--- title: "App Store Submission Checklist 2026: Pass App Review" description: "Submitting an iPhone app in 2026? Our App Store checklist covers required URLs, privacy manifest, subscriptions, screenshots, age ratings and rejections." url: https://develak.com/blog/app-store-submission-checklist/ language: en updated: 2026-09-10 source: Develak translations: fr: https://develak.com/fr/blog/checklist-soumission-app-store.md --- Canonical page: [Guides](https://develak.com/blog/) 10 min read # App Store submission checklist (2026): everything Apple checks before approving your app The complete 2026 checklist for submitting an iPhone app: App Store Connect setup, privacy policy and support URLs, privacy manifest, account deletion, subscriptions, screenshots, age rating, TestFlight and the rejections to avoid. Develak studio Published September 10, 2026 [Lire en français](https://develak.com/fr/blog/checklist-soumission-app-store/) To get an app approved on the App Store in 2026, you need a complete App Store Connect record, a stable build with an accurate privacy manifest, a privacy policy URL and a support URL that lead to real pages, clear subscription terms if you sell anything, and screenshots in the required sizes. Most rejections trace back to four guidelines: 2.1 (crashes and incomplete apps), 2.3 (inaccurate metadata), 4.3 (spam) and 5.1.1 (data collection). This is the checklist Develak runs before every submission of its 34 iPhone, iPad and Mac apps. ## Key takeaways - Every app needs a privacy policy URL and a support URL with real contact information (guideline 1.5). - The privacy manifest must declare the required-reason APIs your code and SDKs call, and your App Privacy answers must match reality. - If users can create an account, they must be able to delete it inside the app (5.1.1(v)). - Subscriptions need price, period and renewal terms, Terms of Use and privacy links, and a Restore Purchases button. - 6.9-inch iPhone screenshots are required; 13-inch iPad screenshots too if the app runs on iPad. - Give App Review working demo access and answer the updated age rating questionnaire (4+, 9+, 13+, 16+, 18+). ## Before you start: account, agreements and toolchain - **Apple Developer Program** membership (US$99 a year). Enroll as an organization to publish under a company name; Apple will ask for a D-U-N-S number. - **Agreements, tax and banking** completed in App Store Connect: no price or in-app purchase goes live without an active Paid Apps Agreement. - **EU trader status.** Under the Digital Services Act, every developer declares whether they are a trader. Since February 2025, apps without that declaration are not distributed in the EU. - **An app record** with a registered bundle ID, a name (30 characters maximum), a primary language and an SKU. - **A current toolchain.** Apple raises the minimum SDK every spring; in 2026, uploads must be built with Xcode 26 and the iOS 26 SDK or later. ## Required URLs and metadata App Store Connect asks for three URLs. Two are mandatory, and App Review opens them. - **Privacy policy URL, required for every app**, even one that collects nothing (guideline 5.1.1(i)). The policy must also be reachable inside the app, and it says what you collect, why, who receives it (SDK providers included), how long you keep it and how to request deletion. - **Support URL, required.** Guideline 1.5 asks for an easy way to contact you: a working e-mail address or contact form, not a placeholder or a bare homepage. - **Marketing URL, optional.** Your product page, if you have one. | Field | Required? | Limit | What App Review checks | | --- | --- | --- | --- | | App name | Yes | 30 characters | Unique, no keyword stuffing or competitor names (2.3.7) | | Subtitle | No | 30 characters | Describes the app, no prices | | Keywords | Yes | 100 characters | Relevant terms, no trademarks you don’t own | | Description | Yes | 4,000 characters | Only features that are in the build | | Privacy policy URL | Yes | Live page | Consistent with App Privacy answers | | Support URL | Yes | Live page | Real contact information (1.5) | | Marketing URL | No | — | — | | License agreement | No | Apple’s standard EULA by default | Your own terms, if any | *App Store Connect fields checked during App Review* ## Privacy: App Privacy details and the privacy manifest Many submissions stall here, because three sources must agree: your App Privacy answers, the privacy manifest in the build, and what the code actually does. ### App Privacy details (the “nutrition labels”) Declare every data type the app or its SDKs collect (health, location, identifiers, usage data, diagnostics…), whether it is linked to the user’s identity, and whether it is used for tracking. Tracking across other companies’ apps or websites also requires the App Tracking Transparency prompt (5.1.2). “Data Not Collected” is only valid if it is true for every SDK, analytics and crash reporting included. ### The privacy manifest (PrivacyInfo.xcprivacy) This property list, shipped in the app and in each SDK, declares tracking domains, collected data and the “required reason” APIs the code calls: `UserDefaults`, file timestamps, system boot time, disk space and active keyboards. Since May 2024, an upload that uses one without an approved reason triggers **ITMS-91053: Missing API declaration**. The most common entry: ```xml NSPrivacyAccessedAPITypes NSPrivacyAccessedAPIType NSPrivacyAccessedAPICategoryUserDefaults NSPrivacyAccessedAPITypeReasons CA92.1 ``` Reason `CA92.1` covers data only your app reads and writes. SDKs on Apple’s list of commonly used third-party SDKs must ship their own signed manifest, so update them before you archive. ### Purpose strings Each permission prompt needs an `Info.plist` usage description that says precisely why access is needed (5.1.1). “This app needs your microphone” invites a rejection; “The microphone is used to measure sound levels. Audio is analyzed on your iPhone and never recorded.” does not. Health apps have extra rules (5.1.3): HealthKit data cannot be used for advertising, and apps must not write inaccurate data into Apple Health. ## Accounts, demo access and account deletion - **Don’t force sign-up** for features that don’t need it (5.1.1(v)). Many of our apps have no account at all: data stays on the device and syncs through the user’s own iCloud. - **Offer in-app account deletion** if users can create an account. Deactivation is not enough, and “e-mail us” is only accepted in highly regulated industries. With Sign in with Apple, revoke the user’s tokens on deletion. - **Pair social login with a private option** such as Sign in with Apple (guideline 4.8). - **Provide demo access** in App Review Information: an account valid for the whole review, with the back end running, or a full demo mode. - **Write review notes.** If a feature needs something the reviewer doesn’t have (a race track, a mechanical watch, a Bluetooth sensor), explain how to test it and attach a short screen recording. ## Subscriptions and in-app purchases Digital features must be sold through in-app purchase (3.1.1), and auto-renewable subscriptions have precise disclosure rules (3.1.2). Check that: - The paywall shows the subscription name, duration, price per period, what is included, and the free-trial terms. - The paywall links to your Terms of Use (EULA) and privacy policy; in the metadata, the Terms go in the License Agreement field or the description. - A **Restore Purchases** button is visible (3.1.1 requires a restore mechanism). - Each product has a localized name, a description and a review screenshot, and your first in-app purchases are submitted with an app version. With StoreKit 2 and SwiftUI, most of it is built in: ```swift SubscriptionStoreView(groupID: "YOUR_GROUP_ID") { PaywallHeader() } .storeButton(.visible, for: .restorePurchases) .subscriptionStorePolicyDestination(url: termsURL, for: .termsOfService) .subscriptionStorePolicyDestination(url: privacyURL, for: .privacyPolicy) ``` We also end every app description with the standard renewal wording (renews automatically unless cancelled at least 24 hours before the end of the period) and the Terms of Use and privacy links. It answers the reviewer’s questions before they are asked. ## Screenshots and the product page - **iPhone:** 6.9-inch screenshots are required (1320 × 2868 or 1290 × 2796 pixels in portrait). Smaller sizes are scaled from them. - **iPad:** if the app runs on iPad, 13-inch screenshots are required too (2064 × 2752 or 2048 × 2732 pixels). - **Mac:** 16:10 screenshots, from 1280 × 800 to 2880 × 1800 pixels. - Up to 10 screenshots per size and language, plus up to three app previews of 15 to 30 seconds. - Show the app in use (2.3.3), not a splash or login screen, and never a feature the build lacks. Screenshots are also your best conversion tool: our [App Store Optimization service](https://develak.com/services/app-store-optimization/) covers keyword research, product page copy and localized screenshot sets. ## Age rating and export compliance **Age rating.** Apple updated its ratings in 2025: the scale is now 4+, 9+, 13+, 16+ and 18+ (replacing 12+ and 17+), and the questionnaire asks about in-app controls, capabilities such as messaging or user-generated content, and medical or wellness topics. Existing apps had to answer the new questions by January 31, 2026 to keep submitting updates. Answer precisely: a rating that is too low is a rejection reason. **Export compliance.** If your app only uses exempt encryption (HTTPS through `URLSession`, Apple’s standard cryptography), declare it once in `Info.plist` and the question disappears from future uploads: ```xml ITSAppUsesNonExemptEncryption ``` ## TestFlight: test the build Apple will review - **Internal testing:** up to 100 members of your team, as soon as the build is processed. - **External testing:** up to 10,000 testers by invitation or public link, after a short beta review. Builds expire after 90 days. - Test what reviewers do: fresh install, denied permissions, no network, the demo account, purchase and restore in the sandbox, and the oldest iOS you support (iOS 17 for most of our apps). - Run an iPhone-only app on an iPad: it can run there in compatibility mode, reviewers may test it, and a crash is still a 2.1 rejection. ## The most common rejection reasons | Guideline | Typical trigger | How to avoid it | | --- | --- | --- | | 2.1 App Completeness | Crash on iPad, expired demo account, placeholder content, back end down | Test the release build through TestFlight; keep demo access valid | | 2.3 Accurate Metadata | Screenshots of features not in the build, keywords stuffed into the name | Describe only what ships; keep keywords in the keyword field | | 3.1.1 / 3.1.2 In-App Purchase | Missing terms or restore button, digital unlock outside in-app purchase | StoreKit, with price, period and links on the paywall | | 4.3 Spam | The same template published under several names | Give each app a distinct purpose, or merge the variants | | 5.1.1 Data Collection | Vague purpose strings, forced sign-up, no in-app deletion | Precise purpose strings, optional accounts, in-app deletion | *Common App Store rejection reasons and how to avoid them* A word on 4.3, since we publish a large catalogue: a portfolio is not spam when every app solves a different problem. A seizure diary, a dive logbook and a wine cellar manager share an architecture, not a purpose. What triggers 4.3 is one app under several names, or a template reskinned with new colors. ## What to do after a rejection A rejection is a message, not a verdict. Apple says that, on average, 90% of submissions are reviewed in less than 24 hours, so a well-handled rejection usually costs a day or two. 1. Read the message in App Store Connect (the App Review messages, long known as the Resolution Center) and note the guideline number. 2. If the reviewer missed something, reply in the thread with clear steps and a screen recording. Metadata-only issues don’t need a new build. 3. If the issue is real, fix it, increase the build number, upload, and summarize the change in your reply. 4. If you still disagree, appeal to the App Review Board with facts. For a critical fix or a time-sensitive event, request an expedited review. 5. For apps already live, bug-fix updates are generally not held for unrelated guideline issues, except legal ones; you can address them in the next version. ## How Develak handles App Store submission We have published 34 apps on the App Store since March 2025, for iPhone, iPad and Mac, in up to 44 languages. Each submission follows this checklist: privacy manifest and App Privacy answers reviewed side by side, purpose strings written for humans, complete paywall terms, review notes with demo access, and screenshots in every required size and language. For clients, we set up App Store Connect, write the metadata and review notes, prepare localized screenshots, run TestFlight and follow the exchange with App Review until the app is live. Nobody can guarantee approval, since only Apple decides, but this process removes the avoidable rejections. See our [iOS app development service](https://develak.com/services/ios-app-development/) and our [App Store Optimization service](https://develak.com/services/app-store-optimization/), or [tell us about your app](https://develak.com/contact/). ## FAQ ### How long does App Store review take in 2026? Apple says that, on average, 90% of submissions are reviewed in less than 24 hours. First submissions and apps with new in-app purchases can take longer, so keep a few days of margin before a launch and use manual release to pick the exact day the app goes live. ### Do I need a privacy policy if my app collects no data? Yes. Every App Store app must provide a privacy policy URL in App Store Connect and make the policy accessible inside the app. If the app collects nothing, the policy says so and explains how services such as iCloud sync are used, and the App Privacy answer is “Data Not Collected”. ### Which screenshot sizes are required for the App Store? Every iPhone app needs 6.9-inch screenshots (1320 × 2868 or 1290 × 2796 pixels in portrait). Apps that run on iPad also need 13-inch iPad screenshots (2064 × 2752 or 2048 × 2732 pixels). Smaller sizes are scaled from these, with up to 10 screenshots per size and language. ### Does my app need an account deletion feature? Only if users can create an account in it. Then guideline 5.1.1(v) requires that they can start deleting the account from inside the app, not just deactivate it. Apps without accounts, where data stays on the device or in the user’s iCloud, don’t need one, though a way to erase all data is good practice. ### What should I do after a guideline 4.3 (spam) rejection? Reply with what makes the app different from existing apps, including your own: purpose, audience and features. If it really is a variant of another app, merge the variants into one app with options or in-app purchases. Resubmitting the same binary under a new name will not work; an appeal only makes sense when the app is genuinely distinct. Written by ## The Develak studio Develak is an independent iOS app studio. We have published 34 apps on the App Store since 2025, in up to 44 languages, and we write these guides from that hands-on experience. [See our 34 apps](https://develak.com/apps/) [About the studio](https://develak.com/about/) ## More iOS guides [All guides](https://develak.com/blog/) Guides 9 min read ### [How to localize an iOS app into 40+ languages with String Catalogs (.xcstrings)](https://develak.com/blog/localize-ios-app-xcstrings/) A practical guide to iOS app localization with Xcode String Catalogs: plurals, InfoPlist permission strings, dates and units, right-to-left layouts, pseudolanguage testing, App Store metadata and translation workflow. September 24, 2026 Guides 9 min read ### [SwiftUI vs Flutter vs React Native in 2026: which should you choose for an iPhone app?](https://develak.com/blog/swiftui-vs-flutter-vs-react-native/) An honest 2026 comparison of SwiftUI, Flutter and React Native for iPhone apps: performance, Apple frameworks, UI fidelity, time to market, hiring, maintenance and Android reach, with a decision checklist. September 17, 2026 ## Turn this guide into a shipped app Develak designs, builds and publishes native iOS apps for founders and teams worldwide, in English or French. [Start a project](https://develak.com/contact/) [contact@develak.com](mailto:contact@develak.com) --- *Markdown version of for AI assistants, published by Develak. Links lead to the web pages; add .md to a page URL for its Markdown version. Site index: .*