Google Play accepts HTML apps, and an HTML app whose content is bundled inside it passes the store's rules more easily than a live-URL wrapper does. What Play requires from every app: a developer account ($25 once), an App Bundle rather than an APK, a set of listing assets, a privacy policy URL, a Data safety declaration, a content rating questionnaire, a target API level from the current year, and — for apps that show web content — enough functionality that it is not merely a bookmark. Each item is small; the list is long, so here it is in order.
Before Play Console
1. A developer account
play.google.com/console, a one-time $25 fee, identity verification (ID document for individuals, D-U-N-S number for organisations). Personal accounts created since late 2023 must also run a closed test with 12 testers for 14 days before the first production release — plan for it.
2. Your own signing key (recommended)
Generate a keystore and upload it in the builder on Pro, so the upload key is yours. Enrol in Play App Signing when Console offers it: Google then holds the app-signing key and can reset your upload key if you lose it.
3. An AAB build
New apps must be uploaded as an Android App Bundle, not an APK. Build with the AAB option (Pro). Version code 1 for the first upload; every later upload must be higher.
Listing assets
| Asset | Spec | Notes |
|---|---|---|
| App icon | 512×512 PNG, 32-bit, under 1 MB | Padded, on a solid background.
Square Icon PadderTurn a wide logo or a tight crop into a padded 512×512 launcher icon
Open the tool
|
| Feature graphic | 1024×500 PNG or JPG | Required. Shown at the top of the listing on some surfaces. |
| Phone screenshots | 2–8, 16:9 or 9:16, each side 320–3840 px | Real screenshots of the app; no device frames required. |
| Short description | 80 characters | What it does, plainly. |
| Full description | 4,000 characters | No keyword stuffing, no mention of competitors, no "best". |
| App category, contact email | — | The email is public on the listing. |
App content declarations
- Privacy policy URL. Required for every app, including one that collects nothing. The policy must be hosted at a public URL and must match what the app does. App Privacy Policy GeneratorA privacy policy for an HTML app, written from what your app actually does Open the tool
- Data safety. The form that becomes the "Data safety" card on your listing. An offline HTML app with no analytics answers "No" to collection and is done; anything with analytics, ads, accounts or push declares each data type. Data Safety Form HelperWork out what to declare in Google Play's Data safety section for a WebView app Open the tool
- Content rating. A questionnaire (IARC) about violence, language, gambling and user interaction. An educational or utility app takes two minutes and gets "Everyone".
- Target audience and content. Whether the app is for children. If it is, the Families policy applies — stricter, and worth reading first.
- Ads. Declare whether the app contains ads. The answer must match the APK.
- News, government, financial, health apps have extra declarations. A quiz app does not.
The policies that catch HTML apps
Minimum functionality
Play rejects apps that are "a webview of a website with no added functionality". An app whose content is bundled — an offline quiz, a reference, a game — is not that; it is an app that happens to be written in HTML. A live-URL wrapper is exactly that unless it adds something: push notifications, native tabs, offline content, a splash-and-onboarding flow. If your app loads a URL, add at least one of those (all Pro) and mention it in the description.
Repetitive content and impersonation
Do not publish the same HTML under several names, and do not wrap a website you do not own. Both are removals, not rejections.
Target API level
New apps must target an API level within one year of the current Android release. The builder's shell targets the current level; you do not need to do anything, but if you built a year ago, rebuild before uploading.
Permissions
Only declare what the page uses. A camera permission on an app with no camera feature is a review question, and sometimes a rejection.
Testing tracks and review
- Upload the AAB to internal testing first — instant, up to 100 testers, no review. Install it from the Play link on a real phone.
- Personal accounts: run the required closed test (12 testers, 14 days), then apply for production access.
- Submit to production. Review takes from hours to a week; first submissions take longer. Rejections come with the policy named — fix, and resubmit.
After publishing
Every update needs a higher version code, the same package name and the same signing key (the versioning guide). Keep the privacy policy and Data safety form in step with the app when you add analytics, push or a permission. And keep the keystore backed up: it is the one file that cannot be replaced.