Is the app on Google Play?

Google Play's policies restrict publishing apps that change the device's location, so the distribution channel here is different. This is not a homemade build “from the internet”: the APK on the website is signed with the developer's permanent key, and the download page lists the SHA256 checksum you can use to verify the file before installing.

The permanent signature matters in practice: it is what lets you install new versions over old ones without uninstalling the app and losing your saved places.