App launch checklists
7 checklists with 145 items for the moments an app most often stalls: store review, launch day, security and data-protection readiness, and taking over code from another team. Every platform rule links to the official page it comes from, with the date we checked it.
Checked 20 October 2026
Google Play Launch ChecklistTo publish a new Android app on Google Play in October 2026 you need a verified developer account, an Android App Bundle that targets Android 16 (API level 36), every App content declaration completed (privacy policy, data safety, content rating, target audience, ads, financial features, health), account deletion in the app and on the web if users can sign up, and a working login for the reviewers. A new personal account must also run a closed test with at least 12 testers opted in for 14 days in a row before it can apply for production. Each rule below links to Google's own page, checked on 20 October 2026.App Store Launch ChecklistTo submit a new iPhone app in October 2026 you need an Apple Developer Program membership (99 USD a year), a build made with Xcode 26 and the iOS 26 SDK, a privacy manifest that covers required-reason APIs and listed SDKs, App Privacy details in App Store Connect, account deletion inside the app if users can sign up, an equivalent private login option if you offer a social login, an age rating and a demo account for App Review. A disclosure first: none of our apps is live on the App Store yet; Trainr's and LetSlic's iOS builds reached TestFlight. Every rule below comes from Apple's own pages, checked on 20 October 2026.SaaS Launch ChecklistBefore a SaaS product takes its first payment, check five things: billing runs on live keys with verified, duplicate-safe webhooks; no customer can see another customer's data; the pages your payment gateway requires are live; errors and downtime reach someone who will act; and your email arrives and your pages can be found. The items below come from SaaS products we have built, with Stripe, Razorpay, Google and OWASP rules linked and checked on 20 October 2026.Marketplace Launch ChecklistA marketplace is ready to launch when its money reconciles, with every sale, refund and payout balancing across buyer, seller and platform; when every supplier is checked before they can earn; when both sides can report, block and dispute; and when the platform meets the consumer rules where it sells. In India that means the Consumer Protection (E-Commerce) Rules, 2020, including a grievance officer who acknowledges complaints within 48 hours and resolves them within a month. The checks come from Trainr, Pakka and LeafRanger and from the official rules, checked on 20 October 2026. The legal items are a planning summary, not legal advice.Agency Handover ChecklistWhen an agency or freelancer hands over your product, you should end up holding the code with its full history in your own repository, every account in your company's name, the release signing material, deploy and rollback runbooks, environment templates without secrets in them, a data export, and a written record of what works, what does not and who owns each open item. The test is simple: your next developer can build, release and roll back without calling the old team. Our own example, below, is the handover of Trainr to the client's own developer on 13 August 2026.Pre-Launch Security ChecklistBefore launch, prove five things: no user can reach another user's data, no secret ships inside your app or web bundle, every payment and webhook is verified on the server, your dependencies carry no known critical flaws, and your logs are good enough to investigate an incident. In India, CERT-In's directions of 28 April 2022 also require listed cyber incidents to be reported within 6 hours and logs to be kept for 180 days. Use the OWASP Top 10:2025 as the map and OWASP ASVS 5.0 Level 2 as the bar most applications should aim for. Official sources checked on 20 October 2026; this is not a penetration test, and the CERT-In items are a planning summary, not legal advice.DPDP Readiness Checklist for AppsIndia's Digital Personal Data Protection Act, 2023 (assented to on 11 August 2023) and the DPDP Rules, 2025 (published in the Gazette dated 13 November 2025) come into force in three steps. The Data Protection Board provisions applied on publication; the consent manager rules apply one year later; and almost every duty on app and SaaS businesses, from notices and security safeguards to breach reporting, erasure and user rights, applies eighteen months after publication, which we calculate as 13 May 2027. As of 20 October 2026 we found no official change to that timeline. This page is a planning checklist built from MeitY's published text, not legal advice.