How to follow App Store review guidelines

Issue #1069

Apple’s App Review Guidelines are long and hard to read. This article covers the parts that matter most, in plain words.

When you break a rule, one of three things happens:

1. Rejected. Apple turns down your update. You fix it and try again.
2. Removed. Apple takes your app off the App Store.
3. Banned. Apple closes your developer account. All your apps go with it.

Below are the rules for each one, starting with the worst. Each rule links to Apple’s own text so you can check the details. Apple updates the guidelines often, so always trust their page over any summary, this one included.

Rules that get you banned

Apple says it clearly: if you try to cheat, your apps are removed and you’re kicked out of the Apple Developer Program (intro).

Cheating means lying to Apple or to users. Here’s what counts:

Watch out for hidden features. Your app must do what Apple saw during review. If you turn on new features from your server after approval, that can count as hiding them. Apple says this can get your account closed, not just your app rejected. A related rule, 2.5.2, says apps can’t download code that adds or changes features. If you use over-the-air updates, for example in React Native or Expo, keep them to fixes.

Watch out for your ads, too. The fake price and fake feature rule covers marketing “within or outside of the App Store.” So a social media ad that promises something your app doesn’t do counts.

Be nice. The Developer Code of Conduct bans harassing users or Apple staff. Lots of bad reviews and refund requests can also count against you.

If you’re banned, you can ask to come back. You have to send Apple a written plan to fix things, and Apple decides.

Rules that get your app removed

These won’t always close your account. But your app can be pulled from the store, and doing it again and again can still get you banned.

If users can post or generate things, you need moderation. This covers chat, comments, social features, and AI apps that let users create content. Rule 1.2 says you need all four:

• A filter for bad content
• A way to report bad content, and quick replies to reports
• A way to block abusive users
• Contact info people can find

Apple names nonconsensual intimate imagery as one of the problems these safeguards must handle. If your app makes images with AI, plan for this from day one.

Don’t copy other apps. Don’t clone a popular app and change the name. Don’t use another company’s name, logo, or icon without permission. See 4.1 and 5.2.

Don’t make another basic app in a crowded category. Apple has enough dating, flashlight, sound effect, wallpaper, timer, and fortune telling apps. Yours must be clearly better or different. Apple may remove these apps if they’re not updated or nobody uses them (4.3).

Rules that get your update rejected

This is where most problems happen. They’re easy to fix, but each rejection costs you days of waiting.

Your app must be finished

• No crashes or obvious bugs
• No placeholder text, empty pages, or broken links
• If your app needs a login, give Apple a test account
• Keep your server running while Apple reviews

See 2.1.

Also, describe every new feature clearly in the Notes for Review box in App Store Connect. Apple says vague notes will be rejected (2.3.1).

Your App Store page must be honest

• Only show features your app really has (2.3.1). Apple’s example: “virus scanners” for iPhone don’t work, so don’t sell one.
• Keep your app name to 30 characters or less (2.3.7).
• Don’t stuff your listing with other brands or popular app names to show up in search (2.3.7).
• Don’t put prices in your app name, subtitle, screenshots, or previews (2.3.7). To be safe, treat words like “Free” or “50% off” as prices too.
• Don’t mention other platforms, like Android, in your app or listing (2.3.10).
• Answer the age rating questions honestly (2.3.6).

Your code must play by the rules

• Only use Apple’s public APIs (2.5.1)
• Don’t download code that adds or changes features (2.5.2)
• Only run in the background for allowed reasons, like music, calls, or location (2.5.4)
• No crypto mining on the phone, even from ads (2.4.2)
• Don’t change how the volume buttons, silent switch, or other system controls work (2.5.9)
• Make sure your app works on IPv6-only networks (2.5.5)
• Test on iPad too. Apple wants iPhone apps to run on iPad when possible (2.4.1)

Your app must be safe

• No hateful or discriminatory content (1.1.1)
• No realistic torture or abuse (1.1.2)
• No porn (1.1.4)
• No fake health tools. An app can’t measure blood pressure, blood sugar, body temperature, or blood oxygen, or take x-rays, using just the phone’s sensors (1.4.1)
• Drug dose calculators must come from a trusted source, like a drug maker, hospital, or pharmacy, or be approved by the FDA or a similar agency (1.4.2)
• Don’t push smoking, vaping, illegal drugs, or heavy drinking (1.4.3)
• Don’t push people to do dangerous things (1.4.5)

Use Apple’s payment system for digital things

If users pay to unlock something inside your app, use In-App Purchase. Don’t unlock features with your own license keys, QR codes, or crypto (3.1.1). There are some exceptions, so check 3.1.3 if you think your app is one.

A few more money rules:

• Restore: give users a way to restore their past purchases (3.1.1).
• Coins and credits: anything bought with In-App Purchase can’t expire (3.1.1).
• Loot boxes: show the odds of each item before people buy (3.1.1).
• Prices: Apple rejects apps with crazy high prices meant to cheat people (3. Business).
• Subscriptions: they must last at least 7 days and keep giving value. Before people subscribe, tell them clearly what they get for the price (3.1.2).

Your app must be a real app

• A website inside an app isn’t enough. Neither is a list of links or an ad for your business (4.2).
• Don’t submit the same app many times. Apple’s example: don’t make a separate map app for each city. Make one app instead (4.3).
• If you offer Google, Facebook, or another social login, also offer one that only collects name and email and lets users hide their email. Sign in with Apple does this (4.8).
• Don’t send marketing push notifications unless users opted in, and let them opt out (4.5.4).
• Ask for ratings with Apple’s built-in review prompt only. Custom “Rate us” popups aren’t allowed (5.6.1).

Respect privacy

From 5.1.1 and 5.1.2:

• Add a privacy policy link in App Store Connect and inside your app.
• Ask before you collect any user data, even anonymous data. Let users change their mind later.
• Explain clearly why you need each permission. “This app needs camera access” is too vague.
• Only ask for data your app really needs.
• If users can make an account, they must be able to delete it inside the app.
• If you send user data to another company, including an AI service, tell users and ask first.
• Don’t lock features behind turning on notifications, location, or tracking.

Some apps need a company account

Banking, healthcare, gambling, legal cannabis, air travel, and crypto exchange apps should come from a registered company, not a personal developer account (5.1.1 part ix). Real-money gambling has extra rules in 5.3.

If you get rejected

If your app is already live and Apple rejects a bug fix update, ask for the fix to go through anyway. Apple says it won’t hold back bug fixes over guideline problems, unless the problem is legal or safety related. Reply in App Store Connect and promise to fix the issue in your next update.

Checklist before you submit

• No crashes, placeholder text, or broken links
• Test account in the review notes, server is running
• Every new feature is described clearly in Notes for Review
• App name is 30 characters or less
• No prices like “Free” in the name, subtitle, or screenshots
• No mention of Android or other platforms
• Screenshots, description, and ads match what the app does
• Works on iPad and on IPv6-only networks
• Digital unlocks use In-App Purchase, with a restore option
• Loot box odds are shown before purchase
• Privacy policy is linked in App Store Connect and in the app
• Permission messages explain the real reason
• App asks before collecting or sharing data, including with AI services
• Users can delete their account in the app
• Social login comes with Sign in with Apple or a similar option
• Review requests use Apple’s built-in prompt
• User posts and AI creations have filtering, reporting, blocking, and contact info
• No hidden features, downloaded feature code, or private APIs
• No other company’s name, logo, or design
• Regulated apps come from a company account

One simple rule covers the worst cases: if you’d need to hide it from Apple, don’t ship it.