Personally I would run a grep to find if someone has already been doing that. This is also difficult to use in forgotten password forms.

I am not sure m4a format can be played on Android devices.

Why wouldn't it? It's an open standard. Even if AAC decoding isn't built in, you could easily provide your own decoder for it.

Of course it can. m4p files are right out but those should be nearly extinct by now.

The player app on my phone plays just about every audio format available, including ogg and flac.

I once got into the iOS app store in 2 hours, it was the first time I was sending an app to the store and it was in 2012. So don't count on anything. App Store may come out and ruin all your plans.