Why 0x2ALL is not on the Play Store

Three requirements, each with the Google support page that states it. Nothing here is about intention or about the review process: it is what the policy text says.

1. An organization account

Apps that offer financial products and services — including crypto wallets and trading software — must be registered as an Organization, with legal name, address, D-U-N-S number, organization phone, and a developer phone displayed publicly on the store listing.

Play Store Help: organization account requirements

2. A licence for every country reached

The Financial Services policy requires compliance with the regulation of every country the app reaches, and states that Google must be able to establish the connection between the developer account and the documentation proving the capacity to offer financial products. Those requirements are built for platforms that custody the user's capital: they presume an entity that collects data, identifies customers, keeps records and can be supervised. 0x2ALL holds nobody's funds — no custody, no account, no server — so it has none of that structure. A licence there would first require becoming a custodian: a different product, sold to different customers.

Play Store Help: financial services policy

3. Google re-signs the app

With Play App Signing the developer signs with an upload key; Google removes that signature and re-signs the distributed APK with the app signing key, which it holds and which the developer cannot recover.

Play Store Help: Play App Signing

The developer's identity

An organization account publishes a legal name, an address and a phone. That is what anonymity protects here: the app is not in the Play Store, so the 2% fee is paid onchain — and a blockchain transaction has none of the privacy of a bank account. Anyone able to read it can link the developer to a wallet, locate him and apply pressure. Physical coercion is the attack this protects against.

A licence in every country reached

0x2ALL holds no licence in any jurisdiction and does not claim to hold one. Formal licences in this market are built for platforms that custody user capital: they require KYC, data collection and a supervised entity. Without custody there is nothing to license in that sense — and building that structure would mean becoming a custodian, which this product is not.

Control of the signature

The fingerprint the user compares inside the app would become Google's, not the developer's, and the check would then prove a relationship with the store instead of authorship of the file.

A store badge means someone reviewed the app once, under a policy that changes.

A published fingerprint means the file on your device is exactly the file the developer signed.

For an app that does not move your money, the second check is the one that protects you in practice. The site publishes three artifacts that make the check possible:

• Certificate fingerprint — the same value the app shows under Security.
• SHA-256 of the APK — in version.json.
• The audit prompt and report, with a timestamp proof.

It protects the developer from physical coercion. Because the app is distributed outside the Play Store, the 2% fee is paid onchain: a transaction has no bank secrecy, no branch and no one to freeze it, but it leaves a public record. Whoever can be identified from that record can be located and pressured, and a person who holds signing keys is a target in a way that a repository is not.

It does not protect you, and it does not need to: there is no custody, the keys stay on your device, there is no account and no server. Nothing about your money depends on knowing who wrote the software.

Anonymity is not a security control. The signature and the custody model are.

1. Open the app and go to Security → Authenticity of this app.
2. Compare the value shown there with the fingerprint published on the security page.
3. If they differ, do not import your recovery phrase: uninstall and download the file again.
4. Before installing a file you received, check its SHA-256 against version.json.
5. A shared file whose fingerprint matches is genuine, whoever sent it. That is the reason this page exists: it gives verified sharing a function.

• Play Protect shows a warning during installation, because the app did not come from the store.
• There are no automatic updates: you check the version and the hash yourself.
• There is no store refund mediation. The app is free to install and charges 2% on each deposit, inside the software, under the Terms of Use.
• If the site goes offline, the file you already downloaded is still yours — which is why you verify before, not after.