App Store Review

App Store Review Guidelines Checker

Comprehensive guide for evaluating iOS, macOS, tvOS, watchOS, and visionOS app code against Apple's App Store Review Guidelines. This skill covers EVERY guideline point to identify potential rejection issues before submission.

Supports: Swift, Objective-C, React Native, and Expo apps

Guidelines current through: Apple's June 8, 2026 App Review Guidelines update (verified still current as of August 29, 2026). Also incorporates post-June policy announcements: social media age-rating questions (mandatory September 2026), Republic of Korea age rating changes (August/October 2026), and Brazil/EU alternative payment and distribution terms.

When to Apply

Use this skill when:

• Preparing an app for App Store submission
• Reviewing code for compliance issues
• Implementing features that may trigger review concerns
• Auditing existing apps for guideline violations
• Building features involving payments, user data, or sensitive content

Guideline Sections

Read individual rule files for detailed explanations, checklists, and code examples:

Risk Levels by Category

Quick Reference: High-Risk Rejection Patterns

For ATT findings, verify the SDK's configuration and actual data use. For account deletion, verify the destination and flow. For logging, inspect the data exposed and any redaction. If that evidence is unavailable, report what needs verification instead of declaring a rejection based on an API call, SDK import, or URL alone.

Critical Issues (Immediate Rejection)

Swift:

// 🔴 Private API usage
let selector = NSSelectorFromString("_privateMethod")

// 🔴 Hardcoded secrets
let apiKey = "sk_live_xxxxx"

// 🔴 External payment for digital goods
func purchaseDigitalContent() {
    openStripeCheckout() // Use StoreKit instead
}

React Native / Expo:

// 🔴 Hardcoded secrets in JS bundle
const API_KEY = 'sk_live_xxxxx'; // REJECTION

// 🔴 External payment for digital goods
Linking.openURL('https://stripe.com/checkout'); // Use react-native-iap

// 🔴 Dynamic code execution
eval(downloadedCode); // REJECTION

// 🔴 Major feature changes via CodePush/expo-updates
// OTA updates for bug fixes only, not new features!

High-Risk Issues

Swift:

// 🟡 Starting Apple-defined tracking without ATT authorization
// Illustrative helper: links user data across companies for ad targeting
enableCrossCompanyAdTracking() // Called before ATT authorization

// 🟡 Account creation without deletion
func createAccount() { } // But no way to initiate deletion in the app

React Native / Expo:

// 🟡 Starting Apple-defined tracking without ATT authorization
// Illustrative helper: SDK links user data across companies for ad targeting
initializeTrackingAdSDK(); // Called before ATT authorization

// ✅ First-party analytics alone does not require ATT
// Assumes no IDFA access, cross-company advertising use, or data broker sharing
import analytics from '@react-native-firebase/analytics';
analytics().logEvent('event');

// 🟡 Delete Account button opens instructions with no deletion flow
Linking.openURL('https://example.com/help'); // Verified instructions-only page
// ✅ An in-app button may link directly to a page that completes deletion
Linking.openURL('https://example.com/delete-account');

// 🟡 Sensitive data exposed in production logs (1.6 / 5.1)
console.log('Access token:', accessToken); // Remove the secret or redact it

// 🟡 Social login without a privacy-preserving alternative (4.8)
<GoogleSigninButton /> // Also offer a login meeting 4.8 criteria
                       // (Sign in with Apple is the simplest option)

// 🟡 Pre-permission button that asks for the grant (5.1.1(iv))
<Button title="Enable Location" onPress={requestLocation} /> // Use "Continue" or "Next"

// 🟡 Custom review prompts (5.6.1)
showCustomAlert('Rate us 5 stars!'); // Use StoreReview.requestReview()

Medium-Risk Issues

// 🟠 Vague purpose strings in Info.plist
"This app needs camera access" // Be specific!

// 🟠 WebView-only app (insufficient native functionality)
const App = () => <WebView source={{ uri: 'https://site.com' }} />;

// 🟠 References to Android in iOS app
const text = "Also available on Android"; // REJECTION

Pre-Submission Checklist

Privacy (Section 5.1)

• Privacy policy link in App Store Connect
• Privacy policy link accessible within app
• All purpose strings are specific and accurate
• App Privacy details completed in App Store Connect
• ATT authorization obtained before Apple-defined tracking or IDFA access (see 5.1.2); first-party analytics alone does not require ATT
• If app supports account creation, deletion can be initiated in-app; a direct link to complete deletion on the web is allowed
• Data minimization - only requesting necessary permissions
• Custom screens before a permission prompt have only one button, labeled neutrally (e.g. "Continue" or "Next"), that opens the system prompt; no "Allow"/"Enable" wording or Cancel/Close actions (see 5.1.1(iv))
• User consent obtained before data collection

Payments (Section 3.1)

• StoreKit used for all digital purchases
• Restore purchases implemented
• Subscription terms clearly displayed
• Loot box odds disclosed if applicable
• No external payment for digital goods (unless entitled)
• Credits/currencies don't expire

Safety (Section 1.x)

• No objectionable content
• UGC moderation implemented (filter, report, block, contact)
• UGC violations can be removed quickly and backed by a remediation plan
• Kids and teens receive age-appropriate experiences inside the app
• Parental gates for Kids Category apps
• No false information or prank features
• Medical disclaimers if applicable
• No substance promotion

Performance (Section 2.x)

• Age rating questionnaire's social media capability questions answered (mandatory for submissions starting September 2026; apps with a social feed get a "Social Media" descriptor and Time Allowances category)
• No crashes or bugs
• Tested on both iPhone and iPad — App Review currently reviews on iPad Air 11-inch (M3) and iPhone 17 Pro Max (as of August 2026)
• All features complete and functional
• No placeholder content
• IPv6 tested and functional
• Demo account provided if needed
• Using only public APIs
• No deprecated APIs
• Proper background mode usage

Design (Section 4.x)

• Sufficient native functionality (not just web wrapper)
• No copycat concerns
• Original app name and branding
• No duplicate Bundle ID spam or low-effort saturated-category clones
• Live Activities, push notifications, and Game Center are not used for spam, phishing, or unsolicited messages
• Extensions comply with guidelines
• Login alternatives if using social login
• Not monetizing built-in capabilities

Legal (Section 5.x)

• No unlicensed third-party content
• Proper Apple trademark usage
• Gambling license if applicable (with real location-based geo-restriction)
• VPN uses NEVPNManager API
• COPPA/GDPR compliance for kids
• Review prompts use the system API only (no custom prompts)
• No review, chart, search, or referral manipulation (5.6)