The fastest ways to get rejected
Six issues account for a large share of first-submission rejections. If any of these are true right now, fix them before reading further.
No "beta", "demo", "coming soon" or lorem text anywhere in the build or the metadataCommon blocker
Including the version notes and the settings screen nobody looks at.
Guideline 2.1 ↗
Every screen reachable from the tab bar or menu is finishedCommon blocker
No stub screens, no dead ends, no "we will build this next sprint" tabs.
Empty, loading and error states are designed, not blankCommon blocker
A brand new account sees the emptiest version of your app. That is exactly what the reviewer sees.
Every button does something predictable - nothing silently no-ops
A tap that does nothing reads as broken, not as "disabled".
No broken links inside the app (help, legal, social, support)
Reviewers tap them. A 404 in your own settings screen is an easy rejection.
You uploaded the release build, not a debug build
Check for debug overlays, seeded test data, verbose logging and staging hostnames.
Privacy Policy hosted at a public URL that loads without a loginCommon blocker
Not a Google Doc that asks for access. Not behind Cloudflare interstitials.
Guideline 5.1.1 ↗
Terms of Service / EULA publishedCommon blocker
Apple's standard EULA is acceptable if you have not written your own - but user-generated content apps need custom terms.
Both are linked from inside the app, not only from the store listingCommon blocker
Settings or profile is the conventional place.
Privacy Policy URL is entered in App Store ConnectCommon blocker
App information → General. Required for every app, free ones included.
App Store Connect help ↗
Support URL points at a real page with a way to reach you
A contact form, an email address or a working FAQ - not your marketing homepage.
The contact email is monitored
Review sometimes emails instead of writing in Resolution Center. Missing it stalls you for days.
The policy actually describes what you collect, why, who you share it with, and how a user deletes it
A generic template that contradicts your privacy label is worse than a short honest one.
Paid Apps Agreement is activeCommon blocker
Nothing paid - app or IAP - can be sold until this shows "Active" in Business.
Tax forms completed for the territories you sell in
US and any regional forms Apple asks for.
Bank account added and verified
Currency and account holder name must match the legal entity.
Small Business Program enrollment considered
15% instead of 30% under $1M/year. Enrolment is not automatic and applies from the next month.
Small Business Program ↗
Export compliance answered
Most apps using only standard HTTPS are exempt - but you must still answer, and you can pre-answer in Info.plist to stop the prompt on every build.
Encryption export rules ↗
Content rights questions answered honestly
If you display third-party content, be ready to show permission.
Age rating questionnaire completed and matching the real content
Under-rating is a rejection. User-generated content and web views push the rating up.
Set an age rating ↗
Price tier and territory availability set
Default is "all territories" - check the ones where you cannot legally operate.
Primary and secondary category chosen deliberately
Category affects both ranking and which review guidelines get applied hardest.
Bundle ID, version string and build number are final
Bundle ID cannot be changed after the first submission.
Every permission has a purpose string that names the featureCommon blocker
"We use your camera" fails. "Take a photo of your receipt to log an expense" passes.
Purpose strings ↗
Location string explains why you need "always" if you ask for it
Ask for "when in use" unless a background feature genuinely requires more.
Permissions are requested just-in-time, never all at launchCommon blocker
A wall of prompts before the user has seen the app is a classic 5.1.1 rejection.
App Tracking Transparency prompt implemented if you track across apps or sites
Using an ad SDK with IDFA counts. Do not gate app functionality on the user saying yes.
ATT ↗
The App Privacy label matches what your bundled SDKs actually collectCommon blocker
Analytics, crash reporting and ad SDKs collect more than most founders declare.
App privacy details ↗
Third-party SDK privacy manifests and required-reason APIs are handled
Missing manifests bounce at upload time now, not at review.
Privacy manifests ↗
The app runs sensibly when every permission is denied
Degrade, do not crash and do not loop the prompt.
IAP products created, priced, and in "Ready to Submit"Common blocker
A product left in "Missing Metadata" will not be reviewed.
Each product has a review screenshot and a descriptionCommon blocker
The screenshot must show the paywall where that specific product appears.
IAPs are attached to the build you submitCommon blocker
On a first submission you must submit the products together with the app, or they sit unreviewed and purchases fail in production.
The paywall shows price, billing period, and what happens after a trialCommon blocker
Length of trial, price after trial, and that it renews automatically.
Subscription requirements ↗
Annual plans display the full annual chargeCommon blocker
"$4.99/mo billed annually" alone is a rejection - show the $59.88.
No fake urgency, fake discounts, or a hidden close button
Countdown timers that reset, and dismiss buttons that appear after 5 seconds, both get flagged.
Digital features are sold through IAP onlyCommon blocker
No Stripe link, no "subscribe on our website" copy, no hints that a cheaper route exists - unless you hold the relevant external-purchase entitlement for that region.
Guideline 3.1.1 ↗
Restore Purchases works and is reachable without an accountCommon blocker
Must be findable by the reviewer. Test it on a fresh install with the same Apple ID.
A "Manage subscription" link opens the system subscription settings
Deep link to itms-apps or the account subscriptions URL from your settings screen.
Server notifications endpoint configured if you validate server-side
Otherwise cancellations, refunds and billing retries go unnoticed.
Server notifications ↗
Sandbox tested end to end: buy, restore, cancel, expire, renew, refundCommon blocker
Sandbox renewals are accelerated - a year is minutes. Watch what your app does when the subscription lapses.
Account deletion is available inside the appCommon blocker
"Email us to delete" is explicitly not enough. It must be initiated in-app.
Account deletion ↗
Deletion actually deletes - and any legal retention is explainedCommon blocker
Logging the user out and keeping the row is a rejection when they test it.
Sign in with Apple offered if you offer Google, Facebook or similarCommon blocker
Email-and-password only? Then you do not need it.
Guideline 4.8 ↗
Users can choose a username instead of being forced to use a real name
Also do not demand a phone number or birthday you have no use for.
Password reset and email verification actually deliverCommon blocker
Transactional mail silently landing in spam is the most common broken flow in a first submission.
The app does not force a signup wall before showing any value
If the core function does not need an account, let people browse first (guideline 5.1.1(v)).
Any "log in with your existing subscription" path is explained in Review Notes
Reader-app style flows need context or they look like a 3.1.1 dodge.
Users can block another userCommon blocker
Required for any app with user-to-user contact.
Guideline 1.2 ↗
Users can report objectionable content, and the report reaches a humanCommon blocker
A report button that writes to a table nobody reads still fails the spirit of the rule.
You can act on a report within 24 hoursCommon blocker
Describe the process in Review Notes - it is what they are checking for.
Community guidelines / safety policy published
Link it from inside the app as well as your site.
Filtering exists for obviously objectionable uploads
Automated moderation plus a manual queue is the expected minimum.
Your EULA binds users to no objectionable content
This exact term is called out in guideline 1.2.
The first two or three lines of the description say what the app does
That is all that shows before "more". Save the manifesto for later.
Screenshots show real UI from the build you are submittingCommon blocker
Mockups of features that do not exist yet are a rejection and a refund magnet.
Screenshot specs ↗
No competitor names, no Android device frames, no unreleased featuresCommon blocker
Mentioning other platforms in the description is guideline 2.3.10.
Keywords are relevant, comma separated, no repeats and no trademarks you do not own
100 characters. Do not repeat words already in your title or subtitle.
Promotional text is accurate
It updates without a new build - useful, but it is still reviewed.
App name and subtitle do not over-claim
"#1", "Best" and "Free" in the name draw 2.3.7 scrutiny.
App icon matches the icon shown in screenshots and in the build
A mismatch reads as a bait-and-switch.
App preview video, if used, shows only captured in-app footage
No external footage, no hands, no marketing voiceover over fake UI.
Every enabled locale has finished metadataCommon blocker
English pasted into the German listing is a rejection.
Screenshots are localized where the app UI actually changes language
If the app only speaks English, do not claim other locales.
Locales you do not support are removed
Fewer, complete listings beat many half-done ones.
Manage localizations ↗
In-app strings match the languages you claim to support
Test with the device language switched, not just a debug flag.
Full run-through: install, onboard, do the core action, log out, log back inCommon blocker
Log-back-in is where half-finished session handling shows up.
Every button on your three main screens tapped at least onceCommon blocker
Literally every one. This finds more bugs than any other line on this page.
Fresh install and upgrade-from-previous-version both tested
Migrations that only run on upgrade are invisible in dev.
Slow network, airplane mode, and backgrounding mid-requestCommon blocker
Use the Network Link Conditioner. Reviewers are often on hotel wifi.
iPad tested unless you have restricted the app to iPhoneCommon blocker
Reviewers routinely test on iPad, and a stretched iPhone layout that breaks is a rejection.
Tested on the newest iOS and the oldest version you claim to support
On real hardware, not only the simulator.
No crash, blank screen or infinite spinner in a fifteen-minute sessionCommon blocker
Watch memory on the oldest supported device.
Push notifications, deep links and universal links tested from a cold start
Cold start is the case that breaks - the app is not running when the link arrives.
Someone who did not build the app has used it, unguidedCommon blocker
You cannot see your own onboarding any more. Watch a stranger use it before Apple does.
You have rights to every image, font, sound and trademark shipped in the build
Font licences for apps are separate from web licences. Check yours.
No hidden or remotely-toggled features that change what the app does after reviewCommon blocker
Feature flags are fine; shipping a different app to reviewers is a ban.
Third-party API use complies with that platform's terms
Scraping a service that forbids it gets pulled on complaint.
AI features have safeguards, rate limits and a report path for bad outputCommon blocker
Guideline 1.2 now applies to generated content the same way it applies to user posts.
AI-generated content is disclosed where a user could mistake it for expert advice
Especially health, legal and financial output.
Age rating raised if the model can produce mature output
An unfiltered chatbot rated 4+ is a fast removal.
Demo account created, working, and populated with dataCommon blocker
An empty account makes a finished app look unfinished. Seed it.
App review information ↗
Review Notes explain the core flow in three stepsCommon blocker
Short and literal: tap this, then this, then this.
Demo credentials still valid on submission dayCommon blocker
Password rotations and expiring test accounts break silently.
A screen recording is linked if the flow needs hardware, a scan, or a second user
Unlisted YouTube or a direct MP4 link is fine.
Special requirements are called out
Physical device, geofence, Bluetooth peripheral, region-locked backend, a partner account.
Someone can answer Resolution Center within a few hours
Fast replies frequently turn a rejection into an approval on the same day.
The build you are submitting is the build the screenshots showCommon blocker
Check the build number in App Store Connect against the one you tested.
Every URL in the listing loads: privacy, terms, support, marketingCommon blocker
Open them in a private window, on mobile data.
Searched the codebase for TODO, lorem, test@, and staging hostnames
One grep. It catches something surprisingly often.
A new user can reach the core value in under 60 seconds
Time it with a stopwatch on a fresh install.
Version release notes written for humans
"Bug fixes and improvements" is allowed but wastes a free marketing slot.
You are available for the next 48 hours
Do not submit and then go on holiday - a one-line reply can save a week.
Apple approves the build.
Real people decide if it survives day one.
A checklist catches what a reviewer will reject. It cannot tell you that nobody understands your onboarding, or that the sign-up button is invisible on a cheap Android, or that people quit at step three. Boarmoney Deploy lets you pay real people to install your app, run a flow you define, and send back written feedback, screenshots or recordings — before you ship, and after.
- ✓You write the task and the proof you want back: a screenshot, a paragraph, a rating, a recording link.
- ✓Set the reward per person and how many people. Funds sit in escrow until you approve the work.
- ✓Approve manually, auto-approve on a timer, or let our AI reviewer screen submissions for you.
- ✓Fees start at 5% and drop to 1% as your batch grows. Rewards can be fractions of a cent upward.
- ✓Structured response forms for ratings, A/B preferences, transcripts and bug reports — exportable as JSON.
- ✓Fund it with SOL or USDC, or run the whole thing over the API if you are an agent.
Nothing on this page is sent anywhere — the checklist is stored in your browser. Boarmoney Deploy is a separate, optional product.
Questions founders ask before submitting
General guidance, not legal advice. Apple updates the App Review Guidelines regularly — check the current text before you rely on any single point.
How long does App Store review take?
Most reviews finish inside 24 to 48 hours, and Apple reports that the large majority are reviewed within a day. First submissions, apps with subscriptions, and anything submitted just before a holiday freeze take longer. Plan for a week on your first release so a single rejection does not blow your launch date.
What gets apps rejected most often?
Guideline 2.1 (app completeness - crashes, placeholder content, broken flows, missing demo accounts) leads by a wide margin, followed by 5.1.1 (privacy and data collection), 3.1.1 (payments outside in-app purchase), 2.3 (inaccurate metadata) and 4.2 (minimum functionality).
Do I have to offer Sign in with Apple?
Only if your app offers a third-party or social login such as Google, Facebook or X as its primary login. If you only offer email and password, or you use a first-party account system of your own, Sign in with Apple is not required.
Do I really need in-app account deletion?
Yes. If your app lets a user create an account, it must let them start deleting that account from inside the app. Pointing them at a support email or a web form only is not acceptable, though you may explain any data you are legally required to retain.
Can I take payment outside of in-app purchase?
Not for digital content or features consumed inside the app - those must use in-app purchase. Physical goods and real-world services are the opposite: they must not use IAP. External purchase links are possible in some regions under specific Apple entitlements, but they are opt-in programmes with their own rules and commission.
What should I do if I get rejected?
Read the exact guideline number Apple cites, fix that one thing, and reply in Resolution Center with a short description of what changed. Metadata-only rejections often need no new build. If you believe the reviewer is wrong, you can appeal to the App Review Board - but a fast, specific reply resolves most cases quicker.
Is my progress saved?
Yes, in your browser's local storage on this device only. Nothing is uploaded, no account is needed, and clearing site data will reset it. Use the export button if you want a copy to share with your team.