# Security & Privacy Scorecard ## TeleGuard ## Quick Assessment **5 security concerns requiring attention** TeleGuard markets itself as a highly secure, anonymous messenger, but our analysis uncovered critical cryptographic flaws that undermine its core security promises. The most serious issue allows anyone with a copy of the app to decrypt push notification content for all users worldwide, directly contradicting its stated encryption guarantees. ## What This Means for You **Primary Concern:** Push notification content — including message previews and call alerts — can be decrypted by anyone who downloads the app, because the encryption key is the same for every user and embedded in the app itself. **Risk-Based Impact:** - **High Risk:** Your push notification content (message previews, call alerts) is not protected — any technically capable party with a copy of the app can read it. This is a fundamental flaw in the app's claimed encryption model. - **Medium Risk:** Your message history is stored in an unencrypted database on your device that is automatically backed up to Google Drive. If your Google account is compromised, or if your device is accessed by someone with physical access, your message history may be exposed. - **Low Risk:** Downloading files through the app bypasses some connection security checks. On public WiFi networks, this could allow an attacker to intercept downloaded files. ## Recommendation: Significant Security Concerns Critical cryptographic flaws — hardcoded encryption keys enable decryption of all push notifications, and the unencrypted message database is silently backed up to Google Drive. These issues directly conflict with TeleGuard's stated privacy and zero-knowledge guarantees, making it unsuitable for sensitive communications. **Best For:** Casual users seeking a privacy-focused alternative to mainstream messengers who are primarily concerned with avoiding advertising and tracking — TeleGuard collects no analytics or advertising data. **Avoid If:** You rely on this app for sensitive or confidential communications, or if you need verifiable cryptographic protection for your messages. ## Key Findings ### High Security Risks (2 issues) 1. **Push Notification Encryption Is Universally Broken** ❗ TeleGuard uses the same encryption key — embedded directly in the app — for every user worldwide. Because anyone can download the app and extract this key, anyone can decrypt the content of push notifications sent to any TeleGuard user. **At Risk:** - Message preview content shown in notifications - Incoming call alerts and identifiers - Any information delivered via push notifications 2. **Download Security Checks Disabled App-Wide** ❗ A component responsible for file downloads disables standard connection security verification for the entire app. This means that on a network where an attacker can intercept traffic, files downloaded through the app may be tampered with or replaced. **At Risk:** - Files and media downloaded within the app - Any content fetched over an insecure or compromised network **This applies if:** You use the app's download features on public or untrusted WiFi networks. **For most users:** On your home or work network, exploitation is unlikely. ### Medium Security Risks (3 issues) 1. **Message Database Backed Up to Google Drive Unencrypted** ⚠️ Android's automatic backup feature is not disabled, meaning your message database is silently uploaded to your Google Drive account. The database itself is not encrypted, so anyone who accesses your Google account can potentially read your message history. **Note:** This applies to all users by default. You can reduce this risk by disabling auto-backup for TeleGuard in your Android device settings. 2. **Message History Not Protected on Device** ⚠️ The database storing your messages is not encrypted. On a rooted device — or if someone gains physical access — your full message history, contact associations, and session data could be read directly. **Note:** This vulnerability requires either a rooted device or direct physical device access. Users with standard, unmodified devices are not affected under normal conditions. 3. **Deep Link Handling Accepts Unverified Input** ⚠️ The app can be triggered by other installed apps via notification links without verifying the source. Input values are passed into the app's processing pipeline without sanitization. The practical impact for users depends on how the app's core logic handles such input. ### Low Priority Items (4 issues) 1. **Inconsistent File Sharing Permissions** The app's file-sharing configuration is overly broad, potentially allowing the app to share files from locations beyond what is necessary for messaging. This does not directly expose data but increases the potential impact of other vulnerabilities. 2. **Notification Preferences Stored Without Additional Protection** App configuration data including notification settings is stored in a standard format that could be read on a rooted device. 3. **Legacy Storage Mode Enabled for Older Android Versions** On Android 10 devices, downloaded files may be written to a location accessible by other apps. This has no effect on Android 11 and newer. 4. **Decryption Failures Are Silently Ignored** If the push notification decryption process encounters an error, the failure is not logged or reported. This makes it difficult to detect if something goes wrong or if the app is being actively attacked. ## Privacy Concerns ### What Data is Collected - **Account information:** TeleGuard ID (anonymous number — no phone number or email required) - **Messages:** Message content (processed for delivery) - **Media:** Photos and videos shared within the app - **Device information:** Standard device data required for push notifications - **Contacts:** If you grant permission, the app can read and modify your contacts ### Third-Party Data Sharing **The following third parties may receive your data:** - **Google Firebase** — Push notification delivery only (Firebase Analytics and advertising tracking are explicitly disabled) - **Google Play Billing** — In-app purchase processing No advertising, analytics, or user tracking third parties were identified in this analysis. ## Understanding the Scores **Security:** 61/100 **Privacy:** 85/100 ### Security Breakdown - **Data Security:** 55/100 — Message database is unencrypted and backed up to Google Drive; push notification encryption is fundamentally broken - **Network Security:** 74/100 — Network security configuration is generally sound, but file download component bypasses connection verification - **Code Safety:** 92/100 — App code is well-structured with no significant code-level vulnerabilities ### Privacy Breakdown - **Data Collection:** 98/100 — Minimal data collection; no advertising IDs or analytics - **Data Sharing:** 100/100 — No data shared with advertising or analytics third parties - **User Control:** 90/100 — Strong anonymity model; no account registration required ## Positive Security Features - ✓ Firebase Analytics and advertising tracking are explicitly disabled in the app - ✓ No advertising, tracking, or analytics SDKs present in the app - ✓ No phone number or email required to create an account — strong anonymity model - ✓ App links use verified domain association, preventing other apps from hijacking TeleGuard links - ✓ Voice and video calls use standard DTLS-SRTP media encryption - ✓ Firebase usage is strictly limited to push notification delivery — no broader data collection ## Areas for Improvement ### GDPR / CCPA Compliance The app's privacy practices could be strengthened by: 1. **Disable Automatic Cloud Backup** Explicitly opt out of Android's auto-backup feature to prevent unencrypted message data from being uploaded to Google Drive without user knowledge or consent. 2. **Transparent Data Handling Disclosure** Update the app's data safety declaration to accurately reflect automatic backup behavior and local storage practices. ### Security Enhancements 1. **Encrypt the Local Message Database** Protect stored messages with device-level encryption so that message history is not accessible even if the device is compromised. 2. **Use Per-Installation, Per-Message Encryption Keys** Replace the shared global encryption key and static nonces with keys and values that are unique to each installation and each message. 3. **Scope File Download Security Controls** Apply security verification only to the download component rather than disabling it app-wide. ## Technical Context **App Type:** Encrypted Messenger (Privacy-Focused, Sensitive Communications) **Classes Analyzed:** 5,574 **Third-Party Services:** 10 **Context Tags:** Communication, Sensitive Data, Camera, Contacts, Encrypted Messaging --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy. ### App Details **Developer:** Swisscows AG **Version:** 4.0.9 (versionCode 175) **Analysis Date:** April 3, 2026 **Package:** ch.swisscows.messenger.teleguardapp ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 4.0.9 analyzed on April 3, 2026 - May not reflect server-side security controls - Cannot detect all runtime behaviors For questions about this analysis, contact hi@canitrustthat.com.