App Store Submission Reference

Overview

Complete reference for every App Store submission requirement:

• Part 1 — Required metadata fields (descriptions, screenshots, keywords, App Review info)
• Part 2 — Privacy requirements (manifest schema, nutrition labels, ATT, Required Reason APIs)
• Part 3 — App Review Guidelines quick reference (all sections 1-5)
• Part 4 — Age rating system (5-tier, capabilities, regional variations)
• Part 5 — Export compliance (encryption decision tree)
• Part 6 — Account and authentication requirements (deletion, SIWA)
• Part 7 — Monetization and IAP submission pipeline
• Part 8 — EU-specific compliance (DSA trader status)
• Part 9 — Build upload and processing
• Part 10 — WWDC25 changes (draft submissions, accessibility labels, tags)

When to Use This Skill

Use when

• Looking up specific metadata field requirements or character limits
• Checking App Review guideline numbers for a specific topic
• Verifying privacy manifest schema fields or Required Reason API categories
• Understanding age rating tiers and new capability declarations
• Checking EU compliance requirements for DSA trader status
• Understanding IAP submission pipeline and review flow
• Preparing builds for upload (SDK requirements, encryption, signing)

Do NOT use when

• Deciding if your app is ready to submit (use app-store-submission)
• Troubleshooting a rejection (use app-store-diag)
• Implementing in-app purchases (use storekit-ref)
• Writing privacy manifest code (use privacy-ux)
• Auditing accessibility compliance (use accessibility-diag)

Related Skills

• app-store-submission — Discipline skill with pre-flight checklist and workflow
• app-store-diag — Rejection troubleshooting and appeal guidance
• privacy-ux — Privacy manifest implementation, ATT UX, permission requests
• storekit-ref — StoreKit 2 API reference for IAP implementation
• accessibility-diag — Accessibility compliance scanning and VoiceOver testing

Key Terminology

Term	Definition
App Store Connect	Web portal and API for managing app metadata, builds, pricing, TestFlight, and analytics
App Review	Apple's human review process that evaluates every app update against the App Review Guidelines
Privacy Manifest	PrivacyInfo.xcprivacy file declaring data collection, tracking domains, and Required Reason API usage
Required Reason API	System APIs (file timestamps, disk space, user defaults, etc.) that require declared usage reasons
Privacy Nutrition Label	App Store privacy cards showing what data your app collects and how it uses it
DSA Trader Status	EU Digital Services Act classification determining if you are a "trader" selling to EU consumers
Build String	Unique identifier for each uploaded build (e.g., "1.2.3.4"), separate from version number
Bundle ID	Reverse-domain identifier (e.g., "com.company.app") uniquely identifying your app across Apple's ecosystem

---

Part 1: Required Metadata Fields

App Information

Field	Required	Localizable	Max Length	Notes
App Name	Yes	Yes	30 chars	Must be unique on the App Store
Subtitle	No	Yes	30 chars	Appears below app name in search results
Description	Yes	Yes	4000 chars	Plain text, no HTML or rich formatting
Promotional Text	No	Yes	170 chars	Editable without new submission
Keywords	Yes	Yes	100 bytes	Comma-separated, each keyword >2 chars
What's New	Yes*	Yes	4000 chars	*Required for all versions except first
Copyright	Yes	No	—	Format: "YYYY Company Name"
Support URL	Yes	Yes	—	Must link to actual contact information
Marketing URL	No	Yes	—	Optional promotional page
Privacy Policy URL	Yes	Yes	—	HTTPS, publicly accessible

Visual Assets

Asset	Required	Localizable	Specification
App Icon	Yes	No	1024x1024 PNG, no alpha, no rounded corners
Screenshots	Yes	Yes	Per device size, 2-10 per locale per device
App Preview	No	Yes	Up to 3 videos per device size per locale

Screenshot Requirements

Screenshots must be provided for each device size you support:

Device	Required Size (portrait)	Required Size (landscape)
iPhone 6.9"	1320 x 2868	2868 x 1320
iPhone 6.7"	1290 x 2796	2796 x 1290
iPhone 6.5"	1284 x 2778	2778 x 1284
iPhone 5.5"	1242 x 2208	2208 x 1242
iPad Pro 13"	2048 x 2732	2732 x 2048
iPad Pro 12.9"	2048 x 2732	2732 x 2048

Screenshots must show the app in actual use. Not permitted: title art alone, login screens, splash screens, or screens from other platforms.

App Preview Video Specifications

Specification	Requirement
Duration	15-30 seconds
Format	H.264, ProRes 422
Audio	English or localized; no offensive content
Frame rate	30 or 60 fps
Resolution	Must match screenshot dimensions for the device
Content	Must show actual app footage; no device frames allowed in video
Per locale	Up to 3 preview videos per device size per locale

App Icon Requirements

Specification	Requirement
Size	1024 x 1024 pixels
Format	PNG
Color space	sRGB or P3
Alpha channel	Not allowed
Rounded corners	Not allowed (system applies automatically)
Layers/transparency	Not allowed
Content	Must be appropriate for 4+ rating regardless of app's actual rating

App Review Information

Field	Required	Notes
Contact First Name	Yes	Reviewer contact
Contact Last Name	Yes	Reviewer contact
Contact Email	Yes	Must be monitored
Contact Phone	Yes	Include country code
Notes for Review	No	Up to 4000 bytes; explain non-obvious features
Sign-in Username	If login required	Must not expire during review
Sign-in Password	If login required	Must not expire during review
Attachment	No	Up to 10 files, max 512 MB total

Metadata Rules (Guideline 2.3)

• App names must be unique, max 30 characters
• Keywords must not include trademarked terms, popular app names, or pricing terms ("free", "sale")
• Screenshots must show the app in use, not just marketing art
• Icons, screenshots, and previews must be appropriate for a 4+ rating even if the app is rated higher
• "For Kids" and "For Children" are reserved for the Kids category
• No other mobile platform names or imagery in screenshots (no Android phones, Windows logos)
• Metadata must accurately reflect app functionality; misleading metadata is grounds for rejection

Localization Requirements

Aspect	Details
Minimum	Primary language required; all other localizations optional
Per-locale metadata	App name, subtitle, description, keywords, What's New, screenshots
Promotional Text	Localizable and editable without new submission
Screenshots	Can differ per locale (show localized UI)
App Previews	Can differ per locale (show localized audio/UI)
URL fields	Support URL and Marketing URL can differ per locale

When localizing, provide screenshots that match the localized UI. Reviewers check that screenshots accurately represent the app in each locale.

Category Selection

Primary Category	Secondary Category	Rules
Required	Optional	Choose the category that best describes your app
Must be accurate	Can complement primary	Inaccurate category is grounds for rejection (2.3.7)
Games have subcategories	—	Games must also select up to 2 game subcategories

Available categories: Books, Business, Developer Tools, Education, Entertainment, Finance, Food & Drink, Games, Graphics & Design, Health & Fitness, Lifestyle, Magazines & Newspapers, Medical, Music, Navigation, News, Photo & Video, Productivity, Reference, Shopping, Social Networking, Sports, Travel, Utilities, Weather.

---

Part 2: Privacy Requirements

Privacy Policy (Guideline 5.1.1(i))

Required in BOTH locations:

1. App Store Connect metadata (Privacy Policy URL field)
2. Within the app itself (accessible from settings or equivalent)

The privacy policy must identify:

• What data is collected and by what means
• All uses of collected data
• Third-party sharing practices
• Data retention and deletion policies
• How users can revoke consent

Privacy Manifest Schema (PrivacyInfo.xcprivacy)

<!-- Top-level keys -->
NSPrivacyTracking              <!-- Boolean: Does app track users? -->
NSPrivacyTrackingDomains       <!-- Array<String>: Domains used for tracking -->
NSPrivacyCollectedDataTypes    <!-- Array<Dictionary>: Data collected -->
NSPrivacyAccessedAPITypes      <!-- Array<Dictionary>: Required Reason APIs -->

NSPrivacyCollectedDataTypes Entry

Each dictionary in the array contains:

Key	Type	Description
NSPrivacyCollectedDataType	String	Category key (e.g., "NSPrivacyCollectedDataTypeName")
NSPrivacyCollectedDataTypePurposes	Array<String>	Purpose keys for this data type
NSPrivacyCollectedDataTypeLinked	Boolean	Is this data linked to user identity?
NSPrivacyCollectedDataTypeTracking	Boolean	Is this data used for tracking?

NSPrivacyAccessedAPITypes Entry

Each dictionary in the array contains:

Key	Type	Description
NSPrivacyAccessedAPIType	String	API category identifier
NSPrivacyAccessedAPITypeReasons	Array<String>	Approved reason codes for usage

Complete PrivacyInfo.xcprivacy Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeEmailAddress</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <true/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
            </array>
        </dict>
    </array>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>
            </array>
        </dict>
    </array>
</dict>
</plist>

API Category Identifiers

Category	Identifier String
File timestamp	NSPrivacyAccessedAPICategoryFileTimestamp
System boot time	NSPrivacyAccessedAPICategorySystemBootTime
Disk space	NSPrivacyAccessedAPICategoryDiskSpace
Active keyboard	NSPrivacyAccessedAPICategoryActiveKeyboards
User defaults	NSPrivacyAccessedAPICategoryUserDefaults

Generating Aggregate Privacy Report

Xcode > Product > Archive > Generate Privacy Report

This produces a PDF summarizing privacy manifests from your app and all embedded frameworks.

Required Reason API Categories

Category	APIs Covered	Common Reasons
File timestamp	NSFileCreationDate, NSFileModificationDate, NSURLContentModificationDateKey	DDA9.1 (display to user), C617.1 (inside app container)
System boot time	systemUptime, mach_absolute_time	35F9.1 (measure elapsed time)
Disk space	NSFileSystemFreeSize, NSFileSystemSize, volumeAvailableCapacityKey	E174.1 (check before writing), 85F4.1 (display to user)
Active keyboard	activeInputModes	54BD.1 (customize UI for keyboard)
User defaults	UserDefaults (all access requires declaration)	CA92.1 (access within app group), 1C8F.1 (access within same app)

App Privacy Details (Nutrition Labels)

Data Type Categories

Category	Examples
Contact Info	Name, email address, phone number, physical address
Health & Fitness	Health data, fitness data
Financial Info	Payment info, credit info
Location	Precise location, coarse location
Sensitive Info	Racial or ethnic data, sexual orientation, religion, biometrics
Contacts	Address book contacts
User Content	Photos, videos, audio, gameplay content, customer support messages
Browsing History	Web browsing history
Search History	In-app search history
Identifiers	User ID, device ID
Purchases	Purchase history
Usage Data	Product interaction, advertising data, app launches, taps, scrolls
Diagnostics	Crash data, performance data
Surroundings	Environment scanning (e.g., AR data)
Body	Hands, head (e.g., hand tracking in visionOS)

Purpose Categories

Purpose	Description
Third-Party Advertising	Displaying third-party ads or sharing with ad networks
Developer's Advertising/Marketing	Your own marketing campaigns
Analytics	Understanding user behavior and measuring effectiveness
Product Personalization	Customizing features, content recommendations
App Functionality	Required for app to work (e.g., authentication, data sync)
Other	Any purpose not listed above

Tracking and Collection Definitions

"Collected" means data is transmitted off-device and accessible beyond what is needed to service the current request. On-device-only processing is NOT collection.

"Tracking" means:

• Linking user/device data from your app with third-party data for advertising or measurement, OR
• Sharing user/device data with a data broker

App Tracking Transparency (ATT)

Required if your app "tracks" per Apple's definition above.

• Add NSUserTrackingUsageDescription to Info.plist (explains why tracking is needed)
• Call ATTrackingManager.requestTrackingAuthorization() before tracking
• Respect the result:
  • .authorized — User granted permission to track
  • .denied — User denied tracking; do not track
  • .notDetermined — User has not yet been asked
  • .restricted — Device-level restriction prevents tracking

Request at a contextually appropriate moment, not at first launch.

Common Purpose Strings (NS*UsageDescription)

These Info.plist keys must be present for each system permission your app requests:

Permission	Info.plist Key
Camera	NSCameraUsageDescription
Microphone	NSMicrophoneUsageDescription
Photo Library (read)	NSPhotoLibraryUsageDescription
Photo Library (write)	NSPhotoLibraryAddUsageDescription
Location (when in use)	NSLocationWhenInUseUsageDescription
Location (always)	NSLocationAlwaysAndWhenInUseUsageDescription
Contacts	NSContactsUsageDescription
Calendars (full access)	NSCalendarsFullAccessUsageDescription
Reminders (full access)	NSRemindersFullAccessUsageDescription
Health	NSHealthShareUsageDescription, NSHealthUpdateUsageDescription
Motion	NSMotionUsageDescription
Bluetooth	NSBluetoothAlwaysUsageDescription
Face ID	NSFaceIDUsageDescription
Local Network	NSLocalNetworkUsageDescription
Tracking	NSUserTrackingUsageDescription
Speech Recognition	NSSpeechRecognitionUsageDescription
Apple Music	NSAppleMusicUsageDescription

Missing purpose strings cause immediate rejection. Purpose string text must clearly explain why the permission is needed in the context of your app's functionality.

Third-Party SDK Privacy Manifests

Apple maintains a list of commonly used SDKs that require privacy manifests. Starting spring 2024, if your app includes these SDKs without privacy manifests, it will be flagged during submission.

Third-party SDKs should include their own PrivacyInfo.xcprivacy in their framework bundle. The aggregate privacy report combines all manifests from your app and embedded frameworks.

If a third-party SDK does not include a privacy manifest, you must declare its data collection in your app's privacy manifest.

---

Part 3: App Review Guidelines Quick Reference

For the complete guideline index (Sections 1-5), see references/app-review-guidelines.md.

Most Common Rejection Reasons

Based on Apple's published data, the most frequent rejection reasons:

Rank	Guideline	Issue	Prevention
1	2.1	App Completeness — bugs, crashes, placeholder content	Thorough QA before submission
2	4.3	Spam — duplicate apps, cookie-cutter templates	Ensure genuine unique value
3	2.3.3	Inaccurate screenshots	Screenshots must match actual app
4	5.1.1	Privacy — missing policy or purpose strings	Complete all privacy requirements
5	4.0	Design — not meeting minimum quality bar	Follow HIG, test all flows
6	2.5.1	Private API usage	Only use public APIs
7	3.1.1	IAP required for digital goods	Use IAP for digital content
8	4.2	Minimum functionality — app too simple	Provide genuine utility
9	5.1.1(v)	Missing account deletion	Implement full account deletion
10	2.3.7	Wrong app category	Choose accurate primary category

App Review Timeline

Stage	Typical Duration
Waiting for Review	Minutes to hours
In Review	Minutes to 24 hours
Total (90th percentile)	Under 24 hours
Total (edge cases)	Up to 7 days
Expedited Review	Same day to 24 hours (if approved)

Review times increase during holidays and major iOS release periods. Plan submissions accordingly.

---

Part 4: Age Rating System

Five-Tier Rating System (Updated January 31, 2026)

Rating	Triggers
4+	No objectionable material
9+	Infrequent or mild: profanity, cartoon/fantasy violence, horror/fear themes. Loot boxes present
13+	Frequent or intense: profanity or crude humor. Infrequent: alcohol/tobacco/drugs references, sexual content/nudity, realistic violence
16+	Unrestricted web access, frequent medical/treatment info, mature/suggestive themes
18+	Frequent or intense: alcohol/tobacco/drugs use, sexual content/nudity, realistic violence. Simulated gambling with real-money elements
Unrated	App cannot be published without completing the questionnaire

Capability Declarations (New, WWDC25)

Apps must declare if they include these capabilities:

Capability	When to Declare
Messaging/chat	Any in-app messaging between users
User-generated content	Users can post, share, or upload content visible to others
Advertising	App displays ads from any ad network
Parental controls	App has parental restrictions or family features
Age assurance	App verifies user age for restricted content

These declarations appear alongside the age rating on the App Store product page, giving parents and users additional transparency.

Regional Variations

Age ratings map differently across regions:

Apple Rating	Australia	Brazil	Korea	Germany (USK)
4+	4+	L (All ages)	All	0
9+	9+	A10	12+	6
13+	13+	A12	15+	12
16+	15+	A16	19+	16
18+	R 18+	A18	19+	18

The age rating questionnaire automatically generates the appropriate regional ratings based on your answers.

Age Rating Best Practices

• Answer the questionnaire conservatively; under-rating leads to rejection
• If your app accesses unrestricted web content (WebView without content filter), it will be rated 16+ minimum
• UGC apps typically need 13+ minimum due to moderation requirements
• Simulated gambling (even without real money) requires at least 9+
• Realistic violence in gameplay requires at least 13+

Age Rating Questionnaire Topics

The questionnaire covers these content categories:

Category	Options
Cartoon or Fantasy Violence	None, Infrequent/Mild, Frequent/Intense
Realistic Violence	None, Infrequent/Mild, Frequent/Intense
Profanity or Crude Humor	None, Infrequent/Mild, Frequent/Intense
Mature/Suggestive Themes	None, Infrequent/Mild, Frequent/Intense
Alcohol, Tobacco, or Drug Use or References	None, Infrequent/Mild, Frequent/Intense
Sexual Content and Nudity	None, Infrequent/Mild, Frequent/Intense
Horror/Fear Themes	None, Infrequent/Mild, Frequent/Intense
Simulated Gambling	None, Infrequent/Mild, Frequent/Intense
Medical/Treatment Information	None, Infrequent/Mild, Frequent/Intense
Unrestricted Web Access	Yes/No

The system automatically calculates your app's age rating across all regions based on your answers.

---

Part 5: Export Compliance

Encryption Decision Tree

Does your app use encryption?
├── No → Set ITSAppUsesNonExemptEncryption = NO in Info.plist → Done
├── Only HTTPS/TLS/URLSession?
│   ├── Yes → Exempt, set ITSAppUsesNonExemptEncryption = NO → Done
│   │         (May need annual self-classification report to BIS)
│   └── No (custom encryption) →
│       Set ITSAppUsesNonExemptEncryption = YES →
│       Upload compliance documentation to App Store Connect →
│       Receive encryption compliance code →
│       Set ITSEncryptionExportComplianceCode in Info.plist → Done

Info.plist Keys

<!-- Most apps: HTTPS only -->
<key>ITSAppUsesNonExemptEncryption</key>
<false/>

<!-- Apps with custom encryption -->
<key>ITSAppUsesNonExemptEncryption</key>
<true/>
<key>ITSEncryptionExportComplianceCode</key>
<string>YOUR_COMPLIANCE_CODE</string>

Exempt Encryption Uses

These are exempt from export documentation (but may still require annual self-classification):

• HTTPS/TLS (URLSession, Network.framework, WKWebView)
• Secure Enclave operations (biometric auth, Keychain)
• Apple's built-in encryption frameworks (CryptoKit, Security.framework) when used per Apple documentation
• Password hashing (bcrypt, scrypt, PBKDF2)

Non-Exempt Encryption Uses

These require compliance documentation:

• Custom encryption algorithms
• Open-source encryption libraries (OpenSSL, libsodium) used for non-standard purposes
• End-to-end encrypted messaging
• VPN implementations
• Custom DRM systems

---

Part 6: Account and Authentication

Account Deletion (Required Since June 2022)

Apps that support account creation must offer account deletion. Requirements:

Requirement	Details
Full deletion	Must fully delete the account, not just deactivate
Easy to find	Must be accessible from app settings; not buried behind support tickets
Inform timeline	Tell user how long deletion takes
Confirm completion	Notify user when deletion is complete
Delete shared UGC	Must handle user-generated content shared with others
Revoke SIWA tokens	Call Apple's revoke token endpoint for Sign in with Apple accounts
Handle subscriptions	Warn about active subscriptions; direct to subscription management

Sign in with Apple Token Revocation