One app, three ways to get it.
Every build is the same code with the same features. The only differences are where it comes from, and whether it carries the optional Google services.
GitHub Releases
The signed APK and the signed app bundle, published by the same tag run that builds the release. Every file ships with a SHA-256 checksum.
Download the APK About 41 MB · arm64-v8a and armeabi-v7a · no Google services requiredGoogle Play
Published on Google Play. This build adds Google Drive backup and an in-app update check under Settings → About.
Get it on Google Play Free · Android 11 and laterF-Droid
Built without Google Play Services, so it has no Drive backup and no in-app update check. F-Droid handles updates there. Everything else is identical.
Tracked in the F-Droid metadata repository; the inclusion request is open.What you need
- Android 11 (API 30) or later. AuraSpend does not run on older versions and will not be made to.
- An arm64 or armeabi-v7a device — effectively every phone made in the last decade. ChromeOS is deliberately unsupported.
- About 41 MB for the APK, plus 22 MB if you choose to download the optional categoriser. Nothing else is downloaded, ever.
- No account, anywhere. A Google account is only needed if you want Drive backup, and only the Play build needs one for the app itself.
Verifying the download
Each release publishes a SHA256SUMS file next to the artifacts. To check the APK you downloaded:
| Command | What it prints |
|---|---|
sha256sum AuraSpend-V*.Alpha.apk |
The digest of your copy. |
grep Alpha.apk SHA256SUMS |
The digest the release published. |
The two must match. The release is signed with a key whose certificate is CN=AuraSpend, and the digest pins the exact file — a substituted or corrupted download will not match.
Installing an APK outside the Play Store. Android will ask you to allow installs from your browser or file manager the first time. That prompt is the operating system's, not AuraSpend's. The Google Play and F-Droid builds do not need it.
Building it from source
It is the same app. You need a JDK and the Android SDK; everything else the build downloads for itself.
| Step | Command |
|---|---|
| Clone | git clone https://github.com/auraspend/auraspend.git |
| Build the release APK | ./gradlew assembleProdRelease |
| Run the tests | ./gradlew testProdDebugUnitTest |
| Check the licence and privacy copy | ./tools/check_license.sh · ./tools/check_privacy_claims.sh |
Without your own signing key, the build produces app-prod-release-unsigned.apk — which Android will not install. The repository documents how to supply one in secrets.properties. The README has the full recipe, and the build flavours are explained in ADR 0010.
Updating
- Google Play build — the app asks Play once a day and says so quietly: one strip below the balance on Home, a dot on the Settings avatar, and a line in Settings → About. Settings → About → Check for updates asks immediately, downloads in the background, and offers a restart. A release the developer marks urgent (priority 4 or 5) opens Play's own full-screen update flow on launch instead; a routine release never interrupts. If the app has not been opened for a few days, the same check can arrive as a notification, which has its own channel and can be turned off in Android's settings.
- F-Droid build — F-Droid's own update mechanism, as its inclusion policy requires.
- GitHub APK — download the new file and install it over the old one. Your data is preserved: the upgrade from 0.1.5 onwards is in place, and before that the database was not yet encrypted.
One warning
Do not sideload an AuraSpend older than 0.1.5 over a newer one. A pre-0.1.5 build cannot open the encrypted database, and the failure is loud rather than silent — but it is still a failure. Google Play prevents this for normal installs; the F-Droid build does not ship old versions.
Read the answers first.
What AuraSpend does with your messages, what it never sends anywhere, and why there is no account.