How does app store review work?

An app for iPhone or Android only reaches the store after Apple or Google has checked it. That check, called review, applies to the first version and to updates as well. Both companies combine automated checks with people who look at the app.

When I build an app for you, I handle the app stores. It still helps to know what happens, because only you can give some of the answers, such as what data your business keeps and why.

The rules change regularly, so the official texts always take priority: Apple’s App Review Guidelines and Google’s Developer Policy Center. A web app that runs in the browser doesn’t go through this review. Do you need the app store? is about that.

What they check

The reviewer checks whether the app works: it can’t crash, buttons and links have to do something, and there can be no placeholder text left in it. The app also has to do what you promise. The description and screenshots in the store have to match what someone sees after installing it.

Privacy is a large part of the review. Apple and Google want to know what data the app collects, what for and who it is shared with, and what you say about that has to match what the app does. The app can also only ask for access to the camera or location if it needs it, and people have to understand why.

You fill in a questionnaire about the content, which sets the age rating. If users can post things themselves, such as messages or photos, both stores expect a way to report something and to deal with unwanted content.

If you sell something in the app, they also look at the payment. Digital content and subscriptions often have to go through the store’s payment system. Physical products and services outside the app, like a haircut or a parcel, don’t fall under that. The rules on this point differ per region and change often, so check what applies to you today.

Why an app can be rejected

These are common reasons for a rejection, and most can be fixed:

• The reviewer can’t log in, because there is no demo account or the test details no longer work.
• The app crashes during review, or a part isn’t finished yet.
• The app is little more than a repackaged website. Apple explicitly asks for an app to go beyond that.
• The app asks for access to something without a clear reason, or the privacy details don’t match what it does.
• A privacy policy or a way to delete an account is missing.
• Digital content is sold outside the store’s payment system, somewhere that isn’t allowed.

You then get a message with the rule the reviewer is relying on. You change the app or the details and submit again. If you disagree, you can ask for an explanation or appeal.

What to have ready before you submit

First you need the accounts: a membership of the Apple Developer Program and a Google Play Console account. They can be in your company’s name, and that is worth arranging up front, as you can read in Who owns your code and data? For a company account they ask for a D-U-N-S number, an international identification number for businesses, so apply for that in good time. At Google, a new personal account first has to run a closed test with a number of testers before the app can go live for everyone. The conditions are in Google’s help pages.

If someone can only do things after logging in, include a demo account that works and already has data in it, or a demo mode. If the reviewer needs something else, such as a QR code to scan, add a sample. Write down step by step how they reach the features. Say your app only works for employees invited by their company: explain that and make sure the demo account has already been invited. Keep the account active for as long as the review runs.

For privacy you need a privacy policy on a public web page. It also has to be easy to find from within the app. You also fill in a form about your data: App Privacy at Apple and Data safety at Google. Include other companies’ services you build in as well, such as tools that measure crashes or usage. The answers appear on your page in the store. For the legal text itself, it is best to ask a lawyer.

If people can create an account in your app, they also have to be able to delete it in the app. At Google you also need a web link where people can request that. It is a feature that has to be built, so put it on the list for the first version.

The rest is the store page: the name, a description, an icon, screenshots and an address where people can find help. Also test the app on real devices before you submit. Apple has TestFlight for that, and Google has internal and closed tests.

How long it takes

How long a review takes varies, and a first submission can raise more questions than an update. So don’t pin your launch to the day you submit. Both stores let you choose when an approved version goes live, so it can wait for the date you want. You can also roll out an update gradually, so it reaches part of your users first.