the burner phone.

## What Wolfden Phone Secure does

Wolfden Phone Secure (item `nova_secure`) is the burner phone: no Nova Account, Ghost Mobile eSIMs only, a fixed set of eight apps and its own tactical interface. It comes with [Shade](#/docs/wd_phone/shade), the anonymous network, already installed. [Phones & inventory](#/docs/wd_phone/devices?section=wolfden-phone-secure) compares it with the other models.

On top of that, it can:

- Make its messages, calls, photos and contacts disappear on a timer.
- Hide who and what arrived on its lock screen.
- **Burn** itself, from Settings or with a second PIN typed on the lock screen.
- Swap its number for a fresh `777` number.
- Join **rooms**: group chats entered with a short code instead of a number.
- Disguise the player's voice on calls.

Police can get past its PIN with a timed **forensic unlock**. Everything except disappearing data, the lock screen and the voice changer is set in `config/secure.lua`.

Players buy Wolfden Phone Secure at **Back Room Electronics**, a phone store open at night with no map blip, and its eSIMs at the Ghost Mobile shop, which has no blip either. See [Phone stores](#/docs/wd_phone/devices?section=phone-stores) and [Burner eSIMs](#/docs/wd_phone/sims?section=burner-esims).

## Disappearing data

| What | Default | What happens |
| --- | --- | --- |
| Messages it sends | 24 hours | Erased for everyone, together with any photos or videos in them. A recipient keeps only a copy they saved to their own Gallery |
| Messages it receives | 24 hours | Gone from the Secure, which also loses the photos in them. The sender keeps their copy |
| Call history | 24 hours | Gone from the Secure |
| Photos and videos in its Gallery | 3 days after they were taken | Deleted for good, without going to Recently Deleted |
| Contacts | 7 days after they were last edited | Deleted with their numbers and photos |

Times count from when a message was sent, a call started or a photo was taken. Players see the configured times in Settings → Phone & Messages.

Change them in `Config.SecureRetention` in `config/communication.lua`:

```lua config/communication.lua
Config.SecureRetention = {
    enabled = true,
    messageMinutes = 24 * 60,
    callMinutes = 24 * 60,
    galleryMinutes = 3 * 24 * 60, -- 0 keeps photos and videos
    contactMinutes = 7 * 24 * 60, -- 0 keeps contacts
    sentForEveryone = true,       -- false only hides sent messages on the Secure
    sweepSeconds = 60,
}
```

## Quiet lock screen

A new or erased Wolfden Phone Secure starts with notification previews on **Hide content**: the lock screen shows that something arrived, never who sent it or what it says. Players can still change it in Settings.

The starting mode is `defaultPreviews` on the `nova_secure` model in `config/devices.lua`. It accepts `show_all`, `title_only`, `hide_content` or `hide_all`. Phones that already exist keep the setting they have.

## Burn Phone

**Settings → Security → Hold to burn phone** erases the phone at once. The player holds the button for 3 seconds; letting go early cancels. The phone must be unlocked.

- Every message it sent is erased for everyone, with its photos and videos.
- The phone is wiped like an erase: contacts, photos, calls and settings are gone and it returns to first setup. Its eSIM stays.
- Its Shade handle is retired: its DMs stop and its listings come down.
- With `burn.destroyItem = true`, the phone item is also removed from the player's inventory.

With `sentForEveryone = false` in `Config.SecureRetention`, burning only removes sent messages from the Secure itself.

### Burn PIN

A **Burn PIN** is a second lock-screen PIN that burns the phone instead of unlocking it. Players set it in **Settings → Security → Set Burn PIN**:

- The phone needs a lock-screen PIN first, and the current PIN is asked for to set, change or remove the Burn PIN.
- The Burn PIN has the same number of digits as the real PIN and must be different from it.
- The real PIN can never be changed to the Burn PIN. Changing the PIN to a different length, or turning the PIN off, removes the Burn PIN.

Typed on the lock screen, the Burn PIN burns the phone exactly like Burn Phone.

## Forensic unlock

An on-duty police officer holding a seized, PIN-locked Wolfden Phone Secure can get past its PIN:

1. Open the phone. Under the lock screen keypad, tap **Forensic unlock (90 s)**.
2. Keep the phone open on its lock screen until the timer ends. Closing the phone or tapping **Cancel** stops it.
3. When it finishes, the phone unlocks as if the right PIN had been entered, for whoever holds it.

The server times the unlock and refuses to finish it early. It checks the officer's job, duty and tool item again when it finishes. Each start and finish is recorded in the phone's audit log, which admins read with `phoneadmin audit <deviceId>`.

An admin can also remove a forgotten PIN with `phoneadmin resetpin <deviceId>`, which removes the Burn PIN too. See [Admin tools](#/docs/wd_phone/admin).

A forensic unlock only gets past the PIN. A burned phone, or data that already disappeared, leaves nothing to find.

## New number

A Ghost Mobile eSIM can swap its number for a fresh `777` number in **Settings → Cellular → Carrier → Swap for a new number**.

- It costs 2500, charged like other carrier charges, and each eSIM can swap once every 60 minutes.
- The old number stops working at once. It is held back for 72 hours (`Config.PhoneNumbers.numberReleaseCooldownHours` in `config/carriers.lua`) before anyone else can get it.

Only eSIMs from a secure carrier such as Ghost Mobile can swap.

## Rooms

Rooms are group chats joined with a code instead of a phone number.

- **Create one** in Messages → New Message → **New Room**. The phone shows a code, such as `K7Q-2M9`, to pass on.
- **Join one** in Messages → New Message → **Join Room** by typing the code.
- A code works for 60 minutes. The room's owner and admins see the current code on the room's info page and can make a **New Code**, which replaces the old one.
- A room that nobody writes in for 24 hours disappears for everyone, with all its messages and photos.

Rooms are for Wolfden Phone Secure phones on a Ghost Mobile eSIM. Each number can own up to five rooms at once, and a room holds as many members as a group chat (`Config.Messages.maxGroupMembers`, 25). Joining is limited to six tries a minute so codes cannot be guessed.

## Group calls

A group call is either all Wolfden Phone Secure phones or none. Calling a group conversation from a Secure skips members on other phones, and a Secure cannot be added to, or join, a call with other phones. Ordinary one-to-one calls between any phones work as usual.

## Voice changer

Players can disguise their voice on calls with the Robot, Distorted, Radio or Muffled style, with **Strength** and **Tone** sliders, set in Settings → Phone & Messages or with the Voice button on the call screen. A change mid-call is heard at once, by speakerphone bystanders too.

A disguised call is a **digital line**: the style alone shapes the voice, and weak signal only causes dropouts. Ghost Mobile rarely gets three bars, so this keeps every style clear. To make weak signal sound weak again on disguised calls, set `digitalLine = false` in `Config.Calls.voiceChanger` in `config/communication.lua`; the harsher of signal and style then wins.

## Configure Wolfden Phone Secure

Edit `config/secure.lua`:

| Setting | Default | What it does |
| --- | --- | --- |
| `burn.enabled` | `true` | Offer Burn Phone |
| `burn.destroyItem` | `false` | Also remove the phone item when it burns |
| `duressPin.enabled` | `true` | Let players set a Burn PIN |
| `crack.enabled` | `true` | Allow the forensic unlock |
| `crack.jobs` | `{ 'police' }` | Jobs that can run it |
| `crack.requireOnDuty` | `true` | The officer must be on duty |
| `crack.seconds` | `90` | How long it takes, in seconds |
| `crack.requiredItem` | `nil` | An item the officer must carry, such as `'phone_cracker'`. It is not used up |
| `crack.secureOnly` | `true` | Only Wolfden Phone Secure phones; `false` allows any PIN-locked phone |
| `numberSwap.enabled` | `true` | Offer the number swap |
| `numberSwap.price` | `2500` | What a swap costs |
| `numberSwap.cooldownMinutes` | `60` | Minimum time between swaps on one eSIM |
| `rooms.enabled` | `true` | Offer rooms in Messages |
| `rooms.secureOnly` | `true` | Only Ghost Mobile lines can create or join rooms |
| `rooms.codeLength` | `6` | Characters in a join code (4 to 12) |
| `rooms.codeMinutes` | `60` | How long a join code works |
| `rooms.idleMinutes` | `24 * 60` | Minutes without a message before a room disappears |
| `rooms.maxPerLine` | `5` | Rooms one number can own at once |

The item in `crack.requiredItem` is not included with Wolfden Phone. Add it to your inventory yourself before setting it.