First submission checklist

Do first, because it has a fixed floor

Closed testing. Some new personal Play developer accounts must run a closed test with a minimum number of opted-in testers for a continuous period before applying for production access. Testers must actually accept and install; a list of email addresses is not a list of testers. Take the current numbers from Play Console. Detail.

Target API level. Google's annual deadline blocks publishing rather than triggering a review conversation, and raising it opts you into that Android version's behaviour changes. Do it early enough to find the library that has not caught up. Detail.

Privacy manifests, the biggest RN-specific risk

# what already carries a manifest
find node_modules -name "PrivacyInfo.xcprivacy" | sed 's|node_modules/||' | cut -d/ -f1 | sort -u

# every manifest in the tree parses
find . -name "PrivacyInfo.xcprivacy" -exec plutil -lint {} \;

# what actually resolved into the build
grep -E '^ +- ' ios/Podfile.lock | sed 's/[ -]*//' | cut -d' ' -f1 | sort -u

Apple's rule is per-bundle: your app's manifest does not cover a dependency, and a dependency cannot lean on yours. hermes is on Apple's SDK list, which makes this near-universal for React Native.

Of the most popular React Native packages that ship native iOS code, about 11 percent carry a manifest of their own, so most of your tree does not. The census. · Apple's list mapped to npm packages. · ITMS-91053 · ITMS-91061

Permissions and background modes

/usr/libexec/PlistBuddy -c "Print" ios/*/Info.plist | grep -i 'UsageDescription' -A1
/usr/libexec/PlistBuddy -c "Print :UIBackgroundModes" ios/*/Info.plist 2>/dev/null
find android -path '*intermediates*' -name 'AndroidManifest.xml' | head -1 \
  | xargs grep -E 'uses-permission|foregroundServiceType'

For each entry, answer in one sentence: which user-facing feature stops working if this is removed? Anything you cannot answer is a rejection waiting, because App Review asks the same question.

Guideline 2.5.4 rejects a declared location background mode with no genuine persistent-location feature. Guideline 5.1.5 rejects apps that demand location up front or break without it. Permission audit. · 2.5.4 · 5.1.5

Accounts, payments, metadata

• In-app account deletion if you support account creation, plus a web-accessible route for Play. Satisfying one does not satisfy the other. Detail.
• Paywall carrying subscription title, length, localised price read from StoreKit rather than hard-coded, working terms and privacy links, plain auto-renewal wording, and a restore purchases path you have tested on a second device. 3.1.2
• In-app purchase for your own subscription; Stripe is fine for real-world services. 3.1.1
• No references to other mobile platforms in description, keywords, promotional text, screenshots or in-app strings. 2.3.10
• No placeholder content. Lorem ipsum, TODO, example.com, a privacy policy link that 404s.
• Play Data safety derived from what your SDKs actually collect, not from memory. Detail.

The Expo trap that costs a whole extra cycle

ios/ and android/ are build artefacts, regenerated from app config and config plugins on every prebuild. A fix applied there works locally, vanishes on the build server, and produces an identical second rejection.

Anything that must survive a build lives in app.json, app.config.js or a config plugin. Why RN and Expo fail differently.

The morning you submit

• Test the demo account from a device that is not yours, in a private session. Broken demo credentials are a Guideline 2.1 rejection and entirely self-inflicted.
• Seed the demo account with data, so a reviewer does not see an empty app.
• Write the review notes: credentials, where to find the non-obvious features, one line per sensitive permission naming the feature, and anything that looks wrong but is not. Review notes that work.
• Open every link in the built app, including the privacy policy, from the device.

What none of this covers

Guideline 4.2 minimum functionality and 4.3 spam are humans deciding whether your app does enough to exist and whether it looks like forty others. 1.4.1 medical scrutiny is a human reading your claims. No checklist predicts them, and any tool implying it can guarantee approval is selling certainty that does not exist. 4.2 · 1.4.1

shipcheck runs every deterministic item above against your local project, before you build, inside the Claude Code session you already have open. No account, no repository upload, first scan free with real findings. What it checks.

Questions and answers