Are Theaimart Apps Safe? How Listings Are Checked Before You Open One

Theaimart lists software made by independent developers, so "is it safe?" is a fair question to ask before opening anything from it. This article describes what is checked before a listing goes public, and where those checks stop.

Theaimart never hands you an installer file#

Theaimart does not accept or distribute installer files: no APKs, no Windows, macOS or Linux installers. Every listing reaches you in one of three ways:

• Google Play. An Android app links to its Google Play listing, and you install it from Google Play, under Google's own review and protections.
• The developer's website. The website link is shown only after the developer has proven they control that site (see below).
• A web app. It opens in your browser, on the developer's site or inside Theaimart's sandbox.

There is no file from Theaimart for anyone to tamper with, because Theaimart never serves one.

1. Links are checked before they are saved#

• Google Play links must point to https://play.google.com. The server rewrites them to the canonical listing address and rejects look-alike hosts such as play.google.com.example.com.
• Website links must use HTTPS. The site stays hidden from the listing until the developer proves they own it. To do that, they publish a one-time token at /theaimart.txt on that site, and the server fetches it to check. If the developer changes the website, the proof is cleared, so a listing cannot quietly swap a verified site for an unverified one.
• Web app links must be full http:// or https:// addresses. Anything else, such as a javascript: link, is never opened.

2. Every listing is reviewed before it is public#

New listings are created as pending. They appear on the marketplace only after an administrator approves them.

Approval is not a one-time event. Under the Terms of Service, Theaimart can remove, restrict or delist a listing later.

3. Web apps built on Theaimart run in a sandbox#

Web apps generated with Theaimart's builder run on a page served with a Content-Security-Policy: sandbox header. The app gets an isolated origin with no access to your Theaimart session, and its network access is limited to Theaimart's own APIs.

Before such an app is stored, its HTML is scanned. Cryptocurrency miners are refused outright. Pages that look like a login form, ask for card details or redirect you elsewhere are flagged for the reviewer.

4. Developer badges come from real ratings#

A developer's badge is earned from ratings by distinct users. Each person counts once, and a developer's own reviews of their apps are excluded. A badge says other people rated the developer's apps well. It is not a security certificate.

What these checks cannot tell you#

Being honest about the limits matters as much as the checks themselves:

• Review is not an audit. An administrator checks the listing and its links, not every line of the developer's code.
• Google Play and the developer's website are outside Theaimart. Once you leave Theaimart, that store's or site's rules and protections apply.
• An app can collect more data than you expect without being malware. Read the listing's privacy policy link when the developer provides one; the listing says so when they have not.
• Theaimart is not a party to your agreement with the developer. The Terms of Service set out what Theaimart does and does not guarantee about third-party listings.

What you can do#

• Get Android apps from the Google Play link on the listing, not from APK files shared elsewhere.
• Check who the developer is and whether a privacy policy is linked before you sign up or pay.
• Report a listing that behaves suspiciously to contact@theaimart.co, the address the Terms of Service name for abuse reports, or use the contact form.

Developers publishing on Theaimart can find the submission steps in the developer documentation, and people browsing can start from the AI App Marketplace.