App Store Submission Checklist

Membership is 99 USD per year (prices vary by region) and renews automatically. Individuals can enroll in the Apple Developer app by photographing a driver’s license or government photo ID. As an individual, your legal name is shown as the seller on the App Store.

!Gotcha: Use your exact legal name on your Apple Account before you start. An alias or company name causes a delay, and you must use the same device for the whole enrollment.

To enroll as a company you need a legal entity (no DBAs or trade names), binding authority, a work email on your domain, a public website, and a D-U-N-S Number. Sole proprietors are told to enroll as individuals instead.

!Gotcha: Banking, healthcare, gambling, and VPN apps must be submitted by an organization, not an individual. Pick the right account type before you build.

In App Store Connect, go to Business > Agreements > Compliance and declare whether you’re a trader under the EU Digital Services Act. Apple requires a declaration even if you don’t distribute in the EU. Apps without trader status are removed from the EU App Store.

!Gotcha: If you’re a trader, your contact details are published on your EU product page. Individuals can supply a P.O. box (with proof) instead of a home address.

Your agreements must be in effect before an approved app can go live, and only the Account Holder can accept them. If you charge for the app or sell in-app purchases, you’ll also need the Paid Apps agreement plus banking and tax info.

Register an explicit App ID that matches the bundle ID in your Xcode target. Reverse-DNS (com.yourcompany.app) is the usual convention.

!Gotcha: You can’t change the bundle ID after you upload a build, so get it right before your first TestFlight upload.

Xcode uses cloud-managed Apple Distribution certificates, so solo developers never need to export a .p12. Xcode can even create the App Store Connect record on your first upload.

!Gotcha: Only the Account Holder or an Admin can create distribution certificates. A teammate with the Developer role gets blocked when archiving for the store.

Since 28 April 2026, uploads must be built with Xcode 26 or later using an iOS 26 (or matching platform) SDK. Apple usually raises the floor each spring, so check Upcoming Requirements before you plan a release.

!Gotcha: Builds made with an older Xcode are rejected at upload, before review even starts.

Since 9 September 2026, iOS and iPadOS apps uploaded to App Store Connect must target iOS 13 or later.

Set it to NO if your app (and every library it links) uses no encryption or only exempt encryption, such as the HTTPS built into the OS via URLSession. Otherwise set YES and follow Apple’s documentation steps. Adding the key skips the export compliance questions on every build.

!Gotcha: A third-party SDK that bundles its own crypto (for example OpenSSL) can flip this to YES and may require extra documentation, like a French encryption declaration if you distribute in France.

Apple keeps a list of about 110 common SDKs (Firebase, Alamofire, Flutter, Lottie, OneSignal, and more) that must include a privacy manifest, plus signatures for binary dependencies.

Every NS…UsageDescription string should say exactly why you need the permission. Don’t gate features on permissions you don’t need, and prefer the photo picker or share sheet over full library access.

!Gotcha: Vague purpose strings and unnecessary permissions are a classic guideline 5.1.1 rejection.

The App Store icon comes from your build: add it in an asset catalog or with Icon Composer, then upload. Make it a full square; the system applies the rounded corners. Changing it later needs a new version.

!Gotcha: Keep the 1024 px icon fully opaque. Apple’s current pages don’t spell this out, but transparent App Store icons have long been rejected at upload.

Apple requires at least one screenshot for iPhone with Dynamic Island (medium display), the 6.1–6.3 inch class. You can upload 1–10 per size as PNG or JPEG. Apple’s table also requires a large-display set: 6.9 inch (1320 × 2868, recommended) or 6.5 inch (1284 × 2778) if you skip 6.9.

!Gotcha: Screenshots can’t contain an alpha channel and must show the app in use, not just a splash or login screen (guideline 2.3.3). Older advice that 6.5 inch is the required size is out of date.

Apps that support iPadOS need at least one screenshot for the iPad 13-inch display: 2064 × 2752 or 2048 × 2732. Smaller iPad sizes are scaled down from it automatically.

The foldable iPhone Duo has outer (1398 × 2034) and inner (2007 × 2853) screenshot sizes. They’re optional today and earn a badge on your product page. Starting April 2027 they’re required for apps built with the iOS 27.1 SDK or later.

Up to three previews per device size and language, 15–30 seconds, H.264 at up to 30 fps, under 500 MB. iPhone previews are 886 × 1920 portrait.

!Gotcha: Previews must be screen captures of the app itself (guideline 2.3.4), not a marketing trailer.

Since 5 October 2026, apps can show a product page header (3840 × 1646) and a search results image (up to 3840 × 2560) on iOS 27 and later. Upload them in the new Asset Library; they don’t need an app update.

!Gotcha: No prices, discounts, or misleading references to other apps (guideline 2.3.14), no alpha channel, and keep it 4+ appropriate.

Choose the bundle ID, a primary language, and a SKU (letters, numbers, hyphens, periods, underscores). Xcode can also create the record for you on first upload.

!Gotcha: The SKU can’t be changed after you create the record.

The name must be 2–30 characters; the subtitle can’t be longer than 30. You can edit the name until you submit.

!Gotcha: No prices, competitor names, or other platforms (like Android) in your name, subtitle, or keywords, and all metadata must suit a 4+ audience (guidelines 2.3.7, 2.3.8, 2.3.10).

The description is plain text, up to 4000 characters. Keywords are limited to 100 bytes, not characters, so accented and non-Latin letters use more. Promotional text (170 characters) can be changed any time without a new submission.

!Gotcha: Describe what the app really does. Inaccurate metadata is guideline 2.3, one of the most common rejections.

A privacy policy URL is required for iOS apps. Guideline 5.1.1(i) also requires an easy-to-find link inside the app, and the policy must cover what you collect, which third parties get it, retention and deletion, and how to revoke consent.

!Gotcha: Linking it in App Store Connect but not in the app (or linking a dead page) gets you rejected.

The support URL is required, must include the protocol (https://), and must lead to actual contact information. A marketing URL is optional.

Choose a primary category (a secondary one is optional) and enter a copyright line like “2026 Example, Inc.”. Then set pricing and the countries you’ll ship in.

Required for every new app and update. You must include what your third-party SDKs (analytics, ads, crash reporting) collect, not just your own code. Data processed only on the device doesn’t count as collected. You can update answers any time without a new build.

!Gotcha: Labels that don’t match what your SDKs really collect are a 5.1.2 problem. Audit every SDK before answering.

Ratings are now 4+, 9+, 13+, 16+, and 18+. Since September 2026, the questionnaire’s social media capability questions are required for new apps and updates. Count AI chat and generation features too: unrestricted web access pushes you to 16+, and social media features to 13+.

!Gotcha: If your terms set a higher minimum age than Apple calculates, you must choose “Override to Higher Age Rating”. Mis-rating can trigger a regulator inquiry (guideline 2.3.6).

You need ATT permission to track users or read the advertising identifier. Ad SDKs that combine data across apps count as tracking even if you don’t use them that way. Using IDFV for analytics across your own apps doesn’t need ATT.

!Gotcha: Never require tracking (or push or location) to unlock features (guideline 5.1.2).

Deletion must start inside the app (for example Settings > Delete Account) and delete the whole account, though it can finish on a web page or run asynchronously. If you use Sign in with Apple, revoke the user’s tokens too.

!Gotcha: Only offering to deactivate an account, or telling people to email you, doesn’t count (guideline 5.1.1(v)).

If you offer third-party or social login, you must also offer another login service that limits data to name and email and lets users hide their email. Sign in with Apple qualifies, but Apple no longer mandates it specifically.

!Gotcha: Not needed if you only use your own account system, or for enterprise, education, government ID, or client apps for a specific third-party service (guideline 4.8).

Unlocking features or content inside the app must use in-app purchase, with a way to restore purchases. Physical goods and services can use other payment methods. On the US storefront you can now also link to external purchases.

!Gotcha: License keys, QR codes, or crypto to unlock features are not allowed (guideline 3.1.1).

Apps with user-generated content or AI generation need content filtering, a way to report and block, and published contact info. Random or anonymous chat is explicitly covered.

Product > Archive, then in the Organizer choose Distribute App > TestFlight & App Store. Run Validate App first to catch problems early. Transporter, altool, and the App Store Connect API also work.

!Gotcha: The build has to finish processing before you can use it. Apple emails you when it’s ready.

Up to 100 App Store Connect users on your team can test right away, with no review. Crashes and obvious bugs are a guideline 2.1 rejection, so this is your safety net.

Up to 10,000 external testers per app, by email or a public link. Enter a beta description and feedback email first. The first build needs a full TestFlight App Review; later builds of the same version might not.

!Gotcha: TestFlight builds expire after 90 days.

The usual ones: crashes, placeholder content, or broken links (2.1); inaccurate metadata or screenshots (2.3); a thin website wrapper (4.2); a copy of an app type that already exists in bulk (4.3); and privacy gaps (5.1.1).

!Gotcha: As of 16 October 2026, hidden or dormant features that appear after review (guideline 2.5.19) can get your developer account terminated.

Select the processed build on the version page. Create your in-app purchases in App Store Connect and add them to the same submission so the reviewer can test them.

!Gotcha: In-app purchases that aren’t visible or working for the reviewer are a 2.1(b) rejection.

If any feature needs sign-in, enter a working username and password in App Review Information, and keep your backend running during review. A built-in demo mode is only allowed with Apple’s prior approval.

!Gotcha: Expired credentials or a server that’s down during review is a quick 2.1 rejection.

Explain anything non-obvious: how to reach key features, hardware needed, or why a permission is used (up to 4000 bytes). Add a contact name, email, and phone number in international format (+1…).

!Gotcha: Generic notes about new features are rejected. Describe them specifically (guideline 2.3.1).

Pick “Manually release this version”, “Automatically release”, or “Automatically release after App Review, no earlier than” a date. Once released, it can take up to 24 hours to appear on the App Store.

Apple says it typically reviews 50% of submissions in under 24 hours and 90% in under 48. You can only have one version under review per platform at a time.

Updates can roll out over 7 days to 1, 2, 5, 10, 20, 50, then 100% of auto-update users. You can pause for up to 30 days or release to everyone at any time.

!Gotcha: Phased release only exists for updates. Your first version goes out to everyone at once.

Rejections appear as App Review messages in the App Review section of your app in App Store Connect. (Apple no longer calls it the “Resolution Center”.)

If the problem is only metadata (text, screenshots, URLs), you can fix it and resubmit without uploading a new build.

If the reviewer misunderstood something, reply in App Store Connect (up to 4000 characters, with attachments like a screen recording).

!Gotcha: Getting rejected repeatedly for the same guideline makes future reviews take longer.

Apple asks for only one appeal per rejected or removed app, covering every guideline cited. Use it when you believe the guideline was misapplied.

For apps already on the store, Apple won’t delay bug fixes over guideline issues unless they’re legal or safety related. Reply to the message instead of resubmitting, and fix the deferred issue in your next version.

!Gotcha: A deferred issue can’t be deferred a second time.

Submit first, then file the expedited review request. Apple grants them for things like critical bug fixes or launches tied to an event, as availability allows.

!Gotcha: Abuse it and Apple may reject your future requests.