How TouchFree Works

TouchFree is a free Android 15+ screen touch lock app built on six cooperating components: a WindowManager overlay, an AccessibilityService, a foreground service, a boot receiver, a WorkManager watchdog, and a screen-state receiver for brick safety. This page explains each piece, the permission it needs, and how the whole system stays alive across reboots, screen-offs, and Android version updates.

Architecture at a glance

TouchFree's lock is not a single overlay. It is a defense-in-depth stack where each layer handles one kind of user input:

1. The touchscreen overlay

When you tap Lock, TouchFree asks WindowManager to add a full-screen window with flag TYPE_APPLICATION_OVERLAY. The overlay is transparent, draws nothing, and absorbs every MotionEvent. The app underneath — YouTube, Netflix, any game — keeps receiving power and rendering frames normally because TouchFree only consumes input, not CPU or GPU.

This is the mechanism that lets videos keep playing while the touchscreen is locked. Other lock apps often pause the underlying app or force-close it; TouchFree does neither.

2. AccessibilityService for system inputs

Volume keys, home buttons, and notification-panel dismissal are reserved by Android for apps declared as AccessibilityService. TouchFree declares one — ScreenLockAccessibilityService — that does only input blocking. No content scraping, no text capture, no external communication.

What the AccessibilityService does

• onKeyEvent intercepts KEYCODE_VOLUME_UP and KEYCODE_VOLUME_DOWN and returns true to consume them.
• TYPE_ACCESSIBILITY_OVERLAY strip at the top of the screen blocks notification shade pull-down. GLOBAL_ACTION_DISMISS_NOTIFICATION_SHADE is a fallback for devices that still leak the gesture.
• Edge swipe interception uses a transparent LockScreenActivity layered under the overlay, with OnBackInvokedCallback registered so that Android 15 gesture navigation cannot return to the launcher.

3. Foreground service and watchdog

Android aggressively kills background processes to save battery. To keep the lock reliable, TouchFree runs a Foreground Service with a persistent notification (ForegroundService type: specialUse). A WorkManager watchdog re-checks the service every 15 minutes and relaunches it if the OS killed it.

The persistent notification is silent and shows only minimal text ("TouchFree is ready"). It has no unlock action — lock can only be toggled from the Quick Settings tile, the floating button, or the main app, so notification access cannot bypass PIN security.

4. Brick safety — the most important rule

This is the single rule that sets TouchFree apart from every other touch lock app on Google Play.

TouchFree solves this at the architecture level, not as an afterthought:

Outcome: TouchFree has zero reports of device-bricking in the current build. This is a hard invariant enforced by both code review and project rules — it is documented in the project's CLAUDE.md as "절대 규칙 (absolute rule)".

5. PIN and fingerprint unlock

PIN entry is a dedicated overlay window that collects digits, hashes with SHA-256, and compares against the stored hash. The PIN is 4 or 6 digits, set during first-run. Failed attempts shake the input field; after n failures (configurable 3–18) the PIN field auto-resets to prevent brute-forcing by a child pressing keys.

Fingerprint unlock is optional and routes through BiometricPrompt, Android's official API. TouchFree never sees the biometric data — Android OS handles the match internally and returns only success or failure. Fingerprint is a convenience; PIN is the always-available fallback.

6. Boot persistence

A BroadcastReceiver listens for BOOT_COMPLETED and QUICKBOOT_POWERON (the latter is a HTC/Samsung fast-boot extension). On boot, the receiver restarts the foreground service and re-registers the screen-state receiver so TouchFree is ready the instant the home screen appears.

The boot receiver is declared with android:exported="true" and RECEIVER_EXPORTED at runtime registration, because Android 13+ blocks implicit intents to non-exported receivers. This was a live bug in an earlier build, fixed and documented in the project's TASK log.

7. Permission reference

References

• Android — TYPE_APPLICATION_OVERLAY
• Android — AccessibilityService
• AndroidX — BiometricPrompt
• AndroidX — WorkManager
• Android — Foreground services

Back to TouchFree home, the FAQ, or the comparison with other Android touch lock apps.