Building the app was the part we planned for. Publishing it was the part that kept producing surprises. Here is what actually stood between a finished Flutter app and a listing.
1. The signing key is permanent
Android release builds must be signed, and the keystore you generate is tied to your app forever. Lose it and you cannot publish an update to your own app — you publish a new app and start from zero installs.
Back it up in more than one place before you upload anything. Store the passwords somewhere you will still have access to in three years. This is the single highest-consequence, lowest-effort step in the whole process.
2. Closed testing is not optional any more
A new personal developer account has to run a closed test before production access unlocks. Google reduced the bar from twenty testers to twelve, but the shape of the rule has not changed. In practice it means:
- Twelve testers who have opted in. Being on the email list is not enough — each person must accept the invite
- Fourteen continuous days with those testers still opted in. People who drop out part-way through are the usual reason a run that looked finished is not accepted
- Testers who actually installed and used the app. An accepted invite with no install does not count for much
The opt-in distinction catches people out constantly. You can have twenty addresses on the list and zero qualifying testers.
3. Account deletion needs a public web page
If your app has accounts, you must provide a publicly reachable URL — reachable without logging in — that explains how to delete an account and what data is removed. We added a /delete-account page to the website. It takes an hour and it is a hard blocker if you skip it.
4. Sign-in configuration will fight you
Google Sign-In on Android needs a client ID tied to your app's package name and the SHA-1 fingerprint of your signing certificate. The catch is that debug builds and release builds have different fingerprints, so sign-in that works perfectly on your machine can fail on the uploaded build.
Register both fingerprints. And when you change something, allow time for it to propagate before concluding it is broken — we lost an evening to a configuration change that was correct and simply had not taken effect yet.
5. The data safety form takes longer than you think
You declare every category of data you collect, why, whether it is shared, and whether it is encrypted in transit. It has to match what the app actually does, and answering honestly means going back through your own code to check. Budget an hour, not five minutes.
The build was the easy half. Compliance, signing and testing took roughly as long as the last feature.
What we would tell someone starting now
- Generate and back up the release keystore on day one, not on launch day
- Start recruiting closed testers early — the fourteen days run in parallel with everything else
- Publish the account deletion page while you are still building
- Test a real release build on a real device before uploading, not just a debug build
- Never paste a screenshot containing environment variables anywhere — rotate anything that leaks
Questions people ask about the twelve-tester rule
How many testers does Google Play actually require?
Twelve, on a personal developer account. It was twenty when the requirement was introduced and has since been reduced. Organisation accounts are not held to the same closed-testing requirement.
Do the fourteen days have to be continuous?
Yes. It is fourteen continuous days of the closed test running with your testers opted in — not fourteen days added up across several attempts.
Can I keep uploading builds during the test?
Yes, and you should. Shipping fixes during the run is normal. What matters is that the test stays live and installable for the whole window.
What happens after the fourteen days?
You apply for production access and answer a short set of questions about the testing you ran. That review is not instant, so leave room for it in any date you have promised somebody.
Why does the app get rejected after a test that looked complete?
Almost always tester count. Invites that were never accepted, or testers who opted out somewhere in the fortnight, leave you below twelve without any obvious signal that it happened.
I wrote this after taking ChatCubie through the process myself. If you are in the middle of it and something here does not match what you are seeing, tell me — the rules have moved twice already and I would rather this stayed accurate.
Postscript: the app in this account was Flutter at the time. v2 has since been rewritten natively — Kotlin on Android, Swift on iOS — but none of the requirements above changed with it. They are about the account and the listing, not the framework.
Top comments (0)