CRT
84ef94253c
Play rules verified against the live Policy Center / Play Console Help pages (checked 2026-10-11, cited in cli/lib/scan/play-rules.ts): restricted permissions and their declarations (background location, photo / video, All files access, AccessibilityService, REQUEST_INSTALL_PACKAGES, Health Connect, full-screen intent, VpnService), prominent disclosure and the in-app privacy policy, Data safety vs SDK disclosures, Families (certified ad SDKs, AD_ID, location), AD_ID on targetSdk 33+, 16 KB page sizes (Unity, React Native, NDK, AGP, prebuilt .so), testing for new personal accounts, Play metadata, ads at launch, payments outside Play Billing, impersonation. Detection reads manifest components, accessibility configs, strings.xml, native toolchain versions and a local build's merged manifest. New fixtures and tests; README table per store.
9 lines
766 B
Markdown
9 lines
766 B
Markdown
# clean fixture
|
|
|
|
A made-up iOS + Android notes app that does everything right, so `storebound scan` must report no open finding:
|
|
Sign in with Apple next to Google, in-app account deletion, Restore Purchases and subscription management, the ATT
|
|
string and prompt, specific purpose strings, a privacy manifest, export compliance answered, targetSdk 36, and Data
|
|
safety answers that cover every detected SDK. On Android: a location disclosure string, an interstitial that is only
|
|
preloaded at launch, NDK r28 and AGP 8.7.3 for its C++ code, a teen-and-adult target audience with a certified ad SDK,
|
|
an organization developer account and a plain Play title. Tests set the App Review demo account through REVIEW_DEMO_USER /
|
|
REVIEW_DEMO_PASSWORD. Not a buildable project.
|