Google Play release checklist — fernweh

Status of everything needed to publish com.fernweh.remote for free on Google Play. Engineering is release-quality (gates green, license-clean); the items below are the store/publishing gaps. Ordered by what blocks upload first.

1. Data Safety form (Play Console → App content → Data safety)

fernweh collects and transmits nothing (verified in code: no analytics, crash-reporting, or ad SDKs; OCR is on-device; reports are local files; the only outbound call is opening Ko-fi in the external browser). Answer the form as:

  • Does your app collect or share any of the required user data types? → No

  • Data collected → (none)

  • Data shared → (none)

  • Is all data encrypted in transit? → N/A (no data leaves the device)

  • Do you provide a way to request data deletion? → N/A (no data collected)

  • Committed to Play Families policy? → your call; app has no ads/IAP.

the earlier plan allowed opt-in telemetry, but none was ever implemented. Keep it that way and the Data Safety form stays "No / No". If telemetry is ever added, this form and PRIVACY.md must both change before that build ships.

2. Privacy policy — hosted URL (required field in the listing)

  • Policy text is in PRIVACY.md.

  • TODO: fill in the [ADD PUBLIC CONTACT EMAIL] placeholder.

  • TODO: host it at a stable public URL and paste that URL into the Play listing. Easiest option: enable GitLab Pages on the repo, or link to the raw file / a rendered gist. Play requires a resolvable, app-specific URL.

3. Release signing (not the debug key currently in the tree)

The APKs in the repo are debug-signed — Play will reject them.

  • Generate an upload keystore: keytool -genkey -v -keystore fernweh-upload.jks -alias fernweh -keyalg RSA -keysize 2048 -validity 10000

  • Wire it into src-tauri/gen/android/app/build.gradle.kts signing config (or a keystore.properties), keep the keystore out of git.

  • Enroll in Play App Signing (recommended) so Google manages the app signing key and you keep only the upload key.

  • Build an AAB for upload, not an APK: cargo tauri android build --aab (Play requires the Android App Bundle).

4. Versioning

  • Currently version = "0.1.0" in tauri.conf.json and Cargo.toml.

  • Set a real versionName and an integer versionCode (Play requires a unique, monotonically increasing versionCode per upload). Establish the bump policy now (e.g. versionCode = CI build number).

5. Store listing assets

  • App icon (present) · feature graphic 1024×500 (TODO) · phone screenshots (2—​8, TODO) · short + full description (TODO) · category (Tools/Entertainment) · content rating questionnaire (TODO) · contact email.

6. Pre-launch hardware verification (recommended before public release)

These backends compile and pass mock/unit tests but have not completed a live round-trip — verify on real hardware before strangers rely on them:

  • Android TV Remote v2 live pairing handshake (6467 crypto)

  • Fire TV ADB auth path

  • OCR / ML Kit runtime on a real device

  • Android back-gesture capture

V2 (post-launch): ticket / upload backend

Planned for a later versioned update, deliberately not in the first Play release (keeps v1’s Data Safety at No/No and its privacy policy trivially true).

Idea: signed builds of fernweh can open a support "ticket" to report a missing remote and, optionally, contribute a recorded IR profile. Reuses the existing local "Report a missing device" payload — it becomes "…​and optionally send it." (The button is greyed out as "soon" until this ships — ui/src/components/discovery_view.rs, prop:disabled; handler stays wired.)

This transmits user data, so shipping it REQUIRES, in the same build:

  • Update PRIVACY.md and the Data Safety form — it stops being No/No. Map each field to its category: model/notes → Messages/support; IR profiles → App activity / user-generated content; label photo → Photos. Mark it optional and user-initiated / not collected in the background.

Design decisions to make before building:

  • App attestation ("signed apps of mine") — anti-spam so only genuine builds can POST. Options: Play Integrity API (robust, adds a Google dependency — weigh against the local-first ethos) vs. a lighter signing-cert-fingerprint / baked-in key check.

  • IR-profile contributions are a licensing event. To fold submissions back into the shipped DB, require a CC0 / public-domain dedication at submit time — otherwise you reintroduce the license-hygiene problem the CC0 switch just solved (cf. the AGPL saga).

  • Photos: strip EXIF/GPS before upload; consider making the photo the one part that is not sent by default.

What’s already done ✅

  • License-clean for Play: 100% CC0 IR DB, MIT app, root LICENSE + NOTICE.

  • All gates green: fmt, clippy -D warnings, 61 tests, trunk release.

  • No ads, no IAP, no billing → avoids Play billing requirements.

  • No data collection → simplest possible Data Safety declaration.