---
sidebar_position: 10
sidebar_label: Shipping
---

# Shipping

## Your server address

Builds point at your server in full, over HTTPS: Android refuses plain HTTP from API 28. While you develop, the emulator reaches your computer at `10.0.2.2` (or at `localhost` after `adb reverse tcp:3000 tcp:3000`). Allow it in a network security config for debug builds only:

```xml
<!-- res/xml/network_security_config.xml, named by android:networkSecurityConfig in a debug manifest -->
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">localhost</domain>
    </domain-config>
</network-security-config>
```

Your app in WordPlus Cloud needs no address for the app: a native app is let in by itself. The key and secret stay on your server. The app gets what it needs from your server `config()` at sign-in.

## Permissions

The library manifests declare what they use, and Gradle merges them into the manifest of your app:

| Library | Permissions |
|---|---|
| `realtime` | `INTERNET` (yours to declare: a plain Kotlin library has no manifest) |
| `realtime-calls` | `INTERNET`, `ACCESS_NETWORK_STATE`, `ACCESS_WIFI_STATE`, `RECORD_AUDIO`, `CAMERA`, `MODIFY_AUDIO_SETTINGS` |
| `realtime-ui` | the call screen activity, which shows on the lock screen and supports picture in picture |

`RECORD_AUDIO` and `CAMERA` are asked for at run time: the call screen asks when a call is answered, and an app of its own screens asks before a call ([calls](calls.md#calls-of-your-own)). The emulator camera is a test pattern: try video calls on a device.

## In the background

- **Rooms:** Android may stop the app network soon after it leaves the screen, and ends its process when it needs the memory. Coming back, the SDK connects again and each room gets what it missed from its history, so nothing your rooms keep is lost. An app that must hear something while closed needs push, which this SDK leaves for later.
- **A call going on** stays on while its screen is in picture in picture. When the user leaves it altogether, Android stops the microphone and camera of an app in the background: run a foreground service of type `microphone` (and `camera` for video) while a call is on, with `FOREGROUND_SERVICE_MICROPHONE` and `FOREGROUND_SERVICE_CAMERA` from Android 14.
- **Calls ring while the app is open.** Ringing a closed app needs a high-priority push, which comes with push.

## Google Play

- **The data safety form** describes what your app collects, as for any of its features: the SDK sends WordPlus Cloud the user id, the rooms they join, and the data your app sends, sealed with keys WordPlus Cloud does not hold, over TLS. The history of a room keeps that sealed data for as long as its rule says. It shares nothing with advertisers and tracks nothing.
- **Encryption:** rooms are sealed with XChaCha20-Poly1305, calls with the WebRTC DTLS-SRTP and, in group calls, the LiveKit end-to-end frame encryption.

## R8

The libraries need no R8 rules of your own: nothing in them is reached by reflection, and WebRTC brings its own. Your `@Serializable` types for `eventsOf<T>()` need the kotlinx.serialization Gradle plugin, as any serialization does.

## Versions

The calls take the LiveKit Android SDK and its WebRTC build at the versions the Better Messages app is tested with. An app that uses LiveKit itself takes the same versions. Gradle resolves to one, so test calls after an upgrade of either.