PrivaMesh for Android 0.1 - the first build published for download.
Requires Android 8.0 (API 26) or later. Sideload: Android will ask you to allow
installs from wherever you downloaded it.
What this build is
A release build, minified and shrunk by R8, signed with the PrivaMesh upload key.
Not the debug build that existed before it: that one was marked debuggable, which
would have let adb read the message database off a phone without root.
Because it is signed with the real key, a later release installs over it as an
update. Your account and history survive. That was the other reason not to ship
the debug build - its throwaway key would have forced everyone to uninstall, and
uninstalling destroys history permanently.
What was checked, and on what
Driven through on an Android 15 emulator, on this build:
- first launch, terms, account creation;
- a 12-word BIP-39 phrase generated and its checksum quiz passed;
- force-stop and relaunch, with the account still there.
That matters more than it sounds. R8 rewrites reflection-driven code, and the
parts that use reflection here are the crypto providers, the generated
serializers and the database implementations - so a release build that merely
compiles proves nothing. These paths ran.
What was not checked
- No real device, only the emulator.
- No message has been sent from an Android build on mainnet.
- The app-lock passcode path: the emulator had no screen lock set.
- Adding a contact from an invite link.
Paid tiers do not work yet
The relay verifies Apple receipts and has no Google Play path, so subscriptions
and message packs cannot be bought or recognised on Android. The free tier needs
no receipt and works.
Also missing
https://privamesh.org/i/... invite links open a browser rather than the app
until the site serves a matching assetlinks.json. The privamesh://add scheme
works today.