Rejection guides

One page per guideline, quoting Apple's own text, with the React Native and Expo specifics Apple's documentation doesn't cover.

Everything in this section

• Account deletion on both stores — Apple requires in-app account deletion. Google additionally expects a web-accessible route. Satisfying one does not satisfy the other, and the differe
• App privacy labels: what gets checked, and how RN apps get them wrong — The App Privacy label is a declaration compared against what your app actually does. Third-party SDKs collect on your behalf, and that is your declara
• Apple's required-manifest SDKs, mapped to npm packages — A complete, machine-readable map of every SDK on Apple's third-party privacy-manifest list to the React Native and Expo npm packages that bring it int
• Google Play, for React Native and Expo apps — Data safety declarations that must match your SDKs, target API level that blocks publishing rather than triggering review, background location declara
• Guideline 1.1: objectionable content — Most developers assume this one is about apps unlike theirs. The categories that actually catch ordinary apps are user content, AI output, health clai
• Guideline 1.2: the four UGC requirements, and why AI apps trip it — If users can see content other users created, Apple requires filtering, reporting, blocking, and published contact. What each one means in practice, a
• Guideline 1.4.1 — medical and health apps — Health apps face greater review scrutiny, must disclose their data and methodology, and get rejected for accuracy claims they cannot support. What tha
• Guideline 2.1, and what reviewers actually test — App completeness is the most common rejection and the most self-inflicted. The five things a reviewer will actually try, and how to check each before
• Guideline 2.3.1: hidden features, and what counts as one — Apple rejects apps containing functionality not visible during review. Feature flags, remote config, debug menus and staged rollouts all touch this, a
• Guideline 2.3.10 — other platforms in your metadata — Apple rejects app metadata that names other mobile platforms. What counts, where it hides in a React Native project, and the screenshots that catch pe
• Guideline 2.5.1: private APIs you did not call — Apple rejects apps using non-public APIs. In a React Native project the call almost always comes from a library, is found by static analysis at upload
• Guideline 2.5.4 — background modes without a feature — Apple rejects apps that declare the location background mode without a genuine persistent-location feature. In Expo projects the key is often injected
• Guideline 3.1.1 — in-app purchase — Digital goods go through in-app purchase. Real-world services rendered offline do not. The line matters for any app that both sells a subscription and
• Guideline 3.1.2 — subscriptions — What must be disclosed on a subscription paywall, which parts of it are objective and testable before you submit, and the RevenueCat and Expo details
• Guideline 3.2.2: business practices Apple will not host — Dark patterns, artificial scarcity, misleading trial mechanics and manufactured reviews. What is listed, what actually gets caught, and why growth tac
• Guideline 4.1: copycats — Apple rejects apps that copy another developer's app. The line is not about categories or features, it is about identity, and the RN failure mode is a
• Guideline 4.2 — minimum functionality — The rejection that says your app does not do enough to justify being an app. What it actually covers, the patterns that trigger it, and why this is th
• Guideline 4.8: when you must offer Sign in with Apple — The rule is narrower than most people think and it still catches React Native apps. When an equivalent login option is required, what counts as equiva
• Guideline 5.1.5 — location services — Apple rejects apps that demand location up front or do not work without it. The staging pattern that avoids it, and how Android's separate background-
• Guideline 5.2: intellectual property — Using a platform's name, a trademarked term, scraped content or someone else's API without permission. What actually gets caught, and the dependency-s
• iPad support: claiming it is easy, having it is not — An app listed as iPad-compatible is tested on iPad. What a reviewer does there, why React Native apps fail it in the same three places, and how to dec
• ITMS-90683 — missing purpose string — Your app links a framework that accesses protected data and the Info.plist has no usage description for it. Why React Native apps hit this without tou
• ITMS-91053 — Missing API declaration — What ITMS-91053 means, why a React Native or Expo app triggers it without touching the API itself, how to find which bundle is responsible, and the ex
• ITMS-91054, ITMS-91055 and ITMS-91056 — The three invalid-declaration errors, what each one actually means, the exact strings App Store Connect sends, and how to find the malformed PrivacyIn
• ITMS-91061 — Missing privacy manifest — ITMS-91061 means a framework on Apple's required-SDK list shipped without a privacy manifest. How to identify the framework in a React Native or Expo
• Play's account deletion requirement — Play requires an in-app deletion path and a publicly reachable web URL. The second one is the half teams miss, because Apple does not ask for it and n
• Play's closed testing requirement — Some new personal developer accounts must run a closed test with a minimum number of testers over a set period before applying for production access.
• The Play Data safety form, and why RN apps declare it wrong — The Data safety section must match what your app and its SDKs actually do. In a React Native project the SDKs do things you did not declare, and Googl
• Play foreground service types — Android requires every foreground service to declare a type matching its real behaviour, and Play requires a justification for the sensitive ones. Wha
• The Play permissions declaration — SMS, Call Log, All files access, background location and a few others need an approved declaration before you can publish. What each one requires, and
• Play target API level, and what it blocks — Google requires new apps and updates to target a recent Android API level by an annual deadline. It is not a review conversation — it blocks the uploa
• The React Native privacy-manifest census — We checked the most popular React Native npm packages for a PrivacyInfo.xcprivacy file. Of the 201 that ship native iOS code, 22 have one. The method,
• Apple's required reason API categories and approved reason codes — The complete list of NSPrivacyAccessedAPICategory values and the approved reason codes for each, transcribed from Apple's own documentation, with the
• Screenshots and app previews — Screenshots must show the app, on the right device, without other platforms, without fabricated content. The specific rules that produce rejections, a
• Web wrappers: when a WebView app is not enough — An app that is a website in a container is the clearest case Guideline 4.2 addresses. What separates a wrapper from a hybrid app that ships fine, and