Your Android app is built, tested and signed off. Then the launch slips by two weeks because Play Console asks for a privacy policy nobody wrote, a data safety form nobody understands, or a demo login the reviewer cannot use. Most publishing delays come from paperwork and policy, not from code.
This checklist walks through what Google Play needs before your first release: the developer account, the app bundle and signing, the store listing, the policy declarations, the testing tracks and a safe rollout. Store rules change often, so use it as a planning guide and confirm the current requirements in Play Console before you submit.
Quick answer: To publish an app on Google Play, open a Play Console developer account in your organisation's name, upload a signed Android App Bundle, complete the store listing, privacy policy, data safety form, content rating and other declarations, test through internal or closed tracks, then submit for review and release in stages. Leave time for identity verification and review.
Step 1: Open the right developer account
Google Play offers personal and organisation developer accounts. A business should almost always use an organisation account, created in the company's legal name with an official email address that will outlive any single employee.
- Organisation details: Google asks organisation accounts for a D-U-N-S number. Check whether your company already has one, and that the legal name and address match your registration documents.
- Identity verification: Google verifies the developer's identity and contact details. This can take days, so start it while the app is still being built.
- Ownership: Create the account under your company, not your agency, and add your developer as a user with limited permissions. Whoever owns the account effectively owns your listing, reviews and users.
- Registration fee: There is a one-time registration fee. Check the current amount on the Play Console sign-up page.
- Testing rule for new accounts: Newly created personal accounts must run a closed test with a minimum number of testers for a set period before they can publish to production. This has applied to personal accounts, not organisation accounts, which is one more reason to register as a business. Confirm the current rule in Play Console Help.
Step 2: Prepare the build Google expects
- Android App Bundle: New apps are uploaded as an Android App Bundle (.aab), not an APK. Google Play generates optimised installs for each device from it.
- Play App Signing: Google holds the app signing key and you keep an upload key. Store the upload key and its password in a vault your company controls, not on one developer's laptop.
- Target API level: Google Play requires new apps and updates to target a recent Android API level, and the requirement moves up every year. Apps that fall too far behind can stop being offered to new users on newer Android versions.
- Version code: Every upload needs a higher version code than the last one. Agree a versioning scheme with your developer early.
- Permissions: Remove any permission the app does not need. Sensitive permissions such as SMS, call log, background location and all-files access need a declaration and a clear core use, and are a common cause of rejection.
Step 3: Complete the store listing and policy forms
This is where most first-time publishers lose time, and it is the part of Android app development projects most often left to the last week. Prepare these items in a shared document before you open Play Console.
| Item | What to prepare |
|---|---|
| App name and short description | A clear name and a one-line summary within Play's character limits, without keyword stuffing or ranking claims. |
| Full description | What the app does, who it is for and its main features, written for users rather than for search. |
| Graphics | App icon, feature graphic and phone screenshots of the real app; tablet screenshots if you support tablets. |
| Privacy policy | A public page on your own domain that matches what the app and its SDKs actually collect. |
| Data safety form | Which data types are collected or shared, why, whether data is encrypted in transit and whether users can ask for deletion. |
| Account deletion | If users can create an account, a way to request deletion of the account and data inside the app and through a web link. |
| Content rating | Accurate answers to the rating questionnaire, including chat, user content and purchases. |
| Target audience | The age groups the app is meant for. Apps aimed at children face extra rules. |
| App access | Test login details and steps so the reviewer can reach every screen. |
| Ads and other declarations | Whether the app shows ads, plus declarations for financial, health, government or news features where relevant. |
The data safety form covers your SDKs too
The data safety answers must include data collected by every SDK in the app, not only your own code. Analytics, crash reporting, ads, chat, maps and payment SDKs all collect something. Ask your developer for a list of SDKs and check each vendor's disclosure guidance. A mismatch between the form, the privacy policy and the app's real behaviour can lead to enforcement action later, even after the app is live.
Extra checks for fintech, lending and health apps
Apps that offer loans, payments, investments or health services face stricter declarations, and personal loan apps in India have specific Play policy requirements, including documents about the regulated entity behind the loans. If your app touches money or health data, read the relevant Play policy section before the design is final, not in the week before launch.
Step 4: Test through the release tracks
Google Play gives you several tracks so that real users test the app before the public does.
- Internal testing: get builds onto your own team's phones quickly for day-to-day checks.
- Closed testing: invite a wider group, such as staff, pilot customers or dealers, by email list or Google Group. Use it to test on budget phones and slow networks.
- Open testing: an optional public beta that anyone can join from the store listing.
- Pre-launch report: Google runs automated tests on a range of devices and flags crashes, accessibility and security warnings. Fix what it finds.
- Production: submit for review. Review times vary, and first releases, new accounts and sensitive permissions usually take longer.
Step 5: Release in stages and watch the numbers
Do not push version 1.0 to every user on day one. Use a staged rollout: release to a small percentage of users, watch crashes and reviews, then widen the release. If something breaks, halt the rollout and fix it before most users ever see the problem.
- Android vitals: track crash and ANR (app not responding) rates. Apps with poor technical quality can be shown less prominently on the store.
- Reviews: reply from Play Console. Recurring complaints are your next sprint's backlog.
- Policy emails: make one person responsible for the Play Console inbox. Policy deadlines are often short, and missing one can lead to an app being removed.
Common reasons Play Store submissions are rejected or delayed
- Weak privacy policy: missing, broken, or a generic template that does not match the app.
- Contradictory data safety answers: the form says no data is shared, but an SDK sends it to a third party.
- Reviewer cannot log in: many Indian apps use mobile OTP login, and the reviewer cannot receive an SMS on your test number. Provide a demo account with a fixed test OTP or password login.
- Unjustified permissions: SMS, contacts or background location requested without a declared core feature that needs them.
- Misleading listing: screenshots or descriptions that do not match the app, or another brand's name in your title.
- Broken functionality: crashes on launch, empty screens or placeholder content.
How EthicsComputer can help
Our Android app development team prepares the store listing, privacy policy and data safety form, handles reviewer feedback and sets up staged rollouts, with the app published under your own developer account. If you also need an iPhone version, see our iOS app development service. For apps that handle payments or personal data, an independent mobile app security test before launch is a sensible step.
Is your Android app ready for the Play Store?
Tell us where you are in the process and we will point out what is missing before you submit.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
