Default catalog
Lenient by design. Releases are verified automatically, and a ban is written by hand, with a stated reason.
The default catalog is the one Zapstore ships with. Its rules are lenient by design, and another catalog can be stricter or looser. Its catalog relay (zapstore/relay) is open source.
Who publishes here
The indexer. Zapstore’s indexer follows public releases on GitHub, GitLab, Codeberg, F-Droid, IzzyOnDroid and similar sources, and publishes them under the catalog’s own pubkey. Most apps get in this way, before their developer does anything. An app only the indexer has published is unclaimed.
Developers. A developer publishes under their own pubkey, or a delegate’s, once they have claimed the app. The catalog relay accepts a developer’s listing only with a current claim, so nobody can publish in a developer’s name without their Android signing key. After a claim, the indexer keeps filling in any release the developer does not publish, under the developer’s listing.
The first listing of a new app passes an admission check, and its rules may change.
How releases are checked
A new release waits on the catalog relay until it is verified: the listing is complete, the relay has read the APK, the APK is signed by the app’s certificate or one linked to it, and its version code is not lower than the last release. Then it is served. These checks are automatic and usually take a few minutes.
Reports and removals
Anyone signed in can report an app. Reports are public. A report asks the operator to take a look, and does not ban anything by itself. A person writes every ban by hand, with a reason, and the reason goes out with the next catalog update. A ban removes the app and covers the publisher’s pubkeys, forge accounts and files, so a new free identity does not get them back in.
A developer can also remove their own app by deleting their listing. That removes the indexer’s listing too, and the indexer stops publishing the app.
What the catalog relay refuses
The catalog relay refuses malware, impersonation, and anything else the Terms of Service forbid. A refusal here does not stop a developer from publishing the same app to another catalog.
