@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/skills/shared/external/play-store-review/SKILL.md

@@ -0,0 +1,350 @@
+---
+name: play-store-review
+description: "Prepare Android apps for Google Play Store review and compliance. Covers Google Play policy requirements, content rating questionnaire, target API level requirements, data safety section, privacy policy requirements, in-app purchase policies, common rejection reasons, app signing with Play App Signing, and AAB upload. Use when preparing for Play Store submission, handling policy violations, or auditing app compliance."
+---
+
+# Google Play Store Review
+
+Policy compliance, submission requirements, and common rejection reasons
+for Google Play Store. Covers 2024-2025 requirements including target API
+levels, data safety declarations, and policy changes.
+
+## Contents
+
+- [Pre-Submission Checklist](#pre-submission-checklist)
+- [Target API Level Requirements](#target-api-level-requirements)
+- [Data Safety Section](#data-safety-section)
+- [Privacy Policy](#privacy-policy)
+- [Content Rating](#content-rating)
+- [In-App Purchase Policies](#in-app-purchase-policies)
+- [App Signing and Upload](#app-signing-and-upload)
+- [Common Rejection Reasons](#common-rejection-reasons)
+- [Policy Categories](#policy-categories)
+- [Do's and Don'ts](#dos-and-donts)
+- [Troubleshooting](#troubleshooting)
+- [Post-Submission Checklist](#post-submission-checklist)
+
+## Pre-Submission Checklist
+
+- [ ] App targets required API level (currently 34+)
+- [ ] Data safety form completed in Play Console
+- [ ] Privacy policy URL is accessible and accurate
+- [ ] Content rating questionnaire completed
+- [ ] App tested on multiple devices and API levels
+- [ ] No placeholder content, test data, or debug features
+- [ ] Store listing complete: title, description, screenshots, feature graphic
+- [ ] App signed with Play App Signing
+- [ ] AAB (not APK) uploaded
+- [ ] In-app purchases tested with test accounts
+- [ ] Permissions justified and minimal
+- [ ] Ads SDK integrated only if declared in store listing
+- [ ] No deceptive design patterns
+
+## Target API Level Requirements
+
+Google Play enforces minimum `targetSdkVersion` for new and updated apps.
+
+| Year | New Apps | Updates | Wear OS |
+|------|----------|---------|---------|
+| 2024 | API 34 (Android 14) | API 34 | API 33 |
+| 2025 | API 35 (Android 15) | API 35 | API 34 |
+
+```kotlin
+android {
+    defaultConfig {
+        targetSdk = 35  // Must meet current year's requirement
+        minSdk = 26     // Minimum supported (your choice)
+    }
+}
+```
+
+### API Level Behavior Changes to Handle
+
+| API Level | Key Change | Action Required |
+|-----------|-----------|-----------------|
+| 33 | POST_NOTIFICATIONS permission | Request at runtime before sending notifications |
+| 33 | Photo picker | Use PhotoPicker instead of READ_MEDIA_IMAGES for picking |
+| 34 | Foreground service types | Declare `android:foregroundServiceType` in manifest |
+| 34 | Partial photo/video access | Handle `READ_MEDIA_VISUAL_USER_SELECTED` |
+| 35 | Edge-to-edge enforced | Handle insets properly; no opt-out |
+| 35 | Predictive back enforced | Implement back navigation with animations |
+
+## Data Safety Section
+
+The Data Safety section in Play Console declares what data your app collects,
+shares, and how it is handled. It is required for all apps.
+
+### Declaration Categories
+
+| Category | Examples | Required Info |
+|----------|----------|--------------|
+| Personal info | Name, email, phone, address | Collection purpose, sharing, optional/required |
+| Financial info | Payment info, purchase history | Encryption status |
+| Location | Approximate, precise | Collection purpose |
+| App activity | Page views, taps, search history | Sharing with third parties |
+| Device/identifiers | Device ID, advertising ID | Retention policy |
+| Photos/videos | Photos, videos | Whether stored on server |
+
+### Key Questions
+
+1. **Does your app collect data?** If yes, which types
+2. **Is data encrypted in transit?** (Should always be yes -- use HTTPS)
+3. **Can users request data deletion?** Required if you store user data
+4. **Is data shared with third parties?** Including analytics, ads, crash reporting SDKs
+5. **Is data collection optional or required?**
+
+### Common SDK Data Collection
+
+| SDK | Data Collected | Declare As |
+|-----|---------------|------------|
+| Firebase Analytics | Device ID, app activity | App activity, device identifiers |
+| Firebase Crashlytics | Crash logs, device info | App info, device identifiers |
+| Google Ads / AdMob | Advertising ID, location | Device identifiers, location |
+| Google Maps | Location | Location (precise) |
+| Facebook SDK | Device ID, app events | Device identifiers, app activity |
+
+You must declare data collected by ALL SDKs in your app, not just your own code.
+
+## Privacy Policy
+
+### Requirements
+
+- Must be accessible via a valid URL (not a document, not behind a login)
+- Must be linked in Play Console AND within the app
+- Must describe:
+  - What data is collected
+  - How data is used
+  - How data is shared
+  - How users can request deletion
+  - Contact information
+- Must be specific to your app (not a generic template)
+- Required for ALL apps (not just apps collecting personal data)
+
+### In-App Privacy Policy
+
+```kotlin
+@Composable
+fun SettingsScreen() {
+    // Include privacy policy link in settings
+    TextButton(
+        onClick = {
+            val intent = Intent(Intent.ACTION_VIEW, Uri.parse("https://example.com/privacy"))
+            context.startActivity(intent)
+        },
+    ) {
+        Text("Privacy Policy")
+    }
+}
+```
+
+## Content Rating
+
+Complete the IARC content rating questionnaire in Play Console. Answer
+honestly -- incorrect ratings lead to app removal.
+
+### Rating Categories
+
+| Rating | Description |
+|--------|-------------|
+| Everyone | No objectionable content |
+| Everyone 10+ | Mild fantasy violence, mild language |
+| Teen | Moderate violence, infrequent mature themes |
+| Mature 17+ | Intense violence, sexual content, gambling |
+
+### Questions Cover
+
+- Violence and fear
+- Sexuality and nudity
+- Language
+- Controlled substances
+- Gambling
+- User interaction (UGC, communication)
+- Location sharing
+- Data collection from children
+
+If your app allows user-generated content, you must answer UGC questions
+even if your app itself has no objectionable content.
+
+## In-App Purchase Policies
+
+### Google Play Billing Library
+
+Apps distributed on Google Play must use Google Play Billing for digital goods:
+
+```kotlin
+// Required for digital content purchases
+implementation("com.android.billingclient:billing-ktx:7.1.1")
+```
+
+### What Requires Play Billing
+
+| Type | Requires Play Billing | Alternative Allowed |
+|------|----------------------|---------------------|
+| Premium features | Yes | No |
+| Subscriptions (digital) | Yes | No |
+| Virtual currencies | Yes | No |
+| Game items / loot boxes | Yes | No |
+| Physical goods | No | External payment |
+| Person-to-person services | No | External payment |
+| Content consumed outside app | Depends | EEA/user-choice billing |
+
+### Subscription Requirements
+
+- Clear pricing before purchase
+- Free trial terms clearly stated
+- Easy cancellation path
+- Grace period and account hold handling
+- Subscription must provide ongoing value
+
+### Loot Box Disclosure
+
+If your app sells randomized items (loot boxes), you must disclose the odds
+of receiving each item type before purchase.
+
+## App Signing and Upload
+
+### Play App Signing (Required for New Apps)
+
+Google manages your app signing key. You upload with an upload key.
+
+```bash
+# Generate upload key
+keytool -genkeypair -v -keystore upload-keystore.jks \
+    -keyalg RSA -keysize 2048 -validity 10000 \
+    -alias upload-key
+
+# Build AAB (not APK)
+./gradlew bundleRelease
+```
+
+### AAB Requirements
+
+- New apps must upload AAB (Android App Bundle), not APK
+- Maximum download size: 200 MB (on-demand delivery for larger)
+- Use Play Feature Delivery for conditional/on-demand modules
+
+### Signing Config
+
+```kotlin
+android {
+    signingConfigs {
+        create("release") {
+            storeFile = file(System.getenv("UPLOAD_KEYSTORE_PATH") ?: "upload.jks")
+            storePassword = System.getenv("UPLOAD_KEYSTORE_PASSWORD") ?: ""
+            keyAlias = System.getenv("UPLOAD_KEY_ALIAS") ?: ""
+            keyPassword = System.getenv("UPLOAD_KEY_PASSWORD") ?: ""
+        }
+    }
+    buildTypes {
+        release {
+            signingConfig = signingConfigs.getByName("release")
+        }
+    }
+}
+```
+
+## Common Rejection Reasons
+
+| # | Reason | Fix |
+|---|--------|-----|
+| 1 | **Crashes or ANRs** | Test on target API levels; fix ANRs with StrictMode and background processing |
+| 2 | **Broken functionality** | Test all features end-to-end before submission |
+| 3 | **Missing privacy policy** | Add URL in Play Console and in-app settings |
+| 4 | **Incomplete data safety** | Declare ALL data collected, including by third-party SDKs |
+| 5 | **Deceptive behavior** | App must do what description says; no hidden functionality |
+| 6 | **Intellectual property** | No unauthorized use of trademarks, brands, or copyrighted content |
+| 7 | **Misleading metadata** | Screenshots must show actual app; no fake reviews/ratings |
+| 8 | **Restricted permissions** | Only request permissions needed for core functionality |
+| 9 | **Background location** | Requires approved use case and prominent disclosure |
+| 10 | **Foreground service misuse** | Declare correct `foregroundServiceType`; no workarounds |
+| 11 | **API level too low** | Update `targetSdkVersion` to current requirement |
+| 12 | **Missing ad disclosure** | Declare ad-supported in store listing if app contains ads |
+| 13 | **Families policy violation** | If targeting children, comply with COPPA/Families Policy |
+| 14 | **Account deletion missing** | If app has account creation, must offer account deletion |
+
+## Policy Categories
+
+### Restricted Content
+
+- No hate speech, violence, or terrorism
+- No sexually explicit content (except in apps with IARC rating)
+- No gambling without proper licensing
+- No marijuana or pharmaceutical sales
+- No weapons or dangerous products
+
+### Privacy and Security
+
+- Data collected must match Data Safety declaration
+- Sensitive permissions require justification
+- Background location requires approval
+- QUERY_ALL_PACKAGES requires approved use case
+- Apps targeting children must comply with COPPA
+
+### Monetization
+
+- No deceptive subscription flows
+- In-app purchase prices must be clear before purchase
+- Free trials must state duration and post-trial price
+- Refund policy must be accessible
+
+### User-Generated Content
+
+Apps with UGC must include:
+- Content moderation
+- Reporting mechanism
+- User blocking
+- Published content policy
+
+### Account Deletion
+
+If your app allows account creation, you must:
+- Offer account deletion within the app
+- Provide a web-based deletion option
+- Delete data within 60 days of request (or explain legal retention)
+
+## Do's and Don'ts
+
+### Do's
+- Test on the required target API level before submission
+- Complete the data safety form accurately, including third-party SDKs
+- Provide a working privacy policy URL
+- Use Play App Signing for new apps
+- Upload AAB format
+- Handle all new API behavior changes (permissions, edge-to-edge, etc.)
+- Offer account deletion if account creation exists
+- Disclose ads in store listing if app contains ads
+
+### Don'ts
+- Do not submit apps with crashes, ANRs, or broken features
+- Do not use misleading screenshots or metadata
+- Do not request permissions your app does not need
+- Do not use background location without Google-approved use case
+- Do not bypass Play Billing for digital goods
+- Do not collect children's data without COPPA compliance
+- Do not ship apps targeting an API level below the current year's requirement
+- Do not use QUERY_ALL_PACKAGES without approved justification
+- Do not hardcode test account credentials in the app
+
+## Troubleshooting
+
+| Problem | Cause | Fix |
+|---------|-------|-----|
+| Rejection for API level | `targetSdkVersion` below requirement | Update to current year's required API level |
+| Data safety form mismatch | SDK collects data not declared | Audit all SDKs; update data safety form |
+| Privacy policy rejected | URL broken, generic, or behind login | Fix URL; make policy app-specific and accessible |
+| Content rating mismatch | Incorrect questionnaire answers | Redo IARC questionnaire honestly |
+| App not published after review | Missing required fields in store listing | Complete all required fields: screenshots, description, etc. |
+| App removed for policy violation | Repeat violations or serious breach | Appeal via Play Console; fix violations promptly |
+| Upload fails | APK instead of AAB, or signing mismatch | Use AAB; verify upload key matches Play Console |
+| In-app purchases rejected | Not using Play Billing for digital goods | Migrate to Google Play Billing Library |
+
+## Post-Submission Checklist
+
+- [ ] Monitor review status in Play Console
+- [ ] Check pre-launch report (automated testing results)
+- [ ] Verify app appears correctly in Play Store (listing, screenshots)
+- [ ] Test in-app purchases with real transactions
+- [ ] Monitor crash rate via Play Console vitals
+- [ ] Monitor ANR rate (target < 0.47%)
+- [ ] Respond to user reviews promptly
+- [ ] Set up staged rollout for production releases (10% -> 50% -> 100%)