⏱️ Lectura: 11 min
Since late 2023, Google Play has required new developer accounts to test their app with at least 20 real users over 14 consecutive days before the Google Play review lets it move on to production. Daniel Gultsch, creator of the messaging client Conversations, summed up his frustration with that policy in a line posted on his own Mastodon instance: “This is unacceptable.”
📑 En este artículo
- TL;DR
- What happened: Google Play review under scrutiny
- Context and history: from a university thesis to the XMPP reference
- Technical details and performance: how Google Play review works today
- How to try it: publishing to closed testing or bypassing Google Play review with F-Droid
- Impact and analysis: what this means for free software on Android
- What’s next: identity verification across Android
- Frequently Asked Questions
- What is Conversations and who develops it?
- Why does Google Play require 20 testers for 14 days?
- Are there alternatives to Google Play for distributing an Android app?
- Does this problem only affect messaging apps?
- What can a developer do if their app is rejected?
- What is UnifiedPush and why does Conversations use it?
- References
The comment, posted on gultsch.social, isn’t an isolated complaint: it puts on the table a years-long tension between Google and free software developers who depend on the Play Store to reach millions of Android users.
TL;DR
- Daniel Gultsch, creator of Conversations, criticized Google Play’s app review process on Mastodon.
- Conversations is a free XMPP client, the reference implementation for federated messaging on Android.
- Since 2023, Google has required new accounts to run a closed testing track with 20 testers for 14 days before publishing to production.
- Apps that avoid Firebase Cloud Messaging, like Conversations via UnifiedPush, trigger more automated review signals.
- F-Droid remains the path without this requirement for distributing Conversations and other free software apps.
- Starting in 2026, Google is expanding developer identity verification, even for apps distributed outside Google Play.
What happened: Google Play review under scrutiny
Gultsch is a well-known figure in the XMPP community: he has maintained Conversations since 2014 and co-authored several extensions (XEPs) that today define modern messaging over that protocol. When someone with that profile publicly calls an app review process unacceptable, he isn’t speaking as an occasional user, but as someone who regularly ships updates to the Play Store and knows the system from the inside.
What triggered his comment was the treatment an open source messaging app receives from the Google Play review system: automated decisions, little transparency about which specific signal triggered a rejection or delay, and an appeals channel that doesn’t always reverse the outcome in time.
The case illustrates a structural problem, not an isolated incident. Any independent developer publishing a communication app on Android has to live with rules designed, in part, to curb large-scale fraud, but that also create friction for small projects without a dedicated legal team.
Context and history: from a university thesis to the XMPP reference
Conversations was born in 2014 as Daniel Gultsch’s project and, over the years, became the reference implementation of what the community calls “modern XMPP”: end-to-end OMEMO encryption, multimedia messages, calls, and groups, all built on a federated, decentralized protocol like XMPP, with no single company owning the network.
That federated nature clashes from the start with Google Play’s design: the store expects every app to handle its push notifications through Firebase Cloud Messaging, Google’s proprietary service. Gultsch was one of the driving forces behind UnifiedPush, an open standard that allows apps to receive push notifications without depending on Google’s servers, something key for users on devices without Google Play Services, such as GrapheneOS or LineageOS.
That technical decision, sound from a privacy and decentralization standpoint, comes at a cost: apps that don’t use Google’s stack tend to trigger more automated checks during Google Play review, because their background behavior doesn’t follow the pattern Google expects from most apps in the ecosystem.
The XMPP community even documents, through an automated compliance test, how well each client, including Conversations, complies with the protocol’s modern extensions: a rare exercise in transparency compared to the opaque review process used by app stores.
Technical details and performance: how Google Play review works today
The publishing process in Play Console moves through tracks: internal, closed testing, open testing, and production. Since November 2023, Google has required new developer accounts to complete a closed testing track with a minimum of 20 testers who have explicitly opted in, for 14 continuous days, before enabling the move to production.
Every uploaded version first goes through an automated model that analyzes the APK or AAB: requested permissions, use of foreground services, network traffic, and matches against known malware or deceptive behavior patterns. Only if the system detects an ambiguous signal does the case escalate to a human reviewer. That design cuts costs for Google, but it also means a rejection can arrive without a specific explanation of which line of code or which permission triggered the alert.
For messaging apps like Conversations, two specific elements create extra friction: the use of a permanent-connection foregroundServiceType (needed to keep the XMPP session alive) and compliance with the target API level schedule, which forces an annual update to targetSdkVersion or risks the app becoming unavailable for new installs.
| Platform | Prior review | Tester requirement | Suitable for FOSS apps |
|---|---|---|---|
| Google Play | Automated, and manual if risk signals appear | 20 testers for 14 days (new accounts) | Yes, with process friction |
| F-Droid | Manual, over the full source code | Not applicable | Yes, designed for free software |
| Apple App Store | Manual, centralized by Apple | Not applicable, but requires a paid developer account | Limited outside the European Union |
⚠️ Heads up: without 20 active testers for 14 consecutive days, Play Console won’t enable the button to promote a version to production, no matter how many times you retry uploading the same APK.
The review flow, step by step
flowchart TD
A["Developer uploads the AAB"] --> B["Automated review with risk models"]
B --> C{"Risk signals detected?"}
C -- "No" --> D["Published to the chosen track"]
C -- "Yes" --> E["Manual human review"]
E --> F{"Complies with policies?"}
F -- "Yes" --> D
F -- "No" --> G["Rejection or suspension"]
G --> H["Developer appeal"]
H --> EHow to try it: publishing to closed testing or bypassing Google Play review with F-Droid
A developer who wants to reproduce the closed testing flow can automate it with fastlane instead of uploading the binary manually from the web console, which is useful for integrating it into a CI/CD pipeline.
# macOS (Homebrew)
brew install fastlane
# Linux (Debian/Ubuntu)
sudo apt install ruby-full -y
sudo gem install fastlane -NV
# Windows (with Ruby+DevKit installed)
gem install fastlane -NV
# Upload an AAB to the closed testing track
fastlane supply --track closed_testing_alpha --aab app-release.aab --json_key play-store-credentials.json --package_name im.conversations.androidThe command above uploads the binary, attaches the release notes, and leaves the publication ready within the specified track. With the Google Play Developer API you can also check a release’s status without opening a browser:
curl -X GET "https://androidpublisher.googleapis.com/androidpublisher/v3/applications/im.conversations.android/edits/EDIT_ID/tracks/closed_testing_alpha" -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json"The response includes a releases[] array with a status field (draft, inProgress, or completed), useful for checking where each version stands in the track without relying on the web interface.
On the end user side, the alternative to avoid depending on Google Play review at all is to install Conversations from F-Droid:
# 1. Install the F-Droid client from https://f-droid.org/ (signed APK, no Play Store)
# 2. Open F-Droid and search for "Conversations"
# 3. Install; updates arrive through the same repository, without going through Play Console💡 Tip: if your app uses a permanent background service, declare the correctforegroundServiceTypein the manifest (for exampleconnectedDeviceordataSync): it reduces the chance the automated review flags it as suspicious behavior.
Impact and analysis: what this means for free software on Android
The Conversations case isn’t unique. Mastodon clients like Tusky, encrypted messaging apps like Briar, or projects that depend on UnifiedPush face the same pattern: they comply with stricter privacy policies than the Play Store average, but that gives them no advantage against a review system designed, above all, to detect ad fraud and mass malware.
The discussion connects to a broader debate about platform control: in the European Union, the Digital Markets Act forced Apple to allow alternative app stores on iOS. Android, by contrast, has allowed installing APKs outside the store for years, but Google has been adding verification layers (Play Integrity API, developer identity verification) that erode that historical advantage over iOS.
Gultsch’s message also resonates with Latin American developers who are just starting to publish on the Play Store: the learning curve is already steep (binary signing, privacy policies, content rating), and adding a requirement of 20 active testers for 14 days forces launch planning weeks in advance, something many introductory guides don’t mention.
For a developer in Latin America who is just starting to publish on the Play Store, the practical lesson is twofold: first, plan the closed testing track as part of the launch timeline, not counting the subsequent review time; second, don’t rely exclusively on Google Play if the project is free software, because F-Droid offers a distribution path without that bottleneck.
What’s next: identity verification across Android
Google confirmed it will expand its developer identity verification program beyond Google Play: starting in 2026 it begins in pilot markets like Brazil, Indonesia, Singapore, and Thailand, and plans to extend to more countries during 2027. The change will affect even those who distribute apps outside the store, meaning it will also reach the sideloading that projects like F-Droid rely on today, or anyone who downloads an APK directly from GitHub.
For the XMPP ecosystem and for projects like Conversations, that means the friction with Google Play doesn’t disappear by switching distribution channels: it shifts to a new identity requirement that, in practice, requires any developer, whether an individual or a nonprofit organization, to submit official documentation so their software can keep installing on certified Android devices.
Try it yourself: go to f-droid.org, install the F-Droid client, and search for Conversations to see, in minutes, what it feels like to install a messaging app without going through Google Play review.
📖 Summary on Telegram: View summary
Frequently Asked Questions
What is Conversations and who develops it?
It’s a messaging client for Android based on the open XMPP protocol, created in 2014 by Daniel Gultsch and maintained together with that protocol’s community.
Why does Google Play require 20 testers for 14 days?
Google introduced the requirement in 2023 for new developer accounts, aiming to curb fraudulent or low-quality apps before they reach mass production.
Are there alternatives to Google Play for distributing an Android app?
Yes. F-Droid distributes free software reviewed at the source code level, and it’s also possible to install a signed APK directly. That path will face developer identity verification starting in 2026 in some countries.
Does this problem only affect messaging apps?
No. The review process applies to any category, but real-time communication apps tend to trigger more automated signals due to their use of background services and push notifications.
What can a developer do if their app is rejected?
Play Console allows appealing the decision from the program policy panel, though the response time can take several days and doesn’t always reverse the rejection.
What is UnifiedPush and why does Conversations use it?
It’s an open push notification standard that avoids relying on Firebase Cloud Messaging, designed for apps that prioritize privacy and run on devices without Google Play Services.
References
- Mastodon: Daniel Gultsch’s original post about the Google Play review.
- Android Developers, Distribute: Google’s official documentation on tracks and publishing policies in Play Console.
- F-Droid: free software repository for Android, an alternative to Google Play.
- GitHub, siacs/Conversations: source code for the Conversations XMPP client.
- XMPP.org: official site of the federated messaging protocol used by Conversations.
📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de Zulfugar Karimov en Unsplash
0 Comments