Mobile App — Publishing & Store Compliance

Release builds for Google Play and the Apple App Store, plus the compliance items both stores require. The full working checklist lives in Chat-Agent-App/docs/STORE_COMPLIANCE.md — this page is the summary.

Before you build

• Set a stable applicationId / bundle id (e.g. com.spagreen.whatsmine.chat) — never change it after first publish.
• Bump version: x.y.z+build in pubspec.yaml for every store upload.
• Point the server URL and legal links at production (Configuration).
• Generate app icons & splash (flutter_launcher_icons, flutter_native_splash).

Build — Android (Play)

flutter build appbundle --release

• Ship an Android App Bundle (.aab) signed with an upload key / Play App Signing.
• Ensure INTERNET and POST_NOTIFICATIONS are in the main manifest (they are, in platform/android/AndroidManifest.xml) — the Flutter default only adds INTERNET to the debug manifest.
• Confirm targetSdkVersion meets the current Play requirement (android/app/build.gradle.kts).

Build — iOS (App Store)

flutter build ipa --release

• Open ios/Runner.xcworkspace in Xcode to set the bundle id, signing team, and upload via the Organizer / xcrun altool.
• Confirm PrivacyInfo.xcprivacy is in the Runner target's Copy Bundle Resources (see Setup — the one manual iOS step).
• Keep App Transport Security at defaults (HTTPS only) — do not ship NSAllowsArbitraryLoads = true.

Store compliance summary

Handled in-app already:

• Account deletion path (Apple 5.1.1(v) / Play data deletion): Settings → Account & data → Request account deletion.
• Privacy strings for camera/photos/mic + an iOS privacy manifest.
• HTTPS-only networking; the token lives in secure storage and is cleared on sign-out.
• No tracking, no ads, no third-party analytics SDKs.

You must still:

• Play Data safety form — declare: email + password sent to your server to authenticate, message content transmitted; encrypted in transit; not shared with third parties / not for ads. Add the deletion URL to the listing's "Data deletion" field.
• Apple App Privacy — declare Contact Info (email) + User Content (messages) used for App Functionality; Tracking = No.
• Host reachable privacy policy + terms URLs (template: Chat-Agent-App/docs/PRIVACY_POLICY_TEMPLATE.md).
• Give reviewers a working demo login + server URL in the review notes (e.g. https://whatsmine-demo.spagreen.net, client@spagreen.net / 12345678). Without it, reviewers can't test.
• Use fictional demo data in store screenshots (no real customer PII).

Push notifications

The app shows local alerts for incoming messages while running (best-effort). True background remote push (FCM/APNs) needs per-deployment Firebase/APNs credentials and a server push pipeline, so it is intentionally not bundled.

To add it:

1. Integrate firebase_messaging (Android/iOS) and register for APNs.
2. Send the device token to your backend on login.
3. Trigger pushes from the WhatsMine message pipeline when a new inbound message arrives for the assigned agent.

See Integrations → Real-time & Push for the server side.

Troubleshooting