Missed context...
However, important context:
This is not a production EU app that citizens are being asked to install today.
It is the official DEMO / DEV reference implementation (white-label blueprint) published at ageverification.dev and on GitHub. The project docs are explicit:
“This white-label application is a reference implementation … that should be customised before publishing it.”
Pre-built APKs and hosted services are for testing and demonstration purposes only.
It ships relaxed storage (SharedPreferences for PIN/flags, visible PNGs) deliberately so developers in 27 member states can quickly test flows, debug, and reset state on emulators/devices.
That said — fair criticism remains:
Even for a reference/demo, the defaults are weaker than they should be (no secure-by-default keystore/Keychain example in the obvious path, no strong tamper detection in the demo build).
The European Commission’s public statements (“technically ready … highest privacy standards in the world”) created the misleading impression that this was a finished, hardened product. That was sloppy messaging.
This by design so they can say: "Well this is not working, we'll keep privacy in mind but everything you do will be send it our servers and stored forever."