Is Shelf safe?

Shelf is a private-space utility that can appear on the launcher as a habit tracker, calendar, or calculator. Each decoy is a functional app with its own name, icon, and colour scheme. Five taps in the top-right corner open the credential prompt. Settings adds a second, quieter gesture: a long press on the decoy title, or on a natural control inside the decoy. Access uses a PIN, a password, a 3×3…

Developer: melastore
Category: File Encryption & Vault
Earliest archived version: 16 Oct 2026
License: GPL-3.0-or-later (per F-Droid metadata)

02 / Release notes

Release notes from F-Droid

16 Oct 2026

0.10.1

Nothing in the app changed. This release only shortens the store text. - The store description is under F-Droid's 4000-character limit. The detail it dropped is in the README and THREAT MODEL.md. - The 0.10.0 changelog is cut down to fit the 500-character limit.

Full notes →

03 / Package identity

Technical fingerprint

Application IDio.github.melastore.shelf

Latest APK SHA-256b332849ea1aebe9186eda34007daea73e43d7dc44ba94705a91c0c16c88b1927

Signing certificateC0:A8:40:76:71:17:55:1D:EF:E6:28:24:99:CF:23:A1:0C:58:6A:42:DA:67:A8:BB:4F:03:8E:F2:97:D6:A4:05

MIN ANDROID30TARGET37ARCHITECTUREarm64-v8a · armeabi-v7a · x86 · x86_64

04 / Version archive

Documented releases

1 TOTAL

VersionReleasedAndroidArchitecture

0.10.116 Oct 202630+arm64-v8a, armeabi-v7a, x86, x86_64→

05 / Safety & access

Safety verdict

Authentic — file hash matches the source indexNo ads or tracking flagged by the source

IntegritySHA-256 verified vs source

SourceOpen-source · fdroid

Permissions8 declared · 1 sensitive

Signaturepresent

Anti-featuresNo known anti-features

Sensitive accessMANAGE_EXTERNAL_STORAGE

Declared permissions

android.permission.FOREGROUND_SERVICE android.permission.FOREGROUND_SERVICE_SPECIAL_USE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.POST_NOTIFICATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.USE_BIOMETRIC android.permission.WAKE_LOCK io.github.melastore.shelf.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Tracker status: Not assessed by WIKI for Android.

06 / Sources

Evidence ledger

Each entry is a captured public reference backing this record.

RepositorySource package page↗Source codeSource repository↗