Google Play allows apps whose content is a website, on one condition: the app must do something a browser bookmark would not. Play's minimum functionality policy rejects "apps that are only a website wrapped in a WebView" — and accepts the same wrapper the moment it carries push notifications, native navigation, offline content, a splash screen or a persistent login. Beyond that, a website app faces the rules every app does: an App Bundle for new submissions, a recent target SDK, a Data safety declaration and a privacy policy. Here is each one, in the form it takes for a converted site.
Minimum functionality — what the policy says
The Spam and Minimum Functionality policy lists, among things Play does not allow, apps that "are designed to do nothing" or whose "primary purpose is to drive affiliate traffic", and specifically webviews that simply load a website. The reviewer's test in practice: would the user lose anything by deleting the app and using the site in Chrome? If the answer is no, it is a rejection with the policy name in the email.
What counts as functionality
Any of these, and one is usually enough, two is safe:
| Feature | Why it satisfies the test | In the builder |
|---|---|---|
| Push notifications | The app reaches the user when the site is closed; a bookmark cannot. | Pro — push step |
| Native bottom tab bar | Navigation the browser does not provide. | Pro — tab bar step |
| Offline content | Pages that work with no connection. | HTML or ZIP input |
| Splash screen and onboarding | A launch experience specific to the app. | Pro — splash and onboarding steps |
| Camera / location integration | Device features used through the app's own permissions. | Free — permissions step |
| A login that persists | The user stays signed in across launches, as in a native app. | Automatic for most sites (cookies persist) |
Two things do not count, and people try them: a custom icon (every app has one) and a name. The functionality has to be something the user does.
The App Bundle requirement
Since August 2021, new apps on Play must be uploaded as an Android App Bundle (.aab), not an APK. An AAB is not installable itself; Play uses it to generate an APK tailored to each device, typically 20–35% smaller. Apps published before 2021 as APKs may continue to update as APKs; everything new is AAB. In the builder, AAB output is a Pro feature — it is the single most common reason people upgrade.
With an AAB comes Play App Signing: Google holds the key that signs what reaches phones, and you sign uploads with an upload key. If you ever set up App Links, the fingerprint you need is the app signing certificate from Play Console, not your upload key.
Target SDK deadlines
Play requires new apps and updates to target a recent Android API level — currently, within one year of the latest release. Each August the bar rises. An app targeting an old SDK is refused at upload, not at review. A converter handles this by regenerating the project against the current SDK every build; a hand-built wrapper needs someone to bump the number and test yearly.
The Data safety form
Every app declares what data it collects, whether it is shared, and why. The listing shows the answers. For a typical website app:
- The website's own data collection counts. If your site has accounts, you collect email addresses and names — through the app, as far as Play is concerned. Declare them.
- Analytics on the site (Google Analytics, etc.) is data collection: "App activity" and "Device or other IDs".
- Push stores a device token with your push provider: "Device or other IDs", shared with a third party.
- Permissions map to categories — camera to "Photos and videos" only if the photo leaves the device, location to "Location". Permission PickerTick what your site does, get the Android permissions it needs Open the tool
- Encryption in transit: yes, if the site is HTTPS. Deletion request: you need a way for users to ask, even if it is an email address.
Over-declaring is safer than under-declaring. A form that says "no data collected" for an app with a login is a policy violation waiting for a complaint.
Privacy policy
Required for every app, linked from the store listing and reachable inside the app. For a website app the site's own policy usually serves — as long as it mentions the app and covers push and analytics. Play checks that the link resolves; it does not read the policy for you.
Listing metadata
Title of 30 characters, short description of 80, no promotional words in either, no emoji, no capitalisation for emphasis, no keyword stuffing in the full description.
Common rejections and their fixes
| Rejection | Cause | Fix |
|---|---|---|
| Minimum functionality | Bare URL wrapper | Add push, tabs, offline content or a splash/onboarding flow; explain them in the description. |
| Deceptive behaviour / impersonation | App wraps a site you do not own, or the listing implies an affiliation | Only publish your own site. Match the developer name to the site. |
| Data safety mismatch | Form says no collection; app has a login or analytics | Declare what the site collects. |
| Broken functionality | Blank screen, login loop, mixed content | Test on a real phone first; see the fixes guide. |
| Permissions | Declared microphone or location with no visible use | Declare only what pages use; describe the use in the listing. |
| Metadata | "FREE" or "BEST" in the title, emoji, stuffed keywords | Reword; keep promotion to the full description. |
A submission checklist for a website app
- AAB built with Pro; version code 1; package name final.
- At least one real feature switched on — push or tabs are the simplest.
- Privacy policy URL that mentions the app.
- Data safety form filled from what the site actually does.
- 512×512 icon, feature graphic, at least two phone screenshots.
- Title and descriptions through the listing checker.
- Tested on a real device, including offline and a full login.
Review takes from a few hours to a week for a first app. The rules are stable; the apps that bounce are the ones that skipped step 2.