Shipping ChatCubie to the Play Store: What Nobody Tells You

Building the app was the part we planned for. Publishing it was the part that kept producing surprises. Here is what actually stood between a finished Flutter app and a listing.

1. The signing key is permanent

Android release builds must be signed, and the keystore you generate is tied to your app forever. Lose it and you cannot publish an update to your own app — you publish a new app and start from zero installs.

Back it up in more than one place before you upload anything. Store the passwords somewhere you will still have access to in three years. This is the single highest-consequence, lowest-effort step in the whole process.

2. Closed testing is not optional any more

New personal developer accounts have to run a closed test before production access unlocks. The requirements, in practice:

• A minimum number of testers who have opted in — being on the email list is not enough, each person must accept the invite
• Fourteen continuous days of the test running
• Testers who actually installed and used the app

The opt-in distinction catches people out constantly. You can have twenty addresses on the list and zero qualifying testers.

3. Account deletion needs a public web page

If your app has accounts, you must provide a publicly reachable URL — reachable without logging in — that explains how to delete an account and what data is removed. We added a /delete-account page to the website. It takes an hour and it is a hard blocker if you skip it.

4. Sign-in configuration will fight you

Google Sign-In on Android needs a client ID tied to your app's package name and the SHA-1 fingerprint of your signing certificate. The catch is that debug builds and release builds have different fingerprints, so sign-in that works perfectly on your machine can fail on the uploaded build.

Register both fingerprints. And when you change something, allow time for it to propagate before concluding it is broken — we lost an evening to a configuration change that was correct and simply had not taken effect yet.

5. The data safety form takes longer than you think

You declare every category of data you collect, why, whether it is shared, and whether it is encrypted in transit. It has to match what the app actually does, and answering honestly means going back through your own code to check. Budget an hour, not five minutes.

The build was the easy half. Compliance, signing and testing took roughly as long as the last feature.

What we would tell someone starting now

1. Generate and back up the release keystore on day one, not on launch day
2. Start recruiting closed testers early — the fourteen days run in parallel with everything else
3. Publish the account deletion page while you are still building
4. Test a real release build on a real device before uploading, not just a debug build
5. Never paste a screenshot containing environment variables anywhere — rotate anything that leaks

ChatCubie is in closed testing now. If you are on Android and want to help, the community is where to sign up.