Who makes the Hesgoal app?
Not a marketing answer. The package ID, the signer, the certificate digest and the third-party services inside the file.
The publisher
The app is published by the Hesgoal App Team, which also
operates this site. The user-facing app label is “Hesgoal”. The
package is com.vvstreams.app, and the signing
certificate names CN=VVStreams.
“Official” is a loaded word, so we avoid it. The accurate statement is narrower: this is the developer's own download page for the app, and the file linked here is the file that team signed. It is not a claim of continuity with any other site that used the Hesgoal name.
What the package proves
An APK is a signed archive. The signer tells you which key signed the file; the hash tells you whether the bytes match the file that was published. Together they are the only reliable way to know that the app on your phone is the app we shipped. The verification guide has the commands.
| Property | Value | Source |
|---|---|---|
| Application label | Hesgoal | Android manifest |
| Package ID | com.vvstreams.app | Android manifest |
| Version | 3.3 | Android manifest |
| Signer DN | CN=VVStreams | apksigner verify --print-certs |
| Signer certificate SHA-256 | 0fe99515295e79461b8f49d1397a703c327777a0b8cf83cbaecb6cef64de686d | apksigner verify --print-certs |
| APK SHA-256 | CAEEB637C878D6DD00171A187B4DC2A2C019DA14D1F74A674A52A6FDEC8C5266 | File hash |
| Firebase project | vvstreams-295dd | Embedded Firebase configuration |
| Stream source strings | streamed.pk, embed.st | DEX string analysis |
| Media stack | Media3 / ExoPlayer | DEX and manifest components |
| UI stack | Jetpack Compose / Material 3 | Package dependencies |
What “official” does and does not mean
It means the file is distributed by the team that signed it. It does not mean the app is endorsed by any league, broadcaster or rights holder, and it does not mean the streams it surfaces are licensed. The app has no affiliation with the Premier League, UEFA, any club or any broadcaster.
It also does not mean the name is a registered trademark. The team
publishes under the Hesgoal name; it does not claim the old
hesgoal.com operation or any ™/® rights.
Third-party services inside the app
The package includes Firebase Analytics, the Google Mobile Ads SDK (AdMob), Install Referrer and the Android Privacy Sandbox ad APIs. It does not contain Firebase Crashlytics, and we found no certificate- pinning code. The app privacy page covers what those services collect and how to limit it.
How to verify a build
- Download the file from the download page.
- Compare the SHA-256 with the published value.
-
Run
apksigner verify --print-certsand compare the certificate digest. - If either differs, delete the file.
