Overview
A cross-platform VPN client built on a WireGuard core, with native tunnel management, multi-region server selection, and a complete privacy and rebrand lifecycle — designed, built, signed and shipped to Google Play.
The problem
The client needed a real VPN: not a wrapper around someone else's SDK, but a proper tunnel with native service integration, reliable connection state, and store-compliant privacy handling. It also had to survive a full rebrand from Zerova to Zystra without breaking existing installs or the signing chain.
Approach
- Built the tunnel in the native Android layer via
VpnServiceand the WireGuard core, keeping the Flutter UI as a thin state reflector. - Implemented connection lifecycle — connect, disconnect, reconnect-on-network-change and a foreground service notification.
- Added multi-region server selection with latency-aware defaults and per-region configs.
- Wrote the VPN service declaration, data-safety form and privacy policy to match actual app behaviour.
- Preserved the signing key through the rebrand so Play treated the new identity as an update.
Result
A production VPN client delivered through the full store lifecycle — including VPN declaration, data-safety compliance and a rebrand handled without losing update continuity on Google Play.
