Publishing obligations
The five things that are yours and not ours — the developer accounts, the licences, being the submitter of record, your own keys and URLs, and a differentiated build.
Five obligations sit with you. None of them can be met by the package, and four of them are checked before a human ever opens your build.
- Developer accounts — organisation enrolment on both stores, with a D-U-N-S number for the entity.
- Licences by country — the named licence for each market you target, recorded in your own attestation console.
- Being the submitter — we never submit, and neither may a reseller.
- Your own keys and URLs — RPC, market data, privacy policy, account deletion.
- Differentiation — Apple 4.2.6, and the build step that refuses a release that is still ours.
- Data safety and privacy — the Play declaration and the iOS privacy answers, traced from what the app actually transmits.
- Proving the server half — the rules are enforced by your backend, so there is one command that checks your install still honours them.
Everything here describes obligations the stores place on operators, as they read at the time of writing. It is not legal advice, and neither store treats a vendor's summary as a defence. Check the current policy text for the markets you are entering, and take the questions in Before you buy to your own counsel.
The order to do them in
Two of these cannot be undone later, so do them first:
- Your bundle identifier. It is fixed after your first release on either store. Choose it before you build anything you intend to keep.
- Your app name. Changing it after launch costs you whatever recognition the listing has built.
Then the accounts (enrolment and verification take days to weeks, and Play's organisation verification is the usual delay), then the licence attestations, then the build.
What the platform does for you
GET /api/user/modulesis the app's only navigation input, so turning a module off on the server removes it from every build, including ones already installed.- The licence attestation console (Admin → System → Attestations) is default-deny: a regulated module reaches nobody until you record a licence for their country. It also emits your Apple storefront list and your Play country targeting list from the same table, so the three cannot drift apart.
- Native responses are shaped: rates, leverage ceilings and projections are removed from anything the app asks for, so a screen cannot render a figure that reads as an earnings promise.
dart run tool/release_preflight.dartrefuses a build that still carries our name, bundle identifier, icon, colours or demo backend.
None of that makes you licensed. It makes the parts we control match what you have told us.