app-store-review

Files (16)

• marketplace.json · .agents/plugins/
• marketplace.json · .claude-plugin/
• plugin.json · .claude-plugin/
• plugin.json · .codex-plugin/
• skill-feedback.yml · .github/ISSUE_TEMPLATE/
• .gitignore
• LICENSE
• README.md
• SKILL.md
• openai.yaml · agents/
• metadata.json
• 1-safety.md · rules/
• 2-performance.md · rules/
• 3-business.md · rules/
• 4-design.md · rules/
• 5-legal.md · rules/

SKILL.md (first lines)

# App Store Review Guidelines Checker

Comprehensive guide for evaluating iOS, macOS, tvOS, watchOS, and visionOS app code against Apple's App Store Review Guidelines. This skill covers EVERY guideline point to identify potential rejection issues before submission.

**Supports:** Swift, Objective-C, React Native, and Expo apps

**Guidelines current through:** Apple's [October 16, 2026 App Review Guidelines update](https://developer.apple.com/news/?id=92th7e5i), verified against the current English guidelines. Includes AI content creation and nonconsensual intimate imagery safeguards (1.2), creative assets (2.3.14), hidden features (2.5.19), revised purchase-link entitlements (3.1.1(a)), and alternative-distribution enforcement (5). Also covers social media age-rating questions, Republic of Korea age rating changes, and Brazil/EU alternative payment and distribution terms.

## When to Apply

Use this skill when:
- Preparing an app for App Store submission
- Reviewing code for compliance issues
- Implementing features that may trigger review concerns
- Auditing existing apps for guideline violations
- Building features involving payments, user data, or sensitive content

## Guideline Sections

Read individual rule files for detailed explanations, checklists, and code examples:

| Section | File | Key Topics |
|---------|------|------------|
| **1. Safety** | [rules/1-safety.md](rules/1-safety.md) | Objectionable content, UGC and AI content safeguards, Kids Category, physical harm, data security |
| **2. Performance** | [rules/2-performance.md](rules/2-performance.md) | App completeness, metadata and creative assets, hardware compatibility, software requirements, hidden features |
| **3. Business** | [rules/3-business.md](rules/3-business.md) | In-app purchase, subscriptions, cryptocurrencies, other business models |
| **4. Design** | [rules/4-design.md](rules/4-design.md) | Copycats, minimum functionality, spam, extensions, Apple services, login |
| **5. Legal** | [rules/5-legal.md](rules/5-legal.md) | Privacy, data collection, intellectual property, gambling, VPN, MDM, developer code of conduct |

## Risk Levels by Category

| Risk Level | Category | Section | Common Rejection Reasons |
|------------|----------|---------|--------------------------|
| CRITICAL | Privacy & Data | 5.1 | Missing privacy policy, unauthorized data collection |
| CRITICAL | Payments | 3.1 | Bypassing in-app purchase, unclear pricing |
| HIGH | Safety | 1.x | Objectionable content, inadequate UGC moderation |
| HIGH | Performance | 2.x | Crashes, incomplete features, deprecated APIs |
| MEDIUM | Design | 4.x | Copycat apps, minimum functionality issues |
| MEDIUM | Legal | 5.x | IP violations, gambling without license |

---

## Quick Reference: High-Risk Rejection Patterns

For ATT findings, verify the SDK's configuration and actual data use. For account deletion, verify the destination and flow. For logging, inspect the data exposed and any redaction. If that evidence is unavailable, report what needs verification instead of declaring a rejection based on an API call, SDK import, or URL alone.

For payments, establish the storefront, platform, and applicable exceptions before flagging external links or checkout (see [3.1.1(a)](rules/3-business.md#311a-link-to-other-purchase-methods) and [3.1.3](rules/3-business.md#313-other-purchase-methods)).

### Critical Issues (Immediate Rejection)

**Swift:**
```swift
// 🔴 Private API usage
let selector = NSSelectorFromString("_privateMethod")

// 🔴 Hardcoded secrets
let apiKey = "sk_live_xxxxx"

// 🔴 External payment for digital goods where IAP is required
func purchaseDigitalContent() {
    openStripeCheckout() // Use StoreKit instead
}
```

**React Native / Expo:**
```typescript
// 🔴 Hardcoded secrets in JS bundle
const API_KEY = 'sk_live_xxxxx'; // REJECTION

// 🔴 External payment for digital goods where IAP is required
Linking.openURL('https://stripe.com/checkout'); // Use react-native-iap

// 🔴 Dynamic code execution
eval(downloadedCode); // REJECTION

// 🔴 Major feature changes via CodePush/expo-updates
// OTA updates for bug fixes only, not new features!
```

### High-Risk Issues

**Swift:**
```swift
// 🟡 Starting Apple-defined tracking without ATT authorization
// Illustrative helper: links user data across companies for ad targeting
enableCrossCompanyAdTracking() // Called before ATT authorization

// 🟡 Account creation without deletion
func createAccount() { } // But no way to initiate deletion in the app
```

**React Native / Expo:**
```typescript
// 🟡 Starting Apple-defined tracking without ATT authorization
// Illustrative helper: SDK links user data across companies for ad targeting
initializeTrackingAdSDK(); // Called before ATT authorization

// ✅ First-party analytics alone does not require ATT
// Assumes no IDFA access, cross-company advertising use, or data broker sharing
import analytics from '@react-native-firebase/analytics';
analytics().logEvent('event');

// 🟡 Delete Account button opens instructions with no deletion flow
Linking.openURL('https://example.com/help'); // Verified instructions-only page
// ✅ An in-app button may link directly to a page that completes deletion
Linking.openURL('https://example.com/delete-account');

// 🟡 Sensitive data exposed in production logs (1.6 / 5.1)
console.log('Access token:', accessToken); // Remove the secret or redact it

// 🟡 Social login without a privacy-preserving alternative (4.8)
<GoogleSigninButton /> // Also offer a login meeting 4.8 criteria
                       // (Sign in with Apple is the simplest option)

// 🟡 Pre-permission button that asks for the grant (5.1.1(iv))
<Button title="Enable Location" onPress={requestLocation} /> // Use "Continue" or "Next"

// 🟡 UGC terms checkbox pre-checked, or no terms before sign-up/login (1.2)
const [agreed, setAgreed] = useState(true); // Start unchecked; gate sign-up on it

From safaiyeh/app-store-review-skill, MIT.

More from safaiyeh/app-store-review-skill