TL;DR
- 4.2: a WebView around your web app is the classic rejection. Ship a native build.
- 4.8: Google/Facebook login for the main account means you also need an equivalent private-email option. Usually Sign in with Apple.
- 5.1.1(v) + Play policy: account creation means in-app account deletion. Google also wants a web link.
- 2.1: give the reviewer a working demo account, and keep the backend awake.
- 5.1.1(i) + Data safety: privacy policy in the listing and in the app. Declare what your SDKs collect.
1. "Beyond a repackaged website" (4.2)
Apple: your app "should include features, content, and UI that elevate it beyond a repackaged website." If your builder outputs a web app, wrapping it in a WebView is exactly what this catches. React Native/Expo output, push, offline handling and phone-first screens all help.
2. Social login needs a private option (4.8)
Using Google/Facebook/X/etc. for the primary account? You must also offer a login that only collects name + email and lets users hide their email. Sign in with Apple is the usual answer. Exception: you only use your own account system.
AI builders love adding "Continue with Google". On iOS that one button can be the rejection.
3. Account deletion, in the app (5.1.1(v))
- Apple: "If your app supports account creation, you must also offer account deletion within the app."
- Google Play: in-app deletion path and a web link for deletion requests, declared in the Data safety form.
"Email us to delete your account" doesn't cut it.
4. The reviewer has to get in (2.1)
Demo account details are required if there's a login, plus "turn on your back-end service". For a free-tier Supabase/Firebase backend, check it won't pause during review, and that OTP/email verification won't block the reviewer.
5. Privacy policy + privacy answers (5.1.1(i))
| Apple | ||
|---|---|---|
| Privacy policy | Link in App Store Connect and in the app | Required for the Data safety form |
| Privacy answers | App Privacy details, including third-party SDKs | Data safety form, required even if you collect nothing |
Want someone else to handle it?
I work on LetsDeployIt: we take apps from Lovable, Bolt, Rork, FlutterFlow or RapidNative through native conversion, listings, privacy forms and submission until they're approved. The list above works fine on your own too.
Which of these five would have caught your app?
Top comments (0)