Skip to content

Install Plico

Download Zapstore

Download
QR code for zapstore.dev/download
  • Scan the code with your phone’s camera
  • Tap Download anyway if the browser warns about the file
  • Allow your browser to install unknown apps if Android asks
  • Open Zapstore and finish the onboarding

Open Plico in Zapstore

Open
QR code to open Plico in Zapstore
  • Scan the code to open Plico in Zapstore, or search for it there
  • Tap Install, and Download if Zapstore asks you to confirm the developer
  • Confirm in Android’s install dialog. Allow Zapstore to install unknown apps if Android asks

Claimed by the developer

Turtlecute cryptographically proved they hold the key that signs Plico. The claim is a signed proof on Nostr, tied to the certificate below.

Developer
Turtlecute
Developer key
npub1acpsfwhq63nehv6rgl8rkxuqfq3x9wvp90gvp40pnf0zg3gy8d6ss564p8
Signing certificate
2625a6b97f7465527e9ad0c0d2704efcd8dff2e3a8c4fff708fa21c8f0d906c3
APK checked by
relay.zapstore.devIt read the APK and found it signed with this certificate before listing the release.
Claim published
Oct 31, 2026
Valid until
Oct 30, 2028
Proof event
b113d1de57aeb7b9a115d2323a62a4ed5cdf82f31f6c691f64db711dacb28a77in relay.zapstore.dev
How trust works

Email app for IMAP accounts. You type your address, and the app finds the servers. New mail arrives in seconds through IMAP IDLE. The app uses no Firebase and no server of its own.

Plico is an email app for IMAP accounts. You type your address, and Plico finds the servers. New mail arrives in seconds through IMAP IDLE. Plico uses no Firebase and no server of its own. No trackers, no Google Play Services.

Plico has its own IMAP, SMTP and MIME code, and only a few libraries. It reads untrusted mail with JavaScript off and with no network access, and it shows the true target of each link before it opens.

  • Any IMAP account: SSL/TLS or STARTTLS. Plico never connects without encryption.
  • Fast push: IMAP IDLE with one connection for each account.
  • Unified inbox, folders and labels, swipe actions, local and server search.
  • Gmail, Outlook.com and Microsoft 365, Riseup: sign-in in the browser or with an app password.
  • Offline: the mail of the last 30 days stays on the phone.
  • Compose: plain text, attachments, Undo send.

Summary generated by Zapstore from source.

Original description, as the developer published it.

Zap Plico

Zapping anonymously. Sign in to zap with your identity.

Sats go to npub1acpsf…s564p8, the developer who signed the app’s certificate proof.

Amount in sats

Stacked in

Latest release

Nov 5, 2026

Claimed app No Google servicesSource available · GPL-3.0-only

It asks for no sensitive access. The app connects to mail servers and OAuth providers for sign-in, and fetches remote images or sender logos from domains you choose to view.

Permissions

  • Notifications POST_NOTIFICATIONS Send you notifications
  • Always running REQUEST_IGNORE_BATTERY_OPTIMIZATIONS Keep running in the background without limits

Release notes

Security hardening for shared files, more reliable sync and sends, and a smoother mailbox and Compose.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.7 keeps your accounts, mail and settings.

Changed

  • A share to Plico opens Compose at once. Before, the inbox showed first while Plico copied the files, and then the screen changed. Back now returns to the app that shared.
  • Back from a folder to All inboxes now has the predictive back animation.
  • Plico starts faster: the push engine does no system calls on the main thread at start.
  • When you open Plico, it removes old "Message not sent" alerts. The mailbox shows failed sends.

Fixed

  • After you changed the sender name or the days of mail bodies to keep, sends and downloads used the old value until Plico connected again. Now they use the new value.
  • A draft with many large attachments could make the app run out of memory during the upload to the server, and then retry again and again. Now Plico refuses it with a clear error.
  • A server that refuses COMPRESS or ENABLE stopped all sync for that account. Now Plico continues without them.
  • A Sent copy on Riseup could be saved two times after a network error. A retry now checks for a copy first.
  • Search downloaded the bodies of the oldest new results. Now it downloads the newest.
  • An unexpected error during the build of a message left the draft in "Sending", and Plico later said that it "may have been sent". Now it shows the error.
  • The Undo bar went away after a rotation, and it could wait behind other messages until its time was over.
  • "Delete forever" in multi-select lost the selection when you tapped Cancel.
  • The "Send again?" dialog closed on rotation.
  • Files picked in Compose could be lost if you left the screen before the copy ended, and Send did not wait for them.
  • A "Push stopped" notification action could start the push service while push was stopped from the Task Manager.
  • Remote images were downloaded again after a rotation, and could stop loading. Inline BMP and AVIF images now show.

Privacy and security

  • Plico does not attach a shared file that the sending app cannot read itself. Before, another app could get a file that you picked earlier in Plico.
  • Shared files have a size limit for all files together, so a share cannot fill the storage of the phone.
  • A copied link goes off the clipboard after 60 seconds.
  • On Setup and Reauth, Plico hides the overlays of other apps, so that no app can draw over a password field.
  • XML attachments that contain XHTML or SVG are now marked as dangerous files.
  • Build: Gradle gets only Google groups from the Google repository.
File Use
Plico-0.2.8.apk Release build, signed.

SHA-256:

  • Plico-0.2.8.apk: e31065f8b34d5ff67669e6933fa21aafd86b0c8a0fb12eb7d9183bda251be625

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Check the certificate with apksigner verify --print-certs Plico-0.2.8.apk or with AppVerifier. Do not install an APK with a different certificate.

Comments

Loading comments…

See more

Get Plico the private way

Updates checked on your device, and every release verified before it installs.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes