App Store Review

From the first TestFlight build to an App Store release, for an app set up per Setting Up a New App. Apple's guidelines and review forms change. When App Store Connect asks for something not listed here, follow it.

Phases

Phase	Review	Who can install
1. TestFlight, internal	None. Available once processing finishes (minutes)	Up to 100 App Store Connect users in an internal group
2. TestFlight, external	Beta App Review for the first build of each version, usually within a day	Up to 10,000 testers by email or public link
3. App Store	App Review, usually within 1–2 days	Everyone in the selected countries

CI uploads every build to TestFlight (dev and prod branches alike). Internal testers get it right away. For external testers, add the build to an external group and fill in Test Information (what to test, demo account, contact).

A TestFlight build expires after 90 days.

Before the first submission

In the app (on the app branch)

Item	Why
Specific permission texts (`NS…UsageDescription`)	Vague texts like "for various purposes" are rejected under guideline 5.1.1. Say what the feature does in this app, and remove keys for unused features.
Privacy manifest (`PrivacyInfo.xcprivacy`)	The App target has none yet. The shell uses required-reason APIs (`UserDefaults`), so add one to the App target declaring `NSPrivacyAccessedAPICategoryUserDefaults` (reason `CA92.1`) and its tracking/collection info. Firebase pods ship their own. Known gap: fix on `main` before the first submission.
Export compliance	`ITSAppUsesNonExemptEncryption = false` is already set (HTTPS only).
iPad	The app targets iPhone and iPad (`TARGETED_DEVICE_FAMILY = 1,2`), so it must work and be screenshotted on iPad. To ship iPhone-only, set it to `1` on the app branch.
Sign in with Apple / login services (4.8)	If the web app offers Google or Facebook login, it must also offer an equivalent privacy-focused login option, Sign in with Apple being the usual answer. Email/password-only apps are fine.
Account deletion (5.1.1(v))	If users can create an account in the app, they must be able to delete it from inside the app. This is a web-team change.

In App Store Connect

Section	Notes for MobiWeb apps
App Information	Name (≤30), subtitle (≤30), category, content rights, age rating questionnaire (answer for the web app's content)
Pricing and Availability	Price tier and countries
App Privacy	Privacy policy URL and the "nutrition label". Declare the Firebase collection (device ID, crash and diagnostics data, usage data for Analytics) plus whatever the web app collects. Tracking is "No" unless data is shared with data brokers or ad networks.
Version page	Screenshots, promotional text, description, keywords (≤100 chars), support URL, marketing URL, the build, copyright
App Review Information	Demo account (no 2FA), contact info, and notes explaining the app's purpose and any hardware features (Bluetooth printer, NFC tags) the reviewer can't test

Screenshots

iPhone 6.9" (1320×2868 or 1290×2796, portrait) is required. Smaller sizes are scaled down from it.
iPad 13" (2064×2752 or 2048×2732) is required while the app supports iPad.
1–10 per size, showing the real app.

Review

Submit from the version page with Add for Review, then Submit to App Review.
Release options: manual, automatic, or scheduled. Use a phased release (7 days) for updates.
Rejections appear in the Resolution Center. Reply there, or fix the problem and resubmit. Expedited review can be requested for critical fixes.

Common rejections

Guideline	Issue	Fix
2.1 App Completeness	Reviewer couldn't log in, or found broken flows	Working demo account and notes; prod web app reachable from the US
4.2 Minimum Functionality	"Repackaged website"	Explain the native features in the review notes (push, Face ID login, Bluetooth printing, NFC, offline) and make sure they're reachable with the demo account
5.1.1 Data Collection	Vague permission texts, missing privacy policy, no in-app account deletion	See the tables above
4.8 Login Services	Third-party login without an equivalent privacy-focused option	Add Sign in with Apple (web team)
2.3 Accurate Metadata	Screenshots or description don't match the app	Update the listing
5.1.2 / ITMS-91053	Missing privacy manifest reasons	Add `PrivacyInfo.xcprivacy` (see above)

After launch

Each new version is reviewed again, usually faster. Bump MARKETING_VERSION on the app branch for every App Store version. CI handles build numbers.
Apple raises the minimum Xcode/SDK for uploads every spring. Keep IOS_RUNNER/XCODE_VERSION current (see CI Release).
The distribution certificate used by CI expires yearly. See CI Release.

15 November 2026