Since June 30, 2022, Apple rejects any app that lets people create an account but not delete it from inside the app, under Guideline 5.1.1(v). Google Play asks for the same, plus a web link to request deletion. To fix it, add a Delete account option in your settings that deletes the account and its data, then resubmit.
Why was my app rejected for account deletion?
Because your app has a sign-up and no way to delete the account it creates. Apple has enforced this since June 30, 2022, and it is one of the most common rejections for apps built with Lovable, Bolt, Base44 or v0, because the builders add sign-up for you and never add the delete option.
You submit, wait two days, and the review note says your app "supports account creation but does not include an option to initiate account deletion". Usually nothing in the app is broken. Apple just wants people to be able to delete the account they made.
If your app supports account creation, you must also offer account deletion within the app.
Apple App Review Guideline 5.1.1(v)
It counts even if sign-up is only email and password, only Google sign-in, or a guest account the app creates on its own. If people can get an account from your app, they need a way to delete it there.
What does Apple accept as account deletion?
Apple accepts a delete option that is easy to find, usually in account settings, and that removes the account and the personal data that goes with it. Its account deletion page spells out the details:
- Deactivating or disabling the account isn't enough. You can offer it, but not as the only option.
- Delete the whole account record and the personal data tied to it, including content the person shared, such as posts, photos and reviews.
- Don't make people call, email or chat with support to delete, unless your app is in a highly regulated field such as banking or health.
- A link is fine if deletion finishes on your website, as long as it goes straight to that page.
- It doesn't have to be instant. Tell people how long it takes and confirm when it's done.
- One confirmation step is fine. Making deletion hard on purpose fails review.
- If the person has an auto-renewing subscription, tell them billing continues through Apple and point them to cancel it first.
- If you offer Sign in with Apple, revoke the person's Apple tokens when you delete the account.
Does Google Play require account deletion too?
Yes. Google Play has required it since May 31, 2024, and it asks for two ways in, not one:
- An in-app path to delete the account and its data, easy to find, for example in settings.
- A working web link where people can ask for deletion without the app installed. It must name your app or your developer name.
You give Google that link in the Data safety form in Play Console, under the data deletion questions. If you keep some data after deletion, for fraud prevention or legal reasons, say so in your privacy policy. The launch checklist covers the rest of the Data safety form.
How to add account deletion to your app
Most AI-built apps keep their users in Supabase, so the fix has two halves: a button in the app and a small server function that does the deleting.
- Add a Delete account row at the bottom of your account or settings screen, in red so it reads as final.
- Open a confirmation that says what gets deleted and how long it takes, with Delete and Cancel.
- On Delete, call a server function (a Supabase Edge Function) with the signed-in user's session.
- In that function, delete the user's rows in your tables (profiles, posts, bookings, uploads in Storage), then delete the user with Supabase's auth.admin.deleteUser.
- Sign the person out and show a short "Your account has been deleted" screen.
- Publish a deletion page on your website for Google Play, with your app's name and a form or email to request deletion.
- Test it on a fresh account: sign up, add some data, delete, then check the user and their rows are gone in your database.
Why a server function: deleting a user in Supabase needs the service role key, and Supabase says never to put that key in the browser or the app. The app asks, the function checks who is asking and deletes only that user.
If your tables point at the user with a foreign key set to delete on cascade, deleting the user removes their rows too. Check that before you rely on it: files in Storage are not removed by a cascade.
Account deletion in Lovable, Bolt, Base44 and v0 apps
The steps are the same whichever builder you used. What changes is where your users are stored:
| Builder | Where users usually live | What to ask for |
|---|---|---|
| Lovable | Supabase, through Lovable Cloud or your own Supabase project | A Delete account option in settings that calls an Edge Function to delete the user's data and the user |
| Bolt.new | Supabase, or Bolt Database on newer Bolt Cloud projects | The same, then check the user is gone from the database Bolt set up |
| Base44 | Base44's built-in users | A delete account action, then check the user and their records disappear from your app's data |
| v0 | Usually Supabase, connected through Vercel | The same Edge Function, or a server action in the Next.js app |
A prompt that works in most builders: "Add a Delete account option at the bottom of the settings screen. Ask for confirmation, then delete all of this user's data and their auth account on the server, sign them out and show a confirmation." Then test it yourself on a fresh account. The builder will say it's done whether or not the user is really deleted.
Builder-specific steps for the stores: Lovable, Bolt.new, Base44 and v0.
What to write back to App Review
Resubmit with a short reply in App Store Connect that tells the reviewer exactly where to look. Reviewers test by hand, so a path they can follow saves a round trip.
- Where the option is: "Account deletion is in Settings, then Delete account, at the bottom of the screen."
- What it deletes: "It deletes the account and all its personal data."
- How long it takes, if it isn't instant.
- A demo account in the App Review information, so the reviewer can sign in and try it (Guideline 2.1).
Apps rejected for this are often rejected for something else in the same review. The Guideline 4.2 guide covers the most common one for AI-built apps.
Can you fix it yourself?
Yes. If your builder can add the button and the server function, and you test it on a fresh account, most people get this done in a few hours without help.
Where it gets harder is when deletion has to reach several places: Stripe customers, files in Storage, Sign in with Apple tokens and a web deletion page for Google Play. That's the kind of store work we do when we convert an app to native, and it's covered in our plans.
How LetsDeployIt helps
We convert your web app into a native React Native and Expo app, add account deletion that really deletes the account and its data, set up the web deletion page and Data safety answers for Google Play, and submit to both stores until approved.
Try a free native preview of your app on your phone: letsdeploy.it.
Common questions about account deletion
Is deactivating an account enough for Apple?
No. Apple says only offering to deactivate or disable an account is not enough. You can offer it alongside deletion, but not instead of it.
Can I ask people to email us to delete their account?
No, not unless your app is in a highly regulated field such as banking or health. Apple wants deletion started in the app, without calls, emails or support chats.
Does account deletion have to be instant?
No. A manual process is fine if you tell people how long it takes and confirm when the account has been deleted.
My app only uses Google sign-in. Do I still need account deletion?
Yes. Signing in with Google still creates an account in your app, so people must be able to delete it, along with its data.
Do I need a web page for account deletion?
For Google Play, yes. Google asks for a working web link where people can request deletion, entered in the Data safety form. Apple only needs the in-app option.
Why can't the app delete the Supabase user directly?
Because deleting a user needs Supabase's service role key, which must never be in an app or a browser. A server function holds the key and deletes only the user who asked.
Sources
- Apple: Offering account deletion in your app
- Apple App Review Guidelines
- Google Play: Account deletion requirements
- Supabase: auth.admin.deleteUser
- Lovable: Supabase integration
- Bolt: Supabase integration
Originally published on letsdeploy.it. Facts checked 2026-10-25.
Top comments (0)