Every App Store readiness check, explained
ReviewAhead checks an Xcode project against 38 App Store readiness rules. Each one has a page here: what App Review is looking for, why apps fail it, and what to change. Every claim is one this scanner acts on.
App Information
Identity, versioning and build configuration (the values App Store Connect reads from your build and the ones you enter beside it.
- Bundle identifierA placeholder or malformed bundle identifier fails upload before App Review sees it. What Apple requires, and how to check yours.Can block submission
- Version and build numberApp Store Connect requires both a marketing version and a build number. What each one is, which setting holds it, and why uploads get rejected.Can block submission
- App icon configurationA submitted app must ship a configured icon set. The three ways an Xcode project gets this wrong, and how to tell which one you have.Can block submission
- Release build settingsENABLE_TESTABILITY, an unoptimised Swift build or a DEBUG flag left on in Release ships an app that behaves differently from the one you tested.Can cause rejection
- App Transport Security exceptionsNSAllowsArbitraryLoads and other broad ATS exceptions have to be justified. Which exceptions draw questions, and which ones signal a development build.Can cause rejection
- Export compliance declarationEvery upload stalls asking encryption questions until this Info.plist key is set. What each value means and which one you need.Recommended improvement
- App display nameThe name under the icon on the Home Screen should be deliberate. An unresolved $(VARIABLE) ships literally.Can cause rejection
- Version metadataWhat’s New in This Version is a required, localizable property for every update. First submissions do not need it.Can cause rejection
App Review
What a reviewer needs in order to exercise your app: credentials, notes, and anything the app cannot demonstrate on its own.
- Reviewer access to gated contentContent behind a login needs working demo credentials in App Review information. The most avoidable rejection there is.Can block submission
- Support and privacy policy URLsA privacy policy URL is required for every app with no exemption. A dead support URL is not technically required but is a routine rejection.Can block submission
- Hardware and setup requirementsIf your app needs a device, an account with a provider, or a physical setup to be useful, the review notes have to explain how to test it.Can cause rejection
App Privacy
Data collection as your app declares it) the privacy manifest in the build, and the App Privacy answers on the product page.
- Permission usage descriptionsA permission requested without its Info.plist purpose string crashes the app on the spot. Which key each permission needs, and what makes a string too vague.Can block submission
- Privacy manifestApps using Required Reason APIs or data-collecting SDKs need a privacy manifest. When it is required, and what a valid one contains.Can block submission
- Required Reason API declarationsApple requires a declared reason for file timestamps, boot time, disk space, keyboards and user defaults. The approved codes, and what makes one invalid.Can block submission
- Tracking declarationBundling an advertising or attribution SDK requires NSPrivacyTracking, tracking domains and an App Tracking Transparency prompt. What each one is for.Can block submission
- SDK privacy disclosureAn SDK collecting data on your behalf has to appear in your privacy policy and your nutrition label. Why the SDK shipping its own manifest is not enough.Can cause rejection
- Collected data declarationsYour privacy manifest has to declare the data types your SDKs collect, not just the ones your own code does.Can cause rejection
- App Privacy declarationEvery data type you and your SDKs collect has to be declared in App Store Connect, classified as tracking, linked or not linked.Can block submission
Age Rating
The questionnaire that sets your rating, and the capabilities in your project that force a minimum.
- Age rating questionnaireAn age rating is required. Unrestricted web access, user-generated content, loot boxes and gambling each push the minimum up.Can block submission
- User-generated content safeguardsApps that let users create, generate or share content, AI apps included, need filtering, reporting, blocking and published contact details. All four.Can block submission
App Accessibility
Accessibility Nutrition Labels, an optional product-page section.
Accounts and Sign-In
Account creation, deletion and third-party sign-in, and the guideline obligations each of them carries.
- In-app account deletionAn app that lets people create an account must let them delete it from inside the app. What counts, and what does not.Can block submission
- Sign in with AppleOffering Google, Facebook or another third-party login usually means you must also offer an equivalent private login option.Can cause rejection
In-App Purchases
StoreKit in the build and the purchase records beside it. Each purchase is reviewed separately from the app.
- App Store Connect productsStoreKit configuration files are local test data. Products have to exist and be submitted in App Store Connect before review.Can block submission
- Restore purchasesNon-consumable purchases and subscriptions need a restore mechanism the user can reach without signing in first.Can block submission
- Subscription disclosureAuto-renewable subscription screens need price, period, renewal terms, a link to your terms of use and privacy policy, and a way to manage the subscription.Can cause rejection
- In-app purchase metadataEach purchase is reviewed separately and needs a display name, a description and an App Review screenshot. The screenshot is a frequent cause of rejection.Can cause rejection
Previews and Screenshots
The sizes App Store Connect requires, worked out from the device families your target ships on.
Export Compliance
Encryption declarations, and the documentation a non-exempt declaration requires.
Capabilities
Entitlements and background modes, which must match the capabilities enabled on your App ID.
- Push notification environmentA release build with aps-environment set to development sends push notifications that never arrive. Why it passes review and fails in production.Can block submission
- Associated domainsAn associated domain left in developer mode bypasses Apple’s CDN and only works on devices with a developer setting enabled.Can cause rejection
- Background modesUIBackgroundModes has to correspond to real, demonstrable behaviour. Declaring location or audio you do not use is a rejection reason.Can cause rejection
- Declared capabilitiesHealthKit enabled without NSHealthShareUsageDescription terminates the app. The other capabilities worth checking against your App ID before you submit.Can block submission
Dependencies
Third-party SDKs in your dependency graph, and the obligations each one creates.
Source Risks
Things found in source that should not ship: credentials, local endpoints, placeholder copy.
- Hardcoded secretsAnything compiled into an app bundle can be extracted from the IPA in minutes. Which keys are a real problem, and which belong there.Can cause rejection
- Development endpointsA reviewer’s device cannot reach your laptop. Development endpoints in shipping code are a blocker because the app simply does not work.Can block submission
- Placeholder user-facing copyLorem ipsum, TODO copy in the interface and fatalError paths read as an unfinished app, which is a rejection in its own right.Can cause rejection
- Test credentials in sourceA test username and password compiled into the shipping app is both a credential leak and a sign of an unfinished build.Can cause rejection
Scan my projectOr skip the reading: scan your project and find out which of these 38 apply to you.