Apple approves roughly 90% of submissions within 24 hours (per Apple’s own App Review data, June 2026), so most first-time indie pain is not slow review. It is the Day-1 metadata rejection that throws you back to the start of the queue because one field was wrong. The fix is boring: finish every piece of prep before you press Submit. Here is the actual list, ordered by what blocks submission first.
TL;DR
- One missing or wrong field (privacy URL, screenshot size, App Privacy answer, age rating) sends you to the back of the queue, not a “please fix” note.
- As of June 2026 the only required screenshots are iPhone 6.9-inch (
1320x2868or1260x2736) and, if your app runs on iPad, iPad 13-inch (2064x2752). Everything else auto-scales. - Forget “Tier 1 / Tier 87”: Apple retired numbered price tiers in 2023. You now pick from 900 price points (
$0.29to$10,000). - Privacy Manifests (
PrivacyInfo.xcprivacy) have been mandatory since May 1, 2024. Missing one for an SDK that uses a required-reason API is an automatic rejection. - The single highest-leverage step is testing In-App Purchases in the TestFlight sandbox before submission. Broken IAP is the most common avoidable rejection.
Background
Apple’s App Store review is rule-based, not vibe-based. Most rejections are not “your app is bad,” they are “you did not configure something correctly.” For an indie developer the highest-leverage move is to finish every piece of prep before your first submission so you spend one review cycle instead of four. This list covers what you need before you press “Submit for Review,” not what you need to ship a great app.
Before you start
You are ready for this checklist when:
- You have a working build that runs on a real device.
- You have an Apple Developer Program membership (
$99/year as of June 2026, billed annually, not the free Xcode tier). - You have at least 5 days of buffer before any external launch commitment.
- You have basic legal entities sorted (or are launching as an individual).
Step by step
-
Create the App Store Connect record: App Store Connect → My Apps → ”+” (top-left) → “New App”.
- Bundle ID: must match your Xcode project (Xcode → Target → Signing & Capabilities → Bundle Identifier). Use reverse-domain naming:
com.<your-domain-reversed>.<appname>, e.g.com.yoursite.pockethabits. - Primary Language: permanently locked after launch (drives default listing language). Pick the audience’s language carefully.
- Primary Category: changeable later, but heavily weights search ranking — pick deliberately.
- App Name + SKU: SKU is internal, never shown. Use a self-describing slug like
appname-2026q2.
- Bundle ID: must match your Xcode project (Xcode → Target → Signing & Capabilities → Bundle Identifier). Use reverse-domain naming:
-
Host the privacy policy at a stable URL. Use your own domain, not a free subdomain. Firebase Hosting (Spark, free and commercial-OK) or GitHub Pages both work; Vercel’s free Hobby tier is non-commercial, so use Pro if your app sells anything:
mkdir privacy && cd privacy echo "# Privacy Policy for <App Name>" > privacy.md echo "Last updated: 2026-05-21" >> privacy.md # deploy to https://yoursite.com/privacy/The policy must include 7 blocks: data collected / purpose / third-party sharing / retention period / user rights / deletion flow / contact. Use the template in App privacy policy checklist.
-
App Privacy form (App Store Connect → App Privacy). Walk Apple’s 32 data categories:
Identifiers → required if using Crashlytics / Adjust / AppsFlyer Usage Data → required if using Firebase Analytics / Mixpanel Diagnostics → almost any Sentry / Crashlytics setup Contact Info → if you collect email / phone Health & Fitness → if using HealthKit ...For each checked: Linked to User / Not Linked / Used for Tracking.
Third-party SDKs count as “you collect.” Audit
Podfile/Package.swiftand check each dependency’s Privacy Manifest. Since May 1, 2024 aPrivacyInfo.xcprivacyis mandatory for any SDK that touches a required-reason API (file timestamps,UserDefaults, disk space, system boot time). A common SDK list Apple also requires a manifest and signature for includes Firebase, Adjust, AppsFlyer, and Alamofire. A missing manifest is an automatic rejection at upload:# Verify all dependencies ship a PrivacyInfo.xcprivacy find . -name "PrivacyInfo.xcprivacy" -exec cat \{\} \; -
Screenshots. As of June 2026 Apple only requires two sizes, and App Store Connect auto-scales each to the smaller devices in that family. You do not need to upload a set for every old iPhone anymore. Per Apple’s screenshot specifications:
REQUIRED (iPhone app): iPhone 6.9" 1320x2868 (iPhone 17 Pro Max) or fallback 1260x2736 (older 6.9" frame) REQUIRED (iPad app): iPad 13" 2064x2752 (iPad Pro M5/M4) OPTIONAL (auto-scaled): 6.5" 1284x2778, 6.3" 1179x2556, 5.5" 1242x2208, iPad 12.9" 2048x2732 Format: PNG or JPEG, RGB, no alpha. 1 to 10 per device class.Dimensions must be pixel-exact: an off-by-one screenshot is rejected, no tolerance. Automate capture with Fastlane snapshot so the assets always match the running build:
gem install fastlane fastlane snapshot init # Write UI tests in SnapshotUITests/SnapshotHelper.swift fastlane snapshot --devices "iPhone 17 Pro Max,iPad Pro 13-inch (M4)"Add captions and device frames with AppLaunchpad or a Figma template, but the screen content must be from a real running build (rule 2.3.3 bans mockups of features you do not have).
-
Write App Name / Subtitle / Keywords: full rules in App Store listing copy. Spec recap:
App Name: ≤30 char Subtitle: ≤30 char Keywords: ≤100 char, comma-separated, no spaces e.g. habit,streak,daily,routine,morning,evening,ritual,offline Description: ≤4000 char What's New: ≤4000 char -
Age Rating: App Store Connect → App Information → Age Rating → “Edit”. Apple asks 14 questions:
Cartoon or Fantasy Violence → None / Infrequent / Frequent Realistic Violence → ... Profanity → ... Sexual Content → ... Gambling → ... (even a dice game = check Simulated Gambling) Unrestricted Web Access → if the app contains a WKWebView that loads arbitrary URLs, you MUST check thisMost common mistake: “Unrestricted Web Access” — any WKWebView loading external URLs requires this checked; unchecked = reject.
-
IAP: configure BEFORE referencing in build. App Store Connect → your app → Features → In-App Purchases → ”+”:
Type: - Consumable one-time consumables (coins, items) - Non-Consumable one-time permanent unlock ("Remove ads") - Auto-Renewable Subscription monthly / annual - Non-Renewing Subscription recurring but no auto-renew Reference Name: internal, e.g. "Pro Monthly" Product ID: referenced in code, e.g. com.yoursite.appname.pro_monthly Price: pick from 900 price points, $0.29 to $10,000 (numbered "tiers" were retired in 2023) Display Name: user-facing, e.g. "Pocket Habits Pro" Description: user-facing, ≤45 charA review screenshot of the paywall page must be uploaded for each IAP, or the IAP stays in “Missing Metadata” and is not reviewed with the build. Then in Xcode:
// StoreKit 2 usage let products = try await Product.products(for: ["com.yoursite.app.pro_monthly"]) -
TestFlight with real users. App Store Connect → TestFlight → Internal / External Testing:
Internal: up to 100 App Store Connect team members, no Beta App Review, test as soon as the build finishes processing External: up to 10,000 invitees; the FIRST build of a version needs Beta App Review, later builds usually do not Process: 1. Xcode → Product → Archive → Distribute App → App Store Connect → Upload 2. Wait for build processing (10-30 min) 3. TestFlight → select build → Add External Testers → send invitation emails 4. Don't proceed without ≥5 real-user feedback + 0 crashesFix obvious issues before submitting for App Review.
-
Final pre-submit checklist:
- [ ] App icon legible at both 1024x1024 and 60x60 - [ ] Launch screen is not blank or a placeholder - [ ] No leftover print() / NSLog / TODO / debug-only menu - [ ] No "test@example.com" / "lorem ipsum" - [ ] Every link in About / Settings / Help responds to curl - [ ] Delete app → reinstall → full cold-start flow without crash - [ ] Review account filled in App Review Information AND verified working on a test device - [ ] Every red "Required" in App Store Connect now green# One-shot grep audit grep -rE "TODO|print\\(|NSLog|test@example|lorem" --include="*.swift" --include="*.m" --include="*.mm" .
Common pitfalls
- Using a personal email or a free hosting subdomain for the privacy policy URL. Apple wants it stable; use your own domain.
- Skipping the App Privacy questionnaire because “I do not collect data.” If you use Firebase Analytics, Sentry, or anything similar — you do collect data.
- Submitting before testing IAP in TestFlight sandbox. IAP bugs are caught in review and waste a full cycle.
- Mockup screenshots that show features your app does not have. This is rule 2.3.3 and a common rejection.
- Listing fake reviews, fake user counts, or “as featured in” claims you cannot substantiate.
- Choosing a name that contains a trademarked term you do not own. Apple’s legal screen will catch this.
Who this is for
First-time iOS publishers and solo developers who want to compress prep work and avoid silly rejections.
When to skip this
Larger teams with an existing release process — you likely already have most of this; focus on the rejection-reasons article instead.
FAQ
- How long does the first submission take to review?: Apple reviews about 90% of submissions within 24 hours as of June 2026, and most of the rest land in 1 to 2 days. The slow part is not Apple, it is the day-1 “Metadata Rejected” that restarts the clock when a field is wrong, so plan a week of buffer for your first app.
- Do I really only need two screenshot sizes now?: For most apps, yes. Since the auto-scaling change you only upload iPhone 6.9-inch and (if it runs on iPad) iPad 13-inch; App Store Connect scales those down to every smaller device. Upload the smaller sizes only if your layout looks wrong when scaled.
- Do I need an LLC to publish?: No. You can publish as an individual on a personal Apple Developer account for the same
$99/year. Some choose an LLC for liability or branding, but it is not required. - Can I publish under a brand name without trademark registration?: Yes, but Apple may ask you to prove ownership if there is a conflicting trademark. Search the USPTO database before you commit to the name.
- What if my app is mostly a web wrapper?: Read rule 4.2 carefully. Pure web wrappers without native value get rejected. Add real native features (push notifications, offline mode, share extensions) or expect a 4.2 rejection.
- Can AI write my listing copy and review responses?: Yes for first drafts. Tools like ChatGPT (GPT-5.5) or Claude (Sonnet 4.6) are good at App Store keyword fields and tightening descriptions, but always verify character limits and never let them invent fake reviews or feature claims. See How to Write App Store Copy With AI.