app store
Common App Store Rejections and How to Fix Each One
The App Store rejections indie apps hit most (2.1, 2.3, 4.2, 4.3, 5.1.1, 3.1.1, 4.8, new 2.5.19): what each means, the fix, and how to reply or appeal.
By Kyle Hurst ·
An App Store rejection feels personal, but it almost never is. Most indie rejections come from the same short list: a broken demo login (2.1), screenshots that don’t show the app (2.3), a thin web wrapper (4.2), a clone (4.3), a missing privacy policy or account deletion (5.1.1), and payments routed around in-app purchase (3.1.1). Each has a known cause and a known fix, and some don’t even need a new build.
This guide covers each one as of the App Review Guidelines dated October 16, 2026. If you haven’t submitted yet, run through our App Store submission checklist first. It’s built around these exact failure points.
What a rejection looks like now
Rejections arrive as App Review messages in the App Review section of your app’s page in App Store Connect. Older tutorials call this the “Resolution Center”; Apple’s documentation no longer uses that name. The message names the guideline it cites (for example, Guideline 2.1 - Performance - App Completeness) and describes what the reviewer saw.
The status matters. Rejected usually means a new build. Metadata Rejected means only your listing is the problem, and Apple says you “can resubmit the same build.” Invalid Binary means the upload itself failed a check.
2.1 App Completeness: the demo account problem
What it says: Submissions “should be final versions with all necessary metadata and fully functional URLs included,” with placeholder content scrubbed. Apple asks you to “include demo account info (and turn on your back-end service!)” and will “reject incomplete app bundles and binaries that crash or exhibit obvious technical problems.”
Why it happens: The demo credentials were missing, expired, or pointed at a sleeping staging server. The app crashed on the reviewer’s device (test the iPad layout too, even for an iPhone-only app). In-app purchases weren’t ready; 2.1(b) requires them to be “complete, up-to-date, visible to the reviewer and functional.” Or a “coming soon” tab or dead support URL made it in.
The fix: Put a working login in the App Review notes, and make sure it never expires (App Store Connect says the credentials “must not expire”). Keep the backend up for the whole review. Create your IAPs in App Store Connect and attach them to the submission. Sending the exact build to a few TestFlight external testers first is a cheap way to catch the crash-on-launch and dead-login problems before a reviewer does. If legal or security rules stop you from sharing an account, 2.1(a) allows a built-in demo mode, but only “with prior approval by Apple.”
2.3 Accurate Metadata: screenshots, names, and creative assets
What it says: Metadata must “accurately reflect the app’s core experience.” Screenshots “should show the app in use, and not merely the title art, login page, or splash screen” (2.3.3). Names are capped at 30 characters (2.3.7), metadata must suit a 4+ audience even if the app is rated higher (2.3.8), and you shouldn’t show other platforms (2.3.10).
Why it happens: Marketing slides with no app UI. “Free,” prices, or competitor names in the name, subtitle, or keywords. Android phones left over from a cross-platform marketing kit. Or vague review notes: 2.3.1(a) says new features “must be described with specificity” and “generic descriptions will be rejected.”
The new one, 2.3.14: The iOS 27 product page header and search result images are governed by guideline 2.3.14. They must relate to your app or brand, “be appropriate for all audiences,” and must not include “references to other apps with an intent to mislead, unverifiable product claims, or specific or discounted pricing information.” So “50% off” or “#1 budgeting app” in header art is out.
The fix: Build screenshots around real app screens; captions and device frames are fine as long as the UI is the star. Strip prices and other brands from text fields. This is usually Metadata Rejected, so no new build. Our App Store screenshot generator frames real screens at the required sizes, and the header and search image generator builds the iOS 27 artwork with crop zones marked. Sizes are in our App Store screenshot sizes guide and our iOS 27 header and search image guide.
4.2 Minimum Functionality: web wrappers and thin apps
What it says: “Your app should include features, content, and UI that elevate it beyond a repackaged website. If your app is not particularly useful, unique, or ‘app-like,’ it doesn’t belong on the App Store.” Per 4.2.2, apps shouldn’t primarily be “marketing materials, advertisements, web clippings, content aggregators, or a collection of links.”
Why it happens: A WebView pointed at your site that does nothing a bookmark couldn’t. A single screen or link list. Agencies hit 4.2.6, which rejects template and app-generator apps unless the content owner submits them.
The fix: Give the app a reason to exist on a phone: offline access, notifications, widgets, share-sheet or Shortcuts support, camera or health integration where it fits. Make navigation and error states feel native rather than like a browser in a frame. Clients should submit under their own accounts. When you reply, list the native features explicitly; the reviewer may not have found them.
4.3 Spam: clones and duplicate bundles
What it says: “Don’t create multiple Bundle IDs of the same app” (4.3(a)), and don’t submit apps “indistinguishable from what’s already widely available” (4.3(b)). Apple names “dating, flashlight, sound effects, wallpaper, simple timers, and fortune telling” as categories where it won’t accept new apps “unless they offer a meaningfully different or improved experience.”
Why it happens: The same app under several names (per city, lite and pro, a reskin per client), or an ordinary app in a saturated category with no explanation of what’s different.
The fix: Merge variants into one app and differentiate with in-app purchase, settings, or content packs. If your app genuinely improves on the others, spell out the specific features in the review notes. A duplicated binary is hard to defend; an original app in a crowded category is often a communication problem.
5.1.1(i) Privacy policy
What it says: “All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.” The policy must say what data you collect, how, and for what; confirm third parties give equal protection; and “explain its data retention/deletion policies and describe how a user can revoke consent and/or request deletion of the user’s data.”
Why it happens: The link exists only in App Store Connect. The URL is dead. A generic template skips your analytics and crash SDKs or says nothing about retention. You’re responsible for disclosing what third-party SDKs collect, and your policy should agree with your App Privacy answers.
The fix: Host the policy at a stable public URL, add it to App Store Connect, and link it inside the app (Settings or About). Our app privacy policy generator builds it from a checklist of the data and SDKs you use, with the sections 5.1.1(i) requires. Apps that collect nothing still need one; see do I need a privacy policy if my app collects no data.
5.1.1(v) Account deletion
What it says: “If your app supports account creation, you must also offer account deletion within the app.” Apple’s account deletion page adds that “only offering to temporarily deactivate or disable an account is insufficient,” and that apps outside highly regulated industries “should not require people to make a phone call, send an email, use a chat support flow.”
Why it happens: Signup is in the app, but deletion is “email support” or a deactivate toggle.
The fix: Add Delete Account in account settings. You can hand off to a web page to finish, as long as the link goes straight to deletion. Deletion can happen later if you say how long it takes and confirm when it’s done; if the law makes you keep some records, say which. With Sign in with Apple, revoke the user’s tokens through its REST API. The same guideline also says apps without “significant account-based features” should work without a login, so don’t wall off a calculator behind signup. Our account deletion guide compares Apple’s rule with Google Play’s, which also wants a web deletion URL.
5.1.2 Data use, ATT, and third-party AI
What it says: “You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so.” Tracking needs permission “via the App Tracking Transparency APIs,” and apps “may not require users to enable system functionalities (such as push notifications, location services, tracking) in order to access functionality.”
Why it happens: An ad or attribution SDK tracks before the ATT prompt. Apple’s user privacy page says an SDK that combines data across other developers’ apps counts as tracking “even if you don’t use the SDK for these purposes.” The app won’t work until the user allows tracking or location. Or user content goes to an AI API with no disclosure.
The fix: Show the ATT prompt before any tracking, and keep the app usable if the answer is no. If user text, photos, or audio go to an outside AI provider, say so before the first send, get an explicit yes, and name the provider in your policy. Reconcile your App Privacy answers with every SDK in the build; those answers can change without a new binary.
3.1.1 In-app purchase and the US link change
What it says: To unlock features or functionality, “you must use in-app purchase.” Apps can’t use “their own mechanisms to unlock content or functionality, such as license keys, augmented reality markers, QR codes, cryptocurrencies.” You also need a restore mechanism.
The US change: Guideline 3.1.1(a) now says link-out entitlements “are not required for developers to include buttons, external links, or other calls to action in their United States storefront apps.” That changed in May 2025. Other storefronts still need an entitlement where Apple offers one, so the same button can pass in the US and fail elsewhere.
Why it happens: Digital content unlocked through Stripe checkout or a license key, a web-purchase button shown outside the US, no Restore Purchases, or IAPs not submitted with the build.
The fix: StoreKit for digital goods; physical goods and real-world services can use other payments. Add Restore Purchases. Scope any web-checkout button to the US storefront unless you hold the entitlement elsewhere.
4.8 Login services: not just “add Sign in with Apple”
What it says: If a third-party or social login (Facebook, Google, X, LinkedIn, Amazon, WeChat) sets up the primary account, you “must also offer as an equivalent option another login service” that limits data to name and email, lets users keep their email private, and doesn’t collect app interactions for advertising without consent.
The nuance: The guideline lists features, not a brand. Sign in with Apple meets them and is the easy choice, but isn’t the only option. No extra login is needed if you only use your own accounts, require an existing education or enterprise account, use a government or industry-backed eID, or are a client for a specific third-party service.
2.5.19 Hidden features (new in October 2026)
What it says: “Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review.” Hiding them through obfuscation “is grounds for removal of your app from the App Store and termination of your developer account.”
Why it matters: This targets apps that show reviewers one thing and flip after approval. The penalty is your account, not a rejection. The guideline doesn’t address ordinary remote config or staged rollouts, so the safe move is to describe server-controlled features in your review notes.
How to respond to a rejection
Reply in App Store Connect. “Reply to App Review” gives you 4,000 characters plus attachments (Account Holder, Admin, or App Manager role). If the reviewer missed something, a short reply with a screen recording can resolve it without a new build.
Fix and resubmit. For metadata issues, edit the listing and resubmit the same build. For binary issues, upload a new build and say what changed. Fix the whole class of problem, not just the flagged screen; repeat rejections for the same guideline slow things down.
Appeal to the App Review Board if you think the guideline was misapplied. Apple asks you to “only submit one appeal per rejected or removed app” and to address every cited guideline in it, so quote the guideline and bring evidence.
Ask for a Bug Fix Submission. If your app is already live, Apple says “bug fixes will not be delayed over guideline violations except for those related to legal or safety issues.” Reply to the message rather than resubmitting. You still fix the issue next time, and a deferred issue isn’t “eligible to be deferred again.”
Request expedited review only for emergencies, like “fixing a critical bug or timing your release to coincide with an event.” Submit first, then file the request. Overuse can get future requests refused.
Apple says it reviews “at least 50% of submissions in less than 24 hours and 90% in less than 48 hours,” so a quick, specific reply usually costs a day, not a week.
Summary table
| Guideline | Usual cause | Fix | Our tool |
|---|---|---|---|
| 2.1 Completeness | Demo login fails, crash, IAP not attached | Non-expiring demo account, live backend | Submission checklist |
| 2.3 Metadata | No app UI in screenshots, prices or rivals in text | Real screens, clean text, specific notes | Screenshot generator |
| 2.3.14 Creative assets | Pricing or claims in header/search art | Brand or feature art only | Header & search images |
| 4.2 Minimum functionality | WebView wrapper, link list | Add native features | Submission checklist |
| 4.3 Spam | Duplicate bundles, clone in crowded category | One app; explain the difference | — |
| 5.1.1(i) Privacy policy | No in-app link, SDKs missing | Hosted policy, linked in ASC and app | Privacy policy generator |
| 5.1.1(v) Account deletion | Email-us or deactivate-only | In-app Delete Account | Privacy policy generator |
| 5.1.2 Data use | Tracking before ATT, undisclosed AI | ATT first, consent for AI sharing | Privacy policy generator |
| 3.1.1 In-app purchase | Web checkout for digital goods | StoreKit, restore, US-only links | — |
| 4.8 Login services | Social login only | Add a privacy-preserving equivalent | — |
| 2.5.19 Hidden features | Post-review remote switch | Document server-controlled features | — |
Icons cause their own upload failures, usually from transparency. The App Icon Generator flattens transparent sources and exports the full Xcode set; the app icon sizes guide covers current iOS requirements.
Before you hit submit
Almost every rejection here is catchable by checking your build and listing the way a reviewer will. The App Store submission checklist covers the demo account, privacy links, account deletion, screenshots, ATT, and in-app purchase setup in one pass, so the first message from App Review is the approval.