ADR-0010: Donate link without Play Billing

We want to accept donations without ads or tracking, and without breaching either Google Play’s Payments policy or the app’s LAN-only pledge.

Under Google Play’s Payments policy, a donation that returns no digital goods or services does not require Play Billing. Gating any functionality behind a donation link would flip that condition and force Play Billing. It would also make "No ads. No tracking. Ever." a lie by omission.

The project’s founding pledge is explicit: "no network calls except to TVs on the LAN".

The URL lives in Rust, not the frontend. donate::open_donate takes no parameters and opens the one hardcoded https://ko-fi.com/stoffelcpr. The webview is granted no opener (or shell) permission in capabilities/default.json, so it cannot open a link of its own choosing — it can only ask for this page by name. Giving the command a url: String argument would hand the webview a general-purpose link opener and quietly undo the "commands only, no ambient capability" design; don’t.

tauri-plugin-opener (v2), called from Rust. Permissions gate the plugin’s IPC commands, so invoking it from our own command needs no capability grant. On Android it fires an ACTION_VIEW intent, so Ko-fi opens in the user’s browser instead of navigating the webview away from the app (which would strand them with no back affordance).

Donations unlock nothing — no features, no ad removal (there are no ads), no content, no thank-you tier.

Styled as a quiet outline, not the accent fill used by primary actions, and captioned "Entirely optional. Nothing is locked." It sits in Settings only — never on the remote, never as a modal, never on launch. An ad-free remote that nags for money has just reinvented the thing it replaced.

Because donations unlock nothing — no features, no ad removal, no content, no thank-you tier — this is exactly the condition under which Google Play’s Payments policy does not require Play Billing (a donation that returns no digital goods or services). Gating any functionality behind the link would flip that and force Play Billing.

This does not breach the LAN-only pledge. The app makes no request to ko-fi.com; it hands a URL to the browser and forgets it. No network client, no phone-home, nothing to log. The pledge of "no network calls except to TVs on the LAN" still holds literally and in spirit.