Shipping

How to pass Apple’s review

Apple’s guidelines run to tens of thousands of words. In practice a small number of them account for most rejections.

1. Give them a working demo account.

   Guideline 2.1 is App Completeness, and the most common way to fail it is a login screen the reviewer can’t get past. Put a username and password in the App Review notes, keep that account alive, and make sure it isn’t rate-limited or region-locked.

2. Don’t gate the core experience behind a sign-up.

   If the app can demonstrate its value without an account, Apple expects it to. A daily puzzle that demands registration before the first question is both a How to avoid getting rejected risk and a How to keep people coming back problem -- let people play as a guest and ask for identity when there’s something worth saving.

3. If you offer social login, offer Sign in with Apple.

   Guideline 4.8. If you use Google, Facebook or similar third-party sign-in, you generally need to offer an equivalent privacy-respecting option alongside it. The rule has been softened over time, so read the current wording rather than trusting a blog post -- including this one.

4. Account creation means How to handle privacy and data deletion, in the app.

   Guideline 5.1.1(v), in force since 2022. If a user can make an account inside the app, they must be able to delete it inside the app -- not by emailing you, not through a web form you link out to. A visible, reachable delete path, and it must actually delete.

5. Digital goods go through Apple’s purchase system.

   Guideline 3.1.1. Anything consumed inside the app -- subscriptions, unlocks, coins, ad removal -- uses How to make money. Physical goods and real-world services do not. Trying to route digital purchases to your own checkout is one of the fastest rejections available.

6. Restore purchases has to exist and has to work.

   A paid app without a working restore is a rejection and a support burden. Reviewers do test it, usually by reinstalling.

7. Permission strings must say why, specifically.

   “This app needs camera access” is a rejection. “Used to scan the QR code on your club’s team sheet” is a pass. Every usage-description string in the Info.plist is read by a human.

8. The privacy labels must match what the app does.

   The App Privacy questionnaire is a declaration, and a mismatch between it and the SDKs you actually ship is treated as a misrepresentation rather than an oversight. Analytics and crash-reporting count as collection.

9. A web page in a wrapper is not an app.

   Guideline 4.2, Minimum Functionality. If the thing could be a bookmark, it will be rejected. Native behaviour, offline capability and platform integration are what separate an app from a shortcut.

10. Expect a day or two, not a week -- but plan for the tail.

    Apple reviews the large majority of submissions within 24 to 48 hours. The tail is what hurts: a rejection resets the clock, and holiday freezes stretch everything. Never schedule a launch against the median.