At a glance
| Rule | Requirement |
|---|---|
| Accepted input | A .zip archive, or a single .html/.htm file (which becomes index.html) |
| Compression | Standard ZIP (DEFLATE or stored). No RAR, 7z, TAR or password-protected ZIPs |
| Size | ≤ 5 MB zipped on the free plan · ≤ 18 MB on Pro |
| Start page | index.html at the root (recommended) — see the resolution order below |
| Ignored | __MACOSX/ and ._* files |
| Paths | Case-sensitive; forward slashes; relative links |
| Content | Screened against app-store content policy before building |
How the size is measured
The builder re-packs your archive (without the ignored files) and measures the zipped result. That number is usually within a few percent of your ZIP's own size. Text compresses well — a 3 MB JavaScript bundle may zip to 800 KB — while images, audio, video and WOFF2 fonts barely compress at all, so media is almost always what pushes an archive over the limit.
How the start page is chosen
index.htmlat the top of the archive.- Otherwise, if every file sits inside a single top-level folder and that folder contains
index.html, that page — and the folder prefix is removed from every path. - Otherwise, the shallowest
.htmlfile, shortest path first.
Rule 3 exists so a ZIP never fails outright, but it guesses. A project archive with index.html (the dev template) at the root and the real build in dist/ will open the template. Put the real page at the root and the question never comes up.
File names
- Case matters. The asset store inside an APK is case-sensitive;
Logo.PNG≠logo.png. - Spaces and non-ASCII characters work — the browser URL-encodes them in the request and the app decodes them again — but they trip up other tools (build scripts, CSS
url()without quotes). Lower-case, hyphenated names avoid the question. - No
..escapes. A request that tries to climb above the site folder is refused. - Directory URLs are not expanded. A link to
docs/does not servedocs/index.html, except for the site root itself. Link todocs/index.htmlexplicitly.
MIME types the app serves
The WebView refuses to execute a script or apply a stylesheet served with the wrong type, so the app's file server maps extensions explicitly:
| Extension | Served as |
|---|---|
.html .htm | text/html |
.js .mjs | application/javascript |
.css | text/css |
.json .map | application/json |
.svg | image/svg+xml |
.wasm | application/wasm |
.woff .woff2 .ttf | font/woff, font/woff2, font/ttf |
| Everything else | Android's built-in type table, or application/octet-stream |
Files served as application/octet-stream (a .glb model, a custom .dat) still load fine through fetch() and game-engine loaders; they just are not rendered directly by the browser.
What should not be in the ZIP
Anything in the ZIP ships in the APK, and anyone can unzip an APK. Keep out .env files, private keys, .git, node_modules and source maps — the junk cleaner removes all of them in one pass. And never rely on a "hidden" file for security: a value your JavaScript can read is a value any user can read.