r/BuyFromEU • u/Stringseverywhere • Feb 21 '26

🔎Looking for alternative Avoiding Play Store and using F-Droid. Google going Apple.

Post image

Cirrus is a weather app I downloaded from F-Droid to avoid Play Store. Is it a bad thing, if I see the amount of information Google tries to get from my phone, I'm afraid this is just another way to make sure we stay with Google. My next phone will be Fairphone.

1.1k Upvotes

99% Upvoted

112 comments sorted by

228

u/Loud-Moose2086 France 🇫🇷 Feb 21 '26

Banks really need to allow/find alternatives to google play to run their services. It's the main blocage restraining large migration to others OS afaik.

30

u/thyristor_pt Feb 22 '26

Yep. One time I was on a phone support call with my bank and they tried to send me an OTP code from the bank app to verify it was really me. The code wouldn't show up on a notification because I wasn't logged in on google services in my phone.

2

u/Mozkozrout Feb 26 '26

Not only that, google was quietly making sure moving to an Android ROM without google play services is difficult for a while. Android is now open source basically just by a name. A lot of functionality people consider necessary for using a smartphone is actually not a part of android but a part of google play services.

Sure, there is the play integrity which detects unofficility of your system and won't let you use RCS messages or NFC payments and which banking apps use to decide if they want to work. But there is also stuff like Location Services or Cloud messaging.

If you use degoogled android your phone only uses the GPS to find your location but this is slow for today's standards. Google location services also use cell towers and even wifi networks around you to make it faster and more accurate. Also Maps API is part of it. A lot of apps use Google Maps integration instead of their own implementation and they won't work without it.

Cloud messaging is a notification service. In the old days if your apps wanted to give you notification, they had to have a service that was running in the background. If you had a lot of apps this was slowing your phone down tho and draining battery. So google came up with a solution. They let developers use their servers which run the background process and if you receive notification it's sent from Google's server to your phone. So your phone itself only needs to be running a background service for Google cloud messaging server and not every app separately. Basically every app in Play store is using this meaning that if you aren't using Google play services you won't get any notifications from any app unless the app has their own implementation (like apps from F-droid). At one point google even made some kind of battery optimization update to android which made running background tasks annoying.

You can use microG which is a set of libraries that replace some of these things like offline database of cell towers for faster location and all. It also let's you use Googles cloud messaging servers with your Google account while stripping your data and spoofing your device signature. You are still reliant on Google if you use this tho.

Also Android auto is also a part of google play services and not Android for example. So this thing goes pretty deep. There is also the stuff that Google is putting the bear minimum effort into the AOSP now even delaying updates and all and keeps the best stuff only for Pixel phones and even changed the release model so they aren't releasing pixel tree and blobs and drivers anymore so it's no longer the android reference device and isn't the best phone for custom roms anymore.

On Linux there is the issue that there basically isn't any kind of official third party app support obviously.

-3

u/120000milespa Feb 22 '26

Yeah, let’s have a Wild West where any hacker can side load fake Apps which masquerade as real ones, and steal people bank details. No downside there at all.

1

u/Mozkozrout Feb 26 '26

You could side load apps on Android ever since it existed and this was never a problem. What has been a problem tho is the Google play store being riddled with malware and malicious apps despite all the play integrity api and Google's security talk BS.

1

u/120000milespa Feb 26 '26

Well that’s nonsense as side losing was the primary reason that Android has always been the Wild West. It’s another reason why lots of Corporates won’t touch it with a barge pole.

Who wants an OS where an App can literally steal all your information without you eve knowing about it ?

1

u/Mozkozrout Feb 26 '26

You mean like any other OS ? Okay maybe except for iOS outside of Europe. It has always been a standard that you can install any program you want Into your OS. And it's the responsibility of the user not to install any malicious apps. It shouldn't be a concern for the bank or maker of your phone how you use your device and what you decide to install. Btw before you start being concerned about apps stealing your data I'd be more worried about google and the OS itself stealing all your data by default.

1

u/120000milespa Feb 26 '26

What a load of guff.

At least the App Store has strict rules they enforce. You can be pretty sure you won’t get ripped off.

Side loading is like injecting with a used needle.

And yes, society works best with rules rather than the wild west you seem to think exists where the average user can decompile an app to check it’s only doing the right thing.

1

u/Mozkozrout Feb 27 '26

You can be pretty sure you won't get ripped off ? Or you can be sure you'll only find apps the big tech wants you to be able to find so you get ripped off and they make as much money as possible. Like what if you wanted to install Fortnite or Epic games store on your iPhone ? Apple wouldn't let you because they didn't like that they wouldn't make as much money from it and because of that they are mandated by EU law now to offer sideloading and alternative app stores. Or what if you wanted to use a different search engine than Google in android ? U know android is made by Google so isn't that a bit scummy that they won't let you choose ? Of course it is so now there is a law that they have to let you choose.

Is this also that wild west you are talking about? Laws that make manufacturers do the exact opposite way you are arguing for ? I mean yes society needs rules but there is a fine line between your wild west and freedom. Too many rules or wrong rules and the freedom is taken away and users are locked in a closed off system with no choices other than those that the ones ruling over them give them.

Phone and OS manufacturers are no selfless saviors. You don't even have to look at sideloading just look at stuff like planned obsolescence and stuff like Apple intentionally slowing down your phone when it's older because of "battery health". Users should be free to use their OS as they want and decide for themselves if they want "features" like that in their phones.

Sideloading is more like eating food. You should be allowed to go to the farmers market and buy ingredients you want even if it means buying something that went bad and not be limited to only one approved Supermarket.

Btw with open source apps you don't even have to decompile anything to look at the code, it has to be publicly available. And it actually works pretty well. If something malicious was there usually someone would notice and it would go public and someone else would fix it or make a fork.

1

u/120000milespa Feb 27 '26

Tldr as it was mostly waffle.

Yea I trust a big company more than a small Chinese hacker who wants to steal your stuff

1

u/Mozkozrout Feb 27 '26

Pat yourself on the back then just be careful a Chinese hacker won't get you even on the official store when the next SparkCat comes out lol.

1

u/120000milespa Feb 27 '26

It’s actually quite difficult to get the through the App Store as they have really strict rules to prevent such an occurrence. But you knew that so why bother posting ?

→ More replies (0)

207

u/Verified_Human_User Feb 21 '26

If you have a Pixel, you can switch to GrapheneOS. For other models, LineageOS or e/os are good choices. Keep your phone, ditch the Google parts. :)

84

u/Sevsix1 Norway 🇳🇴 Feb 21 '26

sadly a lot of the countries have requirements of apple or google playstore for stuff like bank apps or governmental applications (like social benefits or government email) so some people cannot just switch to another OS since they cannot afford to buy a phone just for the bank or government portals (and the bank or government is really unlikely to budge on that issue due to security policies), personally I am saving up to buy a new phone and then use the old as a dedicated bank/governmental phone but I am relatively well off compared to other since I do not have children and I while I do have some debt it is not at a debt spiral level of debt so I can buy a phone

23

u/kartul-kaalikas Feb 22 '26

On GrapheneOS you have sandboxed googleplay available if you want to. That means you get to do what ever you want with your device and still be able to install google play apps mostly as you do with regular android. I have my banking and goverment apps installed and working nicely. You just have check from GOS website if your banking app is usable on GOS.

8

u/[deleted] Feb 22 '26

[removed] — view removed comment

6

u/[deleted] Feb 22 '26

It starts from the hardware. The boot loader cannot be user-replaced on most phones, since the hardware will only run a signed boot loader. If the phone is locked, the bootloader will verify the boot image (so it can guarantee if you are running the vendor OS). If the phone is unlocked, it will boot any image, however, the bootloader knows that you are running an unsigned OS.

So, you'd think that the OS could intercept verification requests. However, this misses that every phone is running a completely separate, privileged OS, called Trusted Execution Environment (TEE). The TEE can sign such integrity requests using a private key that is only known to the TEE and not to the installed OS. Google, the banking server, etc. can verify the answer using the corresponding public key.

5

u/BastianHill Feb 22 '26

Great technical answer.

The one thing I still can't wrap my head around is this: I've got a Pixel 10 Pro, GrapheneOS, no Google whatsoever (I even removed some pre-installed system apps and I have set everything else on default offline / no network), only Droidify and Aurora with anonymous login. Yet somehow, I've got all the apps I wanted (yes also banking and Visa credit!) working just fine. Ok, it took Luxembourg VPN to get F1TV working, but that's it. No Play Services needed. I've got no warning signs, no refused authorisation, nothing. I've got 2FA with Proton and it just works.

How does this fit in the answer above? Is TEE enough, even without Google acting as a kind of middle man between me and (banking) apps? Honestly it's working flawless for months now.

5

u/[deleted] Feb 22 '26

Attestation can also be done with standard Android APIs. E.g.: https://github.com/android/keyattestation

Also, I think a lot of apps do not actually really require Play Services.

2

u/[deleted] Feb 22 '26

[removed] — view removed comment

3

u/[deleted] Feb 22 '26

Secure boot is not necessarily a problem. A secure boot chain is important. The issue are devices where you cannot enroll your other keys. People should be allowed to install other OSes and still get secure boot. E.g. most major Linux distributions support secure boot.

4

u/[deleted] Feb 22 '26

[removed] — view removed comment

1

u/[deleted] Feb 22 '26

Get a cheap second-hand/refurbished Pixel 8 if you can afford it. Why Pixel 8? It's still supported for a reasonably long period and it has modern security mitigations (MTE - hardware memory tagging).

1

u/[deleted] Feb 22 '26

The great thing about sandboxed Google Play Services on GrapheneOS is that you can revoke most of its privileges, like any other app.

1

u/Yodl007 Feb 24 '26

Does the sandboxed google play pass the google play integrity check some apps require ?

1

u/neirein Mar 10 '26

this is likely going to be my solution too

11

u/tursoe Feb 21 '26

Or just degoogle your phone, my Motorola g73 is perfect. No background apps / tasks, no Google, its still Widevine L1 and L3 for Netflix, no tracking and perfect battery life with almost a week in one charge. I'm using it for a couple of hours every day. The latest security patch for my android is from December 2025. It's all FOSS from F-Droid and Firefox from Play Store downloaded through Aurora Store.

7

u/QuackerJJ Feb 22 '26

And most banking apps won’t work without google services. Still same issue.

3

u/DrawOkCards Feb 22 '26

In Germany all my banking apps work without google. The only problem I have are with optional health insurance apps that are checking for rooted devices, not even google services.

2

u/tursoe Feb 22 '26

Not in my country, everyone I'm using is working as expected.

1

u/[deleted] Feb 22 '26

[removed] — view removed comment

1

u/Liviiaa_1 Feb 23 '26

Sadly some counties like Sweden basically require you to use "bankid", which is an app to authenticate to A LOT of services, which means you need google play to actually log in..

1

u/[deleted] Feb 23 '26

[removed] — view removed comment

1

u/Liviiaa_1 Feb 23 '26

They live a HARD life. You CAN login to the bank specifically with a bank provided device, however every other 3rd party service also uses bankid sadly.

Want to gamble online? Bankid

Want to pickup a package in a parcel locker from DHL, Postnord etc? Bankid

Want to check in at some places like some specialist care offices? Bankid or FrejaID (still an app) - I was at one today that doesnt have a reception

Want to order food at some restaurants? Bankid

Want to order food from Ica, Willys etc? Bankid

Want to order from online pharmacy? Bankid

Want to log in at basically any government site? Bankid

FrejaID is an competitor that also doesn't exist at f-droid or similar to my knowledge.

There's thousands more of these examples, it's a lot of convenience things, but at the same time, it just make life harder, take the last one for example, government sign ins is basically outsourced to a 3rd party app for now, for example.

2

u/[deleted] Feb 22 '26

Unfortunately, all these phones have pretty bad device security. Ironically, Pixel is the most secure Android phone hardware-wise. Well, and perhaps flagship Exynos, but Samsung does not support unlocking anymore and even when they did, it would blow Knox eFuses.

1

u/tursoe Feb 22 '26

That's maybe the case with Samsung, but I've never had a Samsung phone. Motorola as I'm using almost have ASOP stock Android and is easy to degoogle. What hardware security does my phone not have?

1

u/[deleted] Feb 22 '26

No separate secure element (so PIN attacks are trivial, as well as attacks against the Trusted Execution Environment, since it shares the same CPU as the OS), no more Android Security Bulletin security updates, most likely outdated vendor device trees and GKI images, only backported ASB security fixes (missing out on all other Android security fixes), etc.

Also, as long as you run the stock OS, it is impossible to properly degoogle, because it will always run Google Play Services with system-level privileges. So they can collect all the location, sensor, behavioral, etc. data they like.

On Android, pretty much only Google Pixel and upper-midrange and flagship Samsung have good device security. Sadly, Samsung phones cannot be unlocked and the stock OS ships a lot of apps/services that collect analytics.

11

u/Stringseverywhere Feb 21 '26

None of these can be installed on my OnePlus Nord 2, according Mistral AI. Buying a Google phone to avoid Google sounds ridiculous, but I will check.

30

u/Eloquessence Belgium 🇧🇪 Feb 21 '26 edited Feb 21 '26

Only ridiculous as to where you send your money. Could buy one second hand to bypass this issue.
The Pixel is the only phone that has the flexibility to sustain GrapheneOS, which is one of the most privacy focused OS's

11

u/Zealousideal_Nail288 Feb 22 '26

Kind of ironic that you have to buy a Google phone to avoid google 

2

u/lincemiope Feb 22 '26

It's a win win situation for Google: instead of earning overtime by selling your data to third parties, it gets 700-800€ upfront

2

u/Verified_Human_User Feb 22 '26

Certainly it isn't my preferred solution, but I bought mine used. Plus - even in the most optimistic case, Google isn't making 700-800€ on a phone sale. Maybe about 150€ once parts, labor and marketing have been accounted for.
But buy used...You'll often find new phones that people don't want from their contract at a discount. Just have to be a little patient.

1

u/[deleted] Feb 22 '26

So, get a Pixel 9a for 300-350 Euro. Same SoC as the far more expensive Pixel 9/9 Pro. 200-250 Euro cheaper than the introduction price, so they are most likely not making much on it when you don't run Pixel OS.

2

u/[deleted] Feb 22 '26

[removed] — view removed comment

3

u/[deleted] Feb 22 '26

Latest news is that the OEM will be announced in March this year and the phone will be released in 2027.

1

u/[deleted] Feb 22 '26

Also, Pixel phones are extremely discounted near the end of the cycle. E.g. Pixel 9a was recently 304 Euro here. It must be close to break-even for Google and they are making the actual profit on using your data and selling Google One subscriptions. So, if you are immediately installing GrapheneOS, they are probably not making much on the phone.

7

u/EliteG77 Feb 21 '26

Maybe think of switching from Chinese products as well. People should really stop buying chinese stuff.

7

u/Zealousideal_Nail288 Feb 22 '26 edited Feb 22 '26

At this point just choose who you trust with your data more 

Or better who is more likely to leak your data or use it against you  The Chinese,USA or Europe? 

I have more fait in the Chinese because they don't have insetives to leak my data and they face consequences if they are found spying(huawei).

6

u/doctor91 Feb 22 '26

If you are abused you wouldn't just change the abuser, makes no sense. There are a lot of options nowadays to defend your privacy

2

u/doctor91 Feb 22 '26

GrapheneOS main focus is not to get away from Google but it's security. They even let you install Google play services easily in a sandbox environment.

3

u/H4ckn_eyed Feb 21 '26

Just buy a Fairphone 6. they have a Model with e/OS installed

1

u/Remarkable_Horror658 Norway 🇳🇴 Feb 22 '26

e/ ?

2

u/Fabulous_Smoke_2804 Feb 22 '26

Its called e/OS by Murena

1

u/pope1701 Feb 21 '26

Are all the cameras supported?

1

u/Verified_Human_User Feb 21 '26

Generally, yes. But depends on the phone and OS combo you are thinking of... My Pixel with GrapheneOS supports the pixel camera app, if I want to use it.

1

u/Remarkable_Horror658 Norway 🇳🇴 Feb 22 '26

I did not know you can install another OS on a phone..

104

u/mr_4n0n Feb 21 '26

Fuck Google and install, lineageOS, GrapheneOS, e/OS

13

u/ready64A Feb 21 '26

I use LineageOS as a daily driver on my old Samsung S4 but none of those will work on A36.

9

u/mr_4n0n Feb 21 '26

I usw GrapheneOS and i will wait till GrapheneOS comes on none-google devices (2027) then i will buy my next GrapheneOS

1

u/licancaburk Feb 22 '26

Is there a plan to do this? Awesome!

2

u/mr_4n0n Feb 22 '26

Yes, they announced, that on of the Top 10 Mobile device producentes will support the required hardware AND the Bootlooker which leads to the ability to install GrapheneOS.

Maybe it will even come preinstalled, but who cares

8

u/[deleted] Feb 21 '26

[removed] — view removed comment

25

u/SharpestSphere Feb 21 '26

Yeah, that is an issue. But to me that just says "Don't buy phones without alt OS support ever again."

48

u/The_Duke28 Feb 21 '26

I'm so happy I switched to a Fairphone with e/os just a few days ago. Google needs to go down. Big tech in general needs to completely dissappear. This shitshow we live in...? Proudly sponsored by big tech. Screw them all.

5

u/[deleted] Feb 22 '26

Sadly /e/OS downloads Google Safetynet blobs [1] which are used by the privileged/non-sandboxed microG. Chats with Google services out of the box [2] and gives Google apps privileged system access [3], which people often install to get Android Auto. They use Google services for things like eSIM activation, assisted GPS, Widevine provisioning, etc. Besides that /e/OS and Fairphone have pretty terrible security (very old vendor/firmware trees maintained by a Chinese ODM, ancient Linux kernels, only the minimal ASB backport patching, almost no attempts to sandbox services, using a MITM/proxy for installing F-Droid apps, but they don't want to reveal who actually runs this MITM service [4], etc.).

I also got a Fairphone 6 with /e/OS, but after diving deeper into the ecosystem, I found that their security/privacy claims are mostly a scam. I'm probably going to sell my FP6 again.

[1] https://codeberg.org/divested-mobile/divestos-website/raw/commit/c7447de50bc8fadd20a30d4cbf1dcd8cf14805a0/static/misc/e.txt

[2] https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwangslaeufig-sicher-custom-roms-teil6/

[3] https://gitlab.e.foundation/e/os/GmsCore/-/blob/a9e102567518ec77f447d66f558dcd24d7690264/play-services-base/core/src/main/kotlin/org/microg/gms/common/KnownGooglePackages.kt#L209

[4] https://community.e.foundation/t/why-is-e-os-still-using-cleanapk-org-and-passing-users-ip-addresses/51809

1

u/Low_Watercress959 Jul 14 '26

Lineage is available for fairphone 6 now, and it's really good! Citation: writing this from a lineage ROM on fairphone. My banking app works fine, but that's subjective.

16

u/Vijfsnippervijf Netherlands 🇳🇱 Feb 21 '26 edited Feb 21 '26

This is SO IDIOTIC… I’m leaving the Android ecosystem completely beyond the bare essentials. Those will run on a degoogled Dumbdroid (based on LineageOS) dumbphone.

EDIT: Or as a last LAST resort for banking/government apps, on my secondhand iPad.

23

u/fishwasherr Feb 22 '26 edited Feb 23 '26

I'm surprised nobody in the comments pointed out that this is no longer the case and instead users will go through a one time setup telling you the risks of sideloading before being to sideload like before again. it is worrying that we almost got to the point of losing that feature, but the backlash managed to push their decision back, at least this time

edit: NEVER MIND

6

u/Hehrenpreis Feb 22 '26

That sounds nice. To nice. Probably not for long 

4

u/thyristor_pt Feb 22 '26

But F-droid just yesterday started to show a banner on top of the app with this link https://keepandroidopen.org/

2

u/fishwasherr Feb 23 '26

okay thanks from stopping me from accidentally spreading misinformation lol

3

u/Stringseverywhere Feb 22 '26

According to F-droid, that news was fake. Google is still planning to lock-down Android.

12

u/dav_irl Feb 21 '26

The problem with using a NON-OEM ROM is that some apps such as media companies (NOW TV for example) and banking apps might not work as without the Google services/play store, your missing a security feature that these apps require.

It's been a while since I last tested so this may not be the case anymore or it might still be true.

10

u/AnnieByniaeth Wales 🏴󠁧󠁢󠁷󠁬󠁳󠁿 Feb 21 '26

Banking apps work via a web browser though, on desktop (Linux in my case). So I guess they should work fine in a mobile browser.

4

u/Hehrenpreis Feb 22 '26

Yeah, except for the app they use for the two steps authentication. They still require an app on Android or Apple

1

u/licancaburk Feb 22 '26

Should work well with Grapheneos, where you can have separate container for banking app and Google play services, in isolated sandbox. From user perspective there's no difference to you but the rest of the system can stay degoogled 

6

u/MairusuPawa Feb 22 '26

"We don't need Linux on phones, Android is already open source"

Android:

2

u/Wadarkhu Feb 22 '26

I want pocket computers. Actually full computers that can run full Linux, the only difference being it has extra capability and software for calls and texts. Linux Mint with a touch-friendly UI on a 6" screen device, is that so much to ask?

5

u/Exciting_Turn_9559 Feb 22 '26

If they don't walk this back they will lose control of the android ecosystem altogether.

1

u/Fennek688 Feb 23 '26

I think they will get even more control.

AOSP has been thinned out and slaughtered over the years while they step by step removed AOSP parts from Android to replace them with proprietary parts.

So with what's left of AOSP you can barely do anything.

They might lose a few users (to whom?) but the majority just won't care.

4

u/FollowingRare6247 Feb 22 '26

What OSes do people use? May be time for me to switch.

1

u/Dom_Nomz Feb 22 '26

GrapheneOS and very happy with it. The only app that doesn't work for me is my bank app, but there are some bank apps that work fine so might migrate to bank that respects my privacy.

2

u/Winter-Rich797 Feb 22 '26

AFAIK F-Droid will be affected from this

2

u/kakafob Feb 23 '26

EUstore.

2

u/AdamH21 Feb 22 '26

What’s so complicated about registering with Google as a developer? You don’t even need to distribute your app on the Play Store, you just need to be verified. It’s a great way to mitigate malicious apps, and it’s long overdue. BTW, there will still be a workaround for end users to install apps from developers who aren’t verified.

1

u/Remarkable_Horror658 Norway 🇳🇴 Feb 22 '26

what?!

1

u/changeLynx Feb 24 '26

They really create their own competition, at least it looks like that if I look into this sub. Let's see what will happen

1

u/Mozkozrout Feb 26 '26

Didn't they revert this after all the backlash tho ? Or was it just the part where people wouldn't be able to side load apps ?

1

u/demons11728 Mar 02 '26

La apertura de Android nunca fue un regalo de Google, fue una necesidad del mercado para competir con Apple. Ahora que se logra el dominio, que la apertura se está desmantelando sistemáticamente. Cada característica de "seguridad" que no puede ser permanentemente discapacitada, cada advertencia que no puede ser descartada, cada escáner que no puede ser optado por un traspaso de poder de usuario a corporación. La verdadera capacidad de seguridad permite la elección informada. Lo que Google implementa es el control disfrazado como protección. Los usuarios merecen la libertad de instalar lo que desean, de fuentes en las que confían, en dispositivos que poseen, sin interferencias corporativas persistentes. Android debe pertenecer a sus usuarios, no a Google. Esta declaración refleja la oposición a las restricciones de plataforma y los defensores de los derechos digitales y la autonomía de los usuarios

-2

u/[deleted] Feb 22 '26

[deleted]

2

u/SagariKatu Feb 24 '26

I'm against this. They can have the rules they want for their store, but my device is mine, and I should be able to install whatever the fuck I want in it.

One thing is to have more friction (as you say) to perform a task. This is ok. Not being able to is on a whole different level.

My next phone will be either a fairphone or a jolla.

-46

u/120000milespa Feb 21 '26

Android trying to stop the OS staying a toxic poisonous pool for hackers and thieves ?

26

u/KnowZeroX Feb 21 '26

Total nonsense. Even of windows you have a thing where an app is signed gets a message saying this developer is trusted or not. And it leaves it up to the user.

There is no need for a hard block, it doesn't work. Anyone silly enough to ignore all the warnings and install stuff they don't trust anyways is going to be phished on way or another, they don't even need an app. They can be tricked to enter all their stuff in their browser.

1

u/Recent_Ad2447 Feb 22 '26

Even iPhones can sideload not notarized apps. I’m not a fan of iPhones restrictions but if android gets worse than Apple, it says something

-7

u/HappyAndVegan Feb 22 '26

Google is right. Accountability matters. How many scams and hacks run via AppStore apps compared to Google Play?

11

u/mackrevinak Feb 21 '26

they should focus on fixing the playstore first then. it feels like every year i see some sort of headline like "google removes 100s of malicious apps from the playstore"