Google Play Review

From the first internal build to a production release on Google Play, for an app set up per Setting Up a New App. Play rules change often. When Play Console asks for something not listed here, follow the console.

Phases

Phase	Track	Review	Who can install
1. Internal testing	`internal` (CI prod builds land here)	Light, usually minutes	Up to 100 testers by email list
2. Closed testing (optional)	`alpha` or a custom closed track	Full review on first release	Testers by email list or Google Group
3. Open testing (optional)	`beta`	Full review	Anyone with the link / from the listing
4. Production	`production`	Full review	Everyone in the selected countries

Our account is an organization account, so the "12 testers for 14 days" closed-test rule for new personal accounts doesn't apply. You can promote from internal straight to production.

CI only uploads to internal. Promote a tested build in Play Console → Test and release → Testing → Internal testing → Promote release.

Before the first review

Everything under Monitor and improve → Policy and programs → App content must be complete before Play accepts a release for review outside internal testing.

Declaration	Notes for MobiWeb apps
Privacy policy	Client's URL. Must be reachable and mention the data the app collects.
App access	Required: every app starts behind a login. Give the reviewer demo credentials and any steps (no 2FA, no IP allow-list). Missing or broken credentials are the most common rejection.
Ads	Usually "No".
Content rating	IARC questionnaire. Answer for what the web app contains.
Target audience and content	Usually 18+ for business apps. Picking ages under 13 pulls in the Families policy.
Data safety	Declare what the web app and the shell collect: the shell sends device identifiers to Firebase (Analytics, Crashlytics, FCM token). Add location, camera, contacts, etc. if the web app uses them. Data is encrypted in transit. Say whether users can request deletion.
Government apps, financial features, health	Answer truthfully. Health-related apps (for example unit care) may need the health apps declaration.
Advertising ID	The Firebase Analytics SDK can read it. Declare it, or disable the ID collection before saying "No".

Permission declarations

The manifest requests camera, microphone, location (fine/coarse, foreground only), Bluetooth scan/connect, NFC and notifications. None of these needs a special Play declaration. Some later additions would:

ACCESS_BACKGROUND_LOCATION
READ_MEDIA_IMAGES/READ_MEDIA_VIDEO (photo and video permissions policy; the system photo picker needs none)
USE_FULL_SCREEN_INTENT
exact alarms
foreground service types

Remove permissions the app doesn't use from the app branch's manifest. Unused sensitive permissions invite questions.

Store listing

Grow users → Store presence → Main store listing:

Asset	Requirement
App name	At most 30 characters
Short description	At most 80 characters
Full description	At most 4000 characters, no keyword stuffing or unverifiable claims ("#1", "best")
App icon	512×512 PNG, 32-bit, at most 1 MB
Feature graphic	1024×500 PNG or JPEG
Phone screenshots	2–8, 16:9 or 9:16, each side 320–3840 px
Tablet screenshots	Recommended; required to appear in large-screen featuring
Category, contact email, website	Required / recommended

Review

Submitting: Publishing overview → Send changes for review. Managed publishing lets you hold approved changes and publish them yourself.
Timing: often hours. New apps and policy-sensitive changes can take several days, so plan launches with a week of slack.
Production rollout: use a staged rollout (for example 20%) for updates. You can halt it if Crashlytics shows problems.

Common rejections

Issue	Fix
App access: reviewer couldn't log in	Working demo account, steps in App access, no geo or IP blocks on the web app
Minimum functionality / webview: "app is a website wrapper"	Make sure the listing and the app show native value: push, biometrics, printing, NFC, offline. The app must be published by or for the website's owner.
Data safety mismatch	Declarations must match what the SDKs and the web app actually collect
Broken functionality	Prod web app reachable, no dev URLs in prod builds (`INITIAL_URL`)
Misleading metadata	Screenshots must show the real app

Reply to rejections from the Policy status page. Appeals go through the link in the rejection email.

After launch

Every update goes through review, usually faster than the first one.
The target API level requirement rises yearly (new apps and updates must target a recent Android version, enforced each August). targetSdkVersion lives in android/variables.gradle on main.
Watch Android vitals (ANR and crash rates). High rates reduce visibility.

15 November 2026