App Store launch checklist: what Apple requires before your first iPhone release

1 Account and compliance status

• Enrol in the Apple Developer Program.

  Membership costs 99 USD per membership year, or the local-currency equivalent where available.

  Official source

• Enrol as an organisation if a company publishes the app, with the company's D-U-N-S number.

  Apple verifies the organisation's identity, legal entity status and address through D-U-N-S, and does not accept trade names, DBAs or branches.

  Official source

• Declare your EU trader status in App Store Connect.

  Required even if you do not distribute in the EU. Traders' verified address, phone number and email are shown on EU product pages, and apps without a status are removed from the EU storefront.

  Official source

2 The build

• Build with Xcode 26 or later and the iOS 26 SDK.

  Required for uploads since 28 April 2026. Apple has announced that from April 2027 builds must use the iOS 27 SDK.

  Official source

• Set the minimum deployment target to iOS 13 or later.

  Apple has required iOS and iPadOS uploads to target iOS 13 or later since 9 September 2026.

  Official source

• Include a privacy manifest that gives an approved reason for every required-reason API the app or its SDKs use.

  Since 1 May 2024, App Store Connect does not accept apps that fail to describe their use of required-reason APIs.

  Official source

• Check each SDK against Apple's list and make sure listed SDKs ship their own privacy manifest and signature.

  Required when a new app, or an update that adds one, includes a listed SDK; the list includes the Firebase SDKs, GoogleSignIn and OneSignal.

  Official source

• Write a clear purpose string for every permission the app asks for, such as camera, photos and location.

  Guideline 5.1.1(ii) asks that purpose strings clearly and completely describe the use of the data, and that paid features never depend on granting access.

  Official source

• Answer the export compliance questions, or set ITSAppUsesNonExemptEncryption in Info.plist so they are answered once.

  App Store Connect asks about encryption on every new version; HTTPS through the system networking APIs is typically exempt from document uploads.

  Official source

• Ship the build to testers through TestFlight before submitting it for review.

  Signing, bundle identifier and missing-permission problems show up at upload and in TestFlight, days before App Review would find them.

3 Privacy and accounts

• Link a privacy policy in App Store Connect and somewhere easy to find inside the app.

  Guideline 5.1.1(i) requires both.

  Official source

• Fill in App Privacy details, including the practices of every analytics, advertising and other third-party SDK in the app.

  Apple requires this information to submit new apps and every update.

  Official source

• If the app supports account creation, let users start account deletion inside the app.

  Guideline 5.1.1(v). Apple says offering only to deactivate or disable an account is not enough, and apps using Sign in with Apple should revoke its tokens on deletion.

  Official source

• If you offer a third-party or social login for the main account, also offer an equivalent login that collects only name and email, lets users keep their email private and does not track them for ads without consent.

  Guideline 4.8, changed in January 2024. Sign in with Apple is one service that meets these criteria; the guideline no longer names it.

  Official source

• Ask permission through App Tracking Transparency before tracking users, and get explicit permission before sharing personal data with third-party AI services.

  Guideline 5.1.2 covers both, including personal data shared with third-party AI services.

  Official source

4 Content, payments and age

• Use in-app purchase for digital unlocks, and your own payment method for physical goods or services used outside the app.

  Guideline 3.1.1 requires in-app purchase for subscriptions and premium content; 3.1.3(e) says physical goods and services consumed outside the app must use other methods, such as Apple Pay or card entry.

  Official source

• If users post content or chat, add filtering, reporting with timely responses, blocking and published contact details.

  Guideline 1.2 requires all four for user-generated content, social and AI content-creation apps.

  Official source

• Make sure the app does more than wrap a website.

  Guideline 4.2 rejects apps that are not useful, unique or app-like beyond a repackaged website.

  Official source

• Complete the age rating questionnaire, including the social media questions.

  An age rating (4+, 9+, 13+, 16+ or 18+) is required, and since September 2026 Apple requires the social media answers for new apps and updates.

  Official source

• If the app is in Health & Fitness or Medical and distributed in the EEA, UK or US, declare its regulated medical device status.

  Apple has required the status for new apps that meet its criteria since 26 March 2026.

  Official source

5 Submission

• Submit a final build with no placeholder content, the backend switched on, and a demo account in the review notes.

  Guideline 2.1. A demo mode instead of an account needs Apple's prior approval.

  Official source

• Make the description, screenshots and privacy answers match the app, and describe new features specifically in Notes for Review.

  Guideline 2.3; Apple says generic descriptions of new features will be rejected.

  Official source

• Upload screenshots for Apple's required display sizes: at least one for iPhone with Dynamic Island, and one for the 13-inch iPad if the app runs on iPad.

  Apple will not accept the submission without them. Its specification page also lists cases where other sizes are required, so check the list in App Store Connect on the day.

  Official source

• Plan for review time.

  Apple says App Review typically reviews at least 50% of submissions in under 24 hours and 90% in under 48 hours.

  Official source

What did these checks catch in our own builds?

Questions about this checklist