Why outside the store
Download straight from us and verify the checksum and signature yourself. For growers who'd rather skip the store.
Releases
How to verify
Every APK release will ship with a SHA-256 checksum and signature instructions on the download page, so you can confirm the file came from us and wasn't modified.
Download the .apk file from this page.
Compare the checksum: compute the downloaded file's SHA-256 and check it against the value above. On Android, a file-manager or hash-checker app that can compute SHA-256 does the job; on Linux or macOS, run sha256sum on the file; on Windows, use the Get-FileHash command in PowerShell. The two values must match exactly.
Tap the downloaded .apk file. If Android asks for permission to install from this source, allow the browser you downloaded with on the settings screen that opens, then come back and finish the install.
Google Play Protect may show an "unknown developer" warning; for installs from outside the store that is expected. What confirms the file are the SHA-256 checksum and the signing certificate fingerprint above — if those match, the file came from us and wasn't modified. To continue the install, open the details on the warning screen (on Android usually "Details" or "More details") and confirm the installation — base that decision on the SHA-256 checksum and the signing certificate fingerprint above matching.
Optional, advanced: on a computer with Android developer tools, apksigner verify --print-certs shows the APK's signing certificate — its SHA-256 fingerprint must match the one published above. If this step isn't practical for you, the checksum comparison above already confirms your download wasn't altered.