ReviewAhead FAQ: App Store review questions, answered
What ReviewAhead checks, why apps get rejected, what it costs, and what happens to your code. Every answer here is checked against the product, or quotes Apple where it says so.
About ReviewAhead
What is ReviewAhead?
ReviewAhead is a pre-submission check for iOS apps. It reads your Xcode project, a .zip of it or an .ipa, checks it against 38 App Store readiness rules, and reports every blocker and risk it finds with the file, the evidence, the App Review Guideline behind it and a concrete fix. It reduces submission risk; it cannot guarantee approval.
Who is ReviewAhead for?
iOS developers who are about to submit an app or an update to the App Store: indie developers, small teams, and agencies shipping apps for clients, who can hand the full report over as a PDF. It is most useful in the last hour before you submit, and straight after a rejection, when you want to know what else is wrong before you resubmit.
Do I need to install anything, or have Xcode open?
No. ReviewAhead is a hosted scanner that runs in your web browser. There is no local tool, command-line scanner or Xcode plugin to install: you upload the project folder, a .zip or an .ipa, and it is read on the server. Nothing is built, and nothing is run.
How long does a scan take?
The full report is back about 25 seconds after the upload finishes. Nothing is compiled or run, so there is no build to wait for.
Can ReviewAhead guarantee my app is approved?
No, and nothing can. App Review evaluates a running app, its content and its metadata, none of which a project scan can see. What ReviewAhead does is find the preventable problems that are visible in your project, before Apple is the one telling you about them.
Why not just ask an AI chat?
AI can explain an App Store rule. ReviewAhead checks whether your project actually satisfies it: the same 38 versioned rules against your parsed build settings, Info.plist, entitlements and dependency graph, with the file and line behind every finding. There is AI review here too, part of the unlimited plan and switched off until you turn it on from the scan screen, and even then it can only suggest wording and explain a finding: it can never add a finding, remove one, or change a severity.
What it checks
What does ReviewAhead check?
38 rules across your build configuration, Info.plist permission strings, the privacy manifest and Required Reason APIs, third-party SDKs, entitlements and background modes, StoreKit and subscriptions, account deletion, Sign in with Apple, export compliance, required screenshot sizes, and risks left in source such as local endpoints, test credentials and hardcoded secrets. Each rule has its own page saying what App Review looks for and how to fix it.
What can I scan?
The folder that holds your .xcodeproj, a .zip of it, an .ipa, or a GitHub repository you have shared with ReviewAhead, up to 512 MB. Archives are validated before anything is extracted. An archive holding only a Swift package gets dependency analysis but no target, configuration or Info.plist checks, because there is no Xcode project to read. An .ipa is read as a build: the shipped Info.plist, privacy manifests, embedded frameworks and the entitlements it was signed with, and nothing that needs source code, because a build carries none.
Should I scan the project or the .ipa?
The project, if you can. It is the better input: the checks that read source code, such as placeholder copy, local endpoints and hardcoded credentials, only run against source. An .ipa is the one that knows what signing actually did, so it is worth scanning when you want to check the entitlements and privacy manifests that really shipped, or when you would rather not upload source at all. The report names the checks a build could not run instead of passing them silently.
Does it work with XcodeGen or Tuist projects?
Yes. A project generated from an XcodeGen project.yml or a Tuist Project.swift keeps no .xcodeproj in version control, so ReviewAhead reads the manifest instead: targets, bundle identifiers, build settings, packages and the Info.plist keys the manifest declares, including ones written only at generate time.
Why does ReviewAhead ask me questions?
Because some requirements are not in the project. Whether a reviewer can sign in, whether your backend will be up during review, and what your App Privacy answers say live in App Store Connect or in how the app behaves. For an ordinary app a scan asks three to eight questions, most of them pre-filled with what the project suggests, and your answer is what the report records.
Can ReviewAhead read App Store Connect?
If you link the app, yes. The age rating questionnaire, screenshot uploads, release notes, purchase states and review details are then read from your own listing instead of being asked as questions, and that read becomes the evidence. Without a linked app those rules state the requirement and work out which parts of it apply to your build.
Is the result the same every time?
Yes. The rules are deterministic and versioned, so the same project checked twice gives the same report. AI review, if you switch it on, adds explanations and wording suggestions beside the findings, and never changes a finding, a severity or the score.
How do I know a fix worked?
Scan again. Findings are matched by rule, target and evidence key, so a fix counts even when the file moved, and the second report shows what you cleared and what is new. A finding is only marked fixed when the rule stops firing against the new build.
App Store rejections
What are the most common reasons Apple rejects an app?
Apple says that, on average, over 40% of unresolved issues are related to Guideline 2.1, App Completeness: crashes, placeholder content and incomplete information such as missing demo account details. Apple also lists broken links, privacy policy issues, unclear data access requests and inaccurate screenshots among the common issues. In a project, the ones that are visible ahead of time are missing or vague permission purpose strings, a missing privacy manifest, no in-app account deletion, a login the reviewer cannot get past, and purchases with no way to restore them.
Missing permission purpose stringsReviewer could not sign inPlaceholder text
What does a Guideline 2.1 rejection mean?
Guideline 2.1 is App Completeness: Apple expects the build you submit to be final, working and reviewable. A rejection under it usually means the reviewer hit a crash, placeholder text, a login they could not get past, a backend that was not responding, or in-app purchases that were not submitted with the build.
Demo credentials for App ReviewIn-app purchases submitted with the app
What happens if a permission purpose string is missing from Info.plist?
iOS terminates the app the moment the permission prompt would appear, so App Review hits a crash immediately, and that is a rejection. A purpose string that exists but says nothing is a softer problem: it does not crash, but it gets rejected on review under Guideline 5.1.1.
Do I need a privacy manifest (PrivacyInfo.xcprivacy)?
Yes, once your app, or any SDK you bundle, uses a Required Reason API or collects data. The manifest is a PrivacyInfo.xcprivacy file in your app target, and App Store Connect rejects uploads that use Required Reason APIs without declaring them, so this fails before review even starts.
When a privacy manifest is requiredRequired Reason API codes
Does my app have to offer account deletion?
Yes, if people can create an account in it. Guideline 5.1.1(v) requires the deletion path to be inside the app, and to delete the account rather than deactivate it. A support email address, a web form, or a message telling people to contact you does not satisfy it.
When do I have to offer Sign in with Apple?
Generally whenever the app offers a third-party login such as Google or Facebook. Guideline 4.8 asks for an equivalent option that collects no more than name and email and lets people keep both private. Sign in with Apple satisfies it, and so do some other options that meet the same conditions.
Why is my build stuck in Missing Compliance?
Because Info.plist does not set ITSAppUsesNonExemptEncryption. Without it, App Store Connect asks the export compliance questions on every upload, and the build waits in Missing Compliance until somebody answers them. Setting the key answers them once, in the build.
How long does App Review take?
Apple says it typically reviews at least 50% of submissions in less than 24 hours and 90% in less than 48 hours, and that an incomplete submission can be delayed or not pass. A rejection restarts that wait, which is why it pays to find the preventable problems before you submit rather than after.
Pricing and refunds
How much does ReviewAhead cost?
Scanning is free. The free scan shows the readiness score, the verdict, a count of findings at every severity and your three most severe findings in full. The full report, with every finding, its file, its evidence and its fix and a PDF export, is $2.99 once. The unlimited plan is $4.99 a month and covers every scan and every report.
Is a rescan cheaper?
Yes. Rescanning an app whose report you already bought is $1.99 rather than $2.99, because the second report is mostly the comparison. The build has to be the same app, checked on its bundle identifier.
Do I need an account?
Not to scan, and not to buy a single report. The button takes you to sign-in first, and that page has a link straight past it to the scanner. An account keeps your reports and history across devices, and is needed for the unlimited plan, promotion codes and scanning straight from a GitHub repository.
Can I get a refund?
Yes, where something went wrong on ReviewAhead's side: a scan that failed or produced no report, a double charge, a report that was empty or plainly broken, or a report bought while an unlimited plan already covered it. Ask within 30 days of the payment. The unlimited plan also keeps the 14-day right of withdrawal on its first payment. A single report asks you to waive that right before you pay, because it is delivered at once.
Your code and your data
Is my source code stored?
Not as files. The upload and the files extracted from it are deleted when the scan ends, whether it finished, failed or was cancelled. What is kept is the report: the score, the findings, file paths, short evidence excerpts with credentials masked, and the project settings needed to recalculate it. A free report is deleted 24 hours after the scan, one you bought 365 days after payment.
Does my source code leave my machine?
Yes. The scan runs on ReviewAhead’s server, not on your machine, so your project is uploaded over HTTPS, read there and deleted when the scan ends. If you would rather not send source at all, scan an .ipa or a zipped .app instead: a build carries no source code, and the binary inside it is never extracted.
Is my code used to train AI models?
No. ReviewAhead does not train AI models on your project, and does not sell it. AI review, if you switch it on, sends a summary to the model provider (finding titles and explanations, evidence notes, your permission strings, the bundle identifier and SDK names), never your files, your project tree or the evidence excerpts.
Is anything sent to Apple?
No, a scan sends nothing to Apple. If you link an App Store Connect app, Apple is asked what it already holds about that app: the request carries the app id and a signed token, and nothing from your project or your upload.
Does connecting GitHub give ReviewAhead access to all my repositories?
No. Scanning from GitHub uses a GitHub App, which is installed only on the repositories you pick, one by one, on GitHub’s own screen. It has read access to their contents and metadata and nothing else, it never writes, and removing a repository on GitHub takes the access with it immediately.
AI review and agents
What does AI review do?
It suggests clearer permission wording, explains a finding in plain language beside the deterministic explanation, and states in writing where the evidence did not settle something. It is part of the unlimited plan and off until you switch it on, and it can never add a finding, remove one, or change a severity: your score is worked out before it is called.
Can I check my app from Claude Code or Codex?
Yes. ReviewAhead is an MCP server, so Claude Code, Codex or any agent that supports MCP can connect to it, upload your project, read the report and fix what it can in your code, then ask you what only you can answer. Scanning from an agent is part of the unlimited plan.