Developer Distribution Agreement

1. Developer Enrollment & Legal Identity KYC

To distribute software on Mega AppStore, developers must register a Publisher Profile, verify their legal organization or individual identity ("Developer KYC"), and configure Multi-Factor Authentication (Passkey or TOTP) prior to uploading binary releases.

2. Binary Packaging & Compatibility Standards

All software uploaded must comply with strict packaging guidelines depending on the target ecosystem:

• Android (APK / AAB): Must declare a valid, unique packageName (reverse domain notation, e.g. com.company.app). Version codes must be strictly monotonic (each new release must have a strictly higher integer versionCode than prior releases).
• Desktop Platforms (macOS / Windows / Linux): Binaries must be packaged into standard formats (DMG, PKG, MSI, EXE, AppImage, or Tarball) with valid executable entrypoints.
• SDK Requirements: Android packages must target modern API levels (minimum Android 10+ / API 29 recommended) with accurate minSdk specifications.

3. Cryptographic Signing & Certificate Continuity

Every release must be signed with an authentic X.509 cryptographic certificate using APK Signature Scheme v2, v3, or standard platform code signing.

4. Sandboxed Security & Malware Inspection Gates

Upon upload to the publisher console, every artifact is quarantined in a sandboxed ingestion pipeline that executes:

1. ClamAV Virus & Trojan Scan: Deep byte-stream heuristic inspection for known signatures and malware variants.
2. OSV Open Source Vulnerability Database Correlation: Extraction of embedded libraries to detect known critical CVE vulnerabilities.
3. Manifest Permission Audit: Static analysis of requested system permissions (e.g., camera, microphone, accessibility services, background location). Excessive or undeclared permissions will prompt reviewer scrutiny.
4. MFA-Gated Human Promotion: Appointed security auditors verify artifact safety before promoting the binary to public edge availability.

5. Prohibited Application Categories & Behaviors

Applications that engage in any of the following activities will be immediately taken down with publisher revocation:

• Deceptive Behaviors: Impersonating existing registered brands or spoofing package identifiers.
• Hidden Payloads: Dynamically downloading executable dex/code from remote servers that bypasses the static security gate.
• Spyware & Covert Telemetry: Silently recording keystrokes, clipboard data, contacts, or photos without transparent user interaction.
• Ad Fraud & Battery Drain: Invisible background ad clicking or unauthorized cryptocurrency mining algorithms.

6. Monetization, In-App Pricing & Mega Points

Publishers may distribute free software or offer paid digital licensing. Where developers choose to participate in the Mega Points referral & download rewards ecosystem, developer commissions are credited to the developer's digital wallet for verified organic downloads.

7. Moderation, Takedowns & Due Process Appeals

If an application is flagged by security scanning or reported by users for malicious activity or copyright infringement, our moderation team may quarantine the release or adjust visibility.

Publishers are entitled to due process: you may submit a formal appeal directly inside the Publisher Console supplying counter-documentation, clean binary patches, or licensing proof.

8. Publisher Representations & Warranties

You represent and warrant that you own or possess all requisite intellectual property licenses, patent rights, and code signing authority for all software uploaded, and that your application does not infringe any third-party copyrights or trade secrets.

9. Termination of Developer Privileges

Mega AppStore reserves the right to suspend or permanently terminate publisher privileges for repeated copyright strikes, intentional distribution of malware, or fraudulent manipulation of platform metrics.