Missed context...
However, important context:
This is not a production EU app that citizens are being asked to install today.
It is the official DEMO / DEV reference implementation (white-label blueprint) published at ageverification.dev and on GitHub. The project docs are explicit:
“This white-label application is a reference implementation … that should be customised before publishing it.”
Pre-built APKs and hosted services are for testing and demonstration purposes only.
It ships relaxed storage (SharedPreferences for PIN/flags, visible PNGs) deliberately so developers in 27 member states can quickly test flows, debug, and reset state on emulators/devices.
That said — fair criticism remains:
Even for a reference/demo, the defaults are weaker than they should be (no secure-by-default keystore/Keychain example in the obvious path, no strong tamper detection in the demo build).
The European Commission’s public statements (“technically ready … highest privacy standards in the world”) created the misleading impression that this was a finished, hardened product. That was sloppy messaging.
This by design so they can say: "Well this is not working, we'll keep privacy in mind but everything you do will be send it our servers and stored forever."
What does such an app showcase, that cannot be shown with a wireframe?
Kind of weird to make a prototype for an app that shall be security heavy, without any real security hardening.