Why does Google Play Protect show a warning?
Play Protect shows this warning for any app installed from outside Google Play whose developer is not yet known to Google. RealRate is not currently published on Google Play because developer registration is not possible from Iran.
The text message permission adds to the sensitivity: it is needed to record bank withdrawals and deposits automatically, and Google reviews it more strictly for unknown apps. The warning does not mean the app has a problem.
- Only withdrawal and deposit messages from bank senders are read; other messages never reach the app
- One-time password and verification code messages, even from the bank itself, are discarded on the spot
- The text of a message never leaves the phone; only the amount and date that you yourself record are stored, encrypted
- The full code of the app is open source and anyone can review it
How can I be sure the file is genuine?
The install file is published only from the Releases section of RealRate's official GitHub repository, and is built and signed automatically from that same open-source code. All official versions are signed with one key; if you see an app with a different signature, it is not from RealRate.
The SHA-256 fingerprint of the signing certificate, for verification (for example with the apksigner tool or APK inspection apps): A7:57:AC:C9:5D:6A:1F:F2:F3:6B:63:15:0F:75:15:D0:44:E6:BC:FD:67:43:D0:7A:C7:5E:FA:4E:43:2E:26:18
- Automatic, transparent builds in GitHub Actions from the public code
- The same signature on every version; an update installs over the previous one
Updating the app
To update, open this page and download and install the file again; the new version installs over the previous one and your data and settings stay where they are. The download link always gives you the latest version.