Blocks submissionGoogle Play

The release package is not debuggable

What is checked This rule is decided by code from the built app and the listing: android.built.manifest.

Applies to every app

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• User Data: Be transparent about all user data handling and comply with applicable privacy law; you are responsible for third-party SDKs and AI integrations in the app. Personal and sensitive data (including device location) must be limited to app functionality the user reasonably expects, transmitted with modern cryptography such as HTTPS, requested via runtime permissions, and never sold. Where collection may not be expected (for example background collection), show a prominent in-app disclosure in the normal flow (not only in a policy, not bundled with unrelated text) describing the data and its use, immediately before any consent or runtime permission request; consent must be a clear affirmative action obtained before collection, and backing out or auto-dismissing messages do not count. If Google asks, you must within 2 weeks show evidence that an SDK collecting data by default meets these rules. Persistent device identifiers may not be linked to other personal data or resettable IDs except for telephony or enterprise device management. Every app needs an accurate Data safety section consistent with its privacy policy, and a privacy policy linked in Play Console and in the app, at a public non-PDF URL, labelled as such, naming the developer or app with a contact, and covering data types, sharing, security, retention and deletion. Apps with account creation must offer account deletion in-app and via a web link entered in Play Console, deleting all associated data (freezing does not count), with any retention disclosed. App Set ID may not be used for ads. EU/UK/Swiss personal data from Google must be handled under the Data Privacy Framework terms, with immediate notice to Google if you cannot comply.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google adds the web-link requirement; Apple adds the ban on call/email/support-only flows and explicitly covers auto-created guest accounts. "Freezing does not count" (Google) equals "deactivating is insufficient" (Apple). partial
• Google names transport encryption; Apple says only "appropriate security measures". google-stricter
• Apple requires an on-screen or audible recording indicator; Google requires the disclosure dialog but no live indicator (except for stalkerware under the Malware policy). partial
• Google requires the policy URL to be public, non-PDF and to name the developer with a contact, and bans selling data; Apple requires consent even for anonymous data, requires the policy to confirm third parties give equal protection, and bans making paid features depend on granting data access. partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as google.release-not-debuggable and says what to do, who does it, where, and how it knows.