Short answer. The takeover happens in four steps and six weeks: the inventory of what you have and what is in your name; the recovery, asset by asset, of the store accounts, the domain, the hosting, the code, the data and the keys, with a formal notice if the contract allows it; the audit of the code and data, which decides what is kept, repaired or rewritten; the restart, access locked down, dependencies updated, stores taken over, one-page documentation. The decision to rewrite is made in week four, on the audit, not in week zero on anger. And 2027 makes the takeover urgent: the stores remove apps that are not updated, and worldwide Android developer verification closes the door on hand-distributed APKs.
This guide answers messages we receive every month, from Algerian companies and diaspora founders, and it complements can you know the total price before starting and freelancer, agency or engineering studio, written before the project. Here, the project has already gone wrong.
Why 2027 makes the takeover urgent
Until now, an abandoned app could run for years with nobody touching it. Three things change in 2027.
- The stores remove apps that are not updated. Google Play and the App Store require every year that apps target a recent system version; a frozen app stops being offered to new users, then disappears from results. If the account is in the vanished vendor's name, nobody can update it.
- Worldwide Android developer verification. Google announced that from 2027, apps installed on certified Android devices must come from an identified developer, including outside the Play Store. The fallback of “we'll send the APK on WhatsApp” has an end date.
- Payment and data. With the 2027 finance bill pushing towards electronic collection and Law 18-07 on personal data, an app whose payment and database you do not control is a legal risk, not only a technical one.
We detailed these deadlines in the seven decisions of a mobile app in 2027. For an app already built, they come down to one sentence: what is not in your name does not belong to you, and what is not updated disappears.
The four steps of a takeover
The order matters. Companies that call a new developer asking them to “redo everything” skip the first two steps and pay for a whole project for code that might have held.
The inventory fits on one page: the Google Play and App Store accounts, the domain name, the host and servers, the code repository, the database, the third-party services, SMS, payment, maps, notifications, and for each one, who holds the access and in whose name it is registered. Reread the contract and invoices: what is written about code ownership and handover of access decides what comes next. Recovery is done asset by asset, through the platforms' own procedures, and through a written formal notice to the vendor when the contract allows it; the detail is in the next figure. The audit looks at the recovered code with three questions: is it readable by another developer, are its dependencies up to date and free of known flaws, is the data exportable and sound? The restart locks everything in your name, updates, resumes store publications, tests a backup restore and writes the one-page documentation.
«The decision to rewrite is made in week four, on the audit, not in week zero on anger.»
What can be recovered, and how
The question “can I get my app back” has six answers, one per asset. The left-hand column takes a day; the right-hand column, weeks.
Store accounts. If they are in your name, change the passwords and enable two-factor authentication on your own phone. If they are in the vendor's name, Google Play and the App Store have an app transfer procedure to another account, which requires the holder's cooperation; without it, the app is republished under your account, with a new identifier, and your users must reinstall it. The domain is checked at the registrar: the registrant must be you; otherwise, demand the transfer in writing, and prepare a new domain with a redirect if the vendor does not answer. Hosting: if you have the access, export a full backup immediately; otherwise, the host can sometimes provide a database export to the contract holder. The code: check the repository holds the last deployed version, not one from six months ago; if there is no repository, the production build can be recovered and analysed, but it does not replace source code. Your customers' data belongs to you, and Law 18-07 makes you responsible for protecting it; the export can be demanded. The keys of third-party services, SMS, CIB/Edahabia payment, maps, are all revoked and recreated, in your name, without exception: a key left with the vendor is an open door.
The audit: keep, repair or rewrite
This is the step anger skips. Three cases, decided on the recovered code, with a written total price for each.
- Keep. The code is readable, dependencies update without breaking, data is sound. Maintenance resumes, everything is locked down, an update is published. More common than people think when the vendor was competent but unavailable.
- Repair. The code holds but one part is fragile: patched-together payment, no offline mode, database without backup. That part is replaced, the rest is kept. The price compares to the part, not the project.
- Rewrite. The code is unreadable, or built on a technology nobody maintains anymore, or the data is unrecoverable. We start again from scoping, importing the data and users. It is the only situation where a whole project is justified, and it is observed, not decreed.
An audit is delivered in writing: what was examined, what was found, the three options with their total price, and a recommendation. A vendor who recommends a rewrite without having read the code is selling you a project, not a takeover.
The ownership kit, so it never happens again
Whether you keep or rewrite, the restart installs five layers that make sure no vendor, including us, can ever block your app again.
The accounts for stores, domain and host are in your name, with two-factor authentication on your phone; the vendor is invited with a role, never as owner. The code lives in a repository in your name, where the vendor is a guest and can be removed in one click; it is delivered at every stage, not at the end. The infrastructure: admin access to servers and database is on your side, third-party keys are in a vault in your name, and backups have been restored at least once, because a backup never tested does not exist. The contract writes code ownership, assigned at each payment, and a reversibility clause: access and documentation handed over within fifteen days on request. The documentation fits on one page, where is what and how to deploy, readable by another developer in an hour. It is what we deliver on every project, and it is what to demand from anyone; we explained it in how to choose a developer in Algeria.
«Nothing essential should exist only on the vendor’s computer or phone.»
The six weeks of the takeover
Six weeks, four of them before the most expensive decision.
Week 1, the inventory, with you: the list, the contract, the invoices, screenshots of what exists. Weeks 2 and 3, recovery, in parallel on all assets, with the formal notice sent on day one if the vendor does not answer; every day without access to the store account is a day of removal risk. Weeks 3 and 4, the audit of the recovered code and data, in writing. Week 4, the decision, on the audit, with three total prices. Weeks 5 and 6, the restart: everything in your name, dependencies updated, store publication resumed, restore tested, documentation. If the decision is to rewrite, weeks 5 and 6 become the scoping of the new project, with data and users carried over.
A takeover, inventory, recovery, audit, restart, sits in category 1 of our price grid; repair or rewrite, if the audit justifies them, are priced separately, in writing.
The mistakes we see in takeovers
- Asking to “redo everything” on the first call. A whole project paid for code that would have held. Inventory, recovery, audit, then decision.
- Waiting for the vendor to answer. The stores do not wait. The formal notice goes out on day one, recovery through the platforms in parallel.
- Leaving a single key with the old vendor. SMS, payment, server: a forgotten key is an open door. All revoked, all recreated.
- Republishing under a new account without telling users. They keep the old app, which dies. Message in the old version, data migration, redirect.
- Restarting without a tested backup. The first incident after the takeover wipes everything. A real restore before touching anything.
- Making the same mistake with the new vendor. Accounts in their name, code delivered at the end. The ownership kit is installed on day one of the takeover.
Frequently asked questions
- My developer vanished with the code, what do I do first?
- The inventory: list the store accounts, the domain, the host, the code repository, the database and the third-party services, and note in whose name each is registered. Reread the contract. Then recovery asset by asset, with a written formal notice on day one if the contract allows it.
- Can an app published under the vendor’s Google Play account be recovered?
- Google Play and the App Store have a transfer procedure to another account, which requires the holder’s cooperation. Without it, the app is republished under your account with a new identifier, and your users must reinstall it, with a message in the old version and a data migration.
- Does my customers’ data belong to me?
- Yes. Your customers’ data belongs to you and Law 18-07 makes you responsible for protecting it. The export can be demanded from the vendor or the host, and it is the first thing to back up once access is recovered.
- Do I have to rewrite everything?
- Only if the audit finds it: unreadable code, unmaintained technology or unrecoverable data. Otherwise, keep or repair the fragile part. The decision is made in week four, on the written audit, with three total prices, not on the first call.
- Why is it more urgent in 2027?
- Because the stores remove apps that do not target a recent system version, because the worldwide Android developer verification announced for 2027 closes the door on hand-distributed APKs, and because payment and personal data are now regulated. An app nobody can update has an end date.
- How do I stop it happening again?
- With the ownership kit: store, domain and host accounts in your name with two-factor, code repository in your name where the vendor is a guest, access and keys on your side, a contract with code assignment at each payment and a reversibility clause, one-page documentation. Installed on day one of the takeover.