Teko processes health data. This page describes the technical protection measures adopted and the operations the application does not perform.
Data is held on the device, in a database encrypted with AES-256. The key is randomly generated on first launch, using the operating system's cryptographic generator, and kept in the system key store. The key is present neither in the application's code nor in any plaintext file — there is no secret embedded in the installed package.
Exception: the home screen widget runs outside the application and has no access to that key. The summary of the day it displays is written to the widget's own data area, without encryption, and is not sent by Teko to any server. Details in the Privacy Policy.
The backup generated by the user is a file encrypted with AES-256, under a password set by the user and derived with a memory-hard derivation function — designed to make brute-force guessing slow and expensive. The file carries an integrity check, so a tampered package is rejected rather than partially opened. Without the password, it reveals neither its contents nor its structure. Loss of the password entails loss of that backup, with no means of recovery.
All traffic uses HTTPS, and the application itself refuses unencrypted connections. Teko Intelligence messages transit through an intermediate Teko server: the AI provider's access key is held on the server and is not present in the application. The connection to that server is additionally protected by certificate pinning.
Subscriptions are processed by Google Play. The application does not receive and does not handle payment data; what travels is the purchase receipt issued by the store and the fact that the subscription is valid. See Subscription and billing.
The application writes no log file. Recent technical events exist in memory only and pass through an automatic redaction layer that removes personal and health data before any output. In production builds, nothing is written to the system console.
On rooted or jailbroken devices, Teko does not run: a compromised system breaks the isolation between applications and would allow data to be extracted at runtime. Enabling developer mode alone results only in a warning, as it does not expose the application's data.
Teko maintains no account, password or PIN of its own. When the Require unlock on open option is enabled, identity confirmation is delegated to the operating system, through biometrics or the device credential (PIN, pattern or passcode). No authentication secret is created, transmitted or stored by the application. On devices with no system credential configured, the option has no effect, so as not to prevent the user from accessing their own data.
Reports may be sent to tekoappsuporte@gmail.com, with a description and, where possible, steps to reproduce. Reporters are asked not to disclose the vulnerability publicly before a fix is available.