Interesting concept.
As for No. 1, you violate the default security protocol for Android, where applications can not read the personal data of other applications. This includes all Android browsers with their cookies isolated from each other, including your application.
For # 2, why not put a short phrase instead (which is easy to remember. Take a cue from the gfycat url generation, although perhaps try to limit the area and word size) to this single “success” or “reward earned” before being redirected to Play Market? (Not sure if you can embed a play store page in an iframe tag).
Even better, if the URL is directed to the location of your application, but switches a specific element on the page to reveal a passphrase, and perhaps makes the download button more attractive (although it just links to the play store page).
The user can then use a short unique passphrase to unlock rewards in the app.
I see a great novelty in your idea, but this is just a suggestion, since you can’t do much to get around the security policy.
source share