chore: complete 2026 Play policy checks

[ovitrif]

Context

Google's July 15, 2026 Play policy email asks developers to review several policy updates and, in particular, check the Android Developer Verification page in Play Console. All Play package names must be registered by September 30, 2026 to avoid removal from Google Play. Google also supports registering additional signing keys used to distribute an app outside Google Play.

The forwarded email/PDF is intentionally not attached here. Relevant official guidance:

• Policy deadlines: https://support.google.com/googleplay/android-developer/table/12921780?hl=en
• Target API requirements: https://support.google.com/googleplay/android-developer/answer/11926878?hl=en
• Registering Play package names: https://support.google.com/googleplay/android-developer/answer/16984799?hl=en
• Registering Android package names and additional keys: https://support.google.com/googleplay/android-developer/answer/16761053?hl=en
• Developer-verification rollout and exemptions: https://support.google.com/android-developer-console/answer/16561738?hl=en
• Data Safety definitions: https://support.google.com/googleplay/android-developer/answer/10787469?hl=en

Current audit findings

• app/build.gradle.kts uses compileSdk = 36 and targetSdk = 36, satisfying the August 31, 2026 target-API requirement. This should not require a patch after 2.4.0.
• The production package name is to.bitkit.
• .github/workflows/release.yml signs the production AAB/APK with the release keystore.
• .github/workflows/release-internal.yml builds the same to.bitkit mainnetRelease APK with a separate internal keystore and publishes it as a downloadable GitHub Actions artifact.
• The release key used by .github/workflows/release.yml is also Bitkit's Play app-signing key.
• The merged production manifest does not request READ_CALL_LOG or SMS permissions. Its legacy ACCESS_FINE_LOCATION permission is capped at Android 11/API 30 and is used for legacy Bluetooth discovery; a permission alone does not establish off-device location collection.
• The Data Safety declaration was updated, accepted, and published on July 1, 2026. The submitted email-address answers were: collected, not shared, not ephemeral, optional/user-initiated, used for app functionality, and encrypted in transit. The simplified public store listing is not a reliable substitute for the submitted Play Console answers.
• Google's email describes the location disclosure material as clarification; it does not announce changed enforcement standards.

Required work

1. Android developer and package verification

1. Open Play Console → Android Developer Verification and confirm Synonym's identity verification is complete.
2. Confirm to.bitkit shows Registered. Complete manual registration if it was not auto-registered.
3. Record confirmation in this issue before September 30, 2026.

2. Signing-key inventory and additional keys

1. Compare the SHA-256 certificates for:
   • the shared Play app-signing/release key used by .github/workflows/release.yml;
   • the internal key used by .github/workflows/release-internal.yml.
2. Register the internal certificate as an additional key under to.bitkit. The release-internal APK is distributed outside Play as a downloadable GitHub Actions artifact, so its signer must be registered alongside the shared Play app-signing/release key.
3. Do not expose private keys, credentials, certificate files, or Play's temporary registration snippet.

Adding a key may require generating a proof APK containing Play Console's temporary adi-registration.properties snippet and signing it with the corresponding keystore. The proof APK is for registration only and must not be published as a Bitkit release.

3. Verify the 2.4.0 artifact

After the 2.4.0 AAB is uploaded, confirm Play Console reports target API 36 for that artifact. No SDK-related follow-up release is expected.

4. Confirm Data Safety remains accurate

1. Confirm the accepted July 1 declaration is still the active Play Console declaration.
2. Review Google's newer precise/approximate-location guidance against the shipped app behavior, including the legacy Bluetooth permission and the geoblocking request. Change the declaration only if an actual off-device data flow requires it; do not infer collection from the public listing or permission presence alone.
3. If 2.4.0 exposes new off-device data flows, flag them for product/legal review before changing the declaration. Do not add speculative categories merely because dormant or future-facing code exists.

5. Record applicability of the other email items

Confirm and record that the remaining announced items do not require Bitkit changes unless the shipped behavior differs from the current audit:

• Anonymous/random chat and Families restrictions: not applicable.
• READ_CALL_LOG phone-call account verification restriction: not applicable; the permission is absent.
• Earned Wage Access/personal-loan clarification: not applicable.
• Third-party AI User Data clarification: not applicable unless such an integration is added.
• Unrated-app clarification: no action if the current Play content rating remains active.

Acceptance criteria

• Synonym's Play developer identity is verified.
• to.bitkit shows Registered in Android Developer Verification by September 30, 2026.
• The shared Play app-signing/release and internal certificate fingerprints have been compared without exposing private material.
• The internal certificate is registered under to.bitkit as an additional key.
• Play Console reports target API 36 for the uploaded 2.4.0 artifact.
• The active Data Safety declaration and location-disclosure applicability have been confirmed.
• Applicability of the remaining policy items is recorded.

This is primarily a Play Console administration/verification task. Current findings do not require delaying 2.4.0 or scheduling an SDK-related patch release.