Question

I have an android application which communicates over plain tcp/ip (no http) connection with my server. Server is oriented to handle many simultanous client connection and is written in apache mina. The communication between android client and server is in some cases unsecure. I’m securing only messages which caries personal information, the other messages are unsecured. But what is more – Im using my own method for security – not a ssl. Im making RSA + AES cyphering and public key exchange. Now I’m starting to worry that when I deploy the app it will be simply rejected from google play, because of facts that it creates unsecure network connection with other service.
What do You think about that, Maybe I should buy certificate, and try to make my communication through the tcp with ssl support ?

Answer 1

According to Google Play Developer Program Policies there is only rule about personal data:

Personal and Confidential Information: We don’t allow unauthorized publishing or disclosure of people’s private and confidential
information, such as credit card numbers, Social Security numbers,
driver’s and other license numbers, or any other information that is
not publicly accessible.

As I can see there should not be any problems with insecure connections to third-party servers.