Safety & Scam Prevention

Oinkoin is an open-source, privacy-focused expense tracker. It is not affiliated with any token, cryptocurrency, or token sale. Scammers sometimes impersonate projects to request funds, tokens, or personal information. Stay safe with the guidance below.

Quick Tips

• Never send money, tokens, or private keys to anyone claiming to represent Oinkoin.
• Official releases are on GitHub releases and the Play Store; verify release assets on the project GitHub.
• Do not trust unsolicited messages, replies, or social media DMs promising giveaways or airdrops.
• Check URLs carefully; attackers often use lookalike domains. Official project links are on the GitHub repository and this website.
• If in doubt, open an issue on our GitHub issues or contact the maintainer via the repository.

Report Scams

If you encounter a scam impersonating Oinkoin, please report it on GitHub or contact the platform where it appeared (e.g., social networks, app stores). Include screenshots and links when possible.

Verify the APK

The APKs published on the GitHub releases page are signed with the Oinkoin signing certificate. You can verify that an APK is genuine by checking its signing certificate SHA-256 fingerprint, which must match the official one below:

How to check the fingerprint

On a computer with the Android SDK build-tools installed, run:

The value of Signer #1 certificate SHA-256 digest in the output must match the fingerprint above. You can also compare hashes with AppVerifier or certhashviewer.

Google Play and F-Droid

APKs installed from the Google Play Store are signed with the same Oinkoin signing certificate, so the fingerprint above applies to them as well. The only exception are APKs built and distributed by F-Droid: they are re-signed by the F-Droid project with its own keys and will therefore not match this fingerprint — that is expected and does not mean the F-Droid build is fake.