What the store reviewer checks
These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.
Two links: App Store Connect and the app
Guideline 5.1.1 asks for the policy link in the App Store Connect metadata field and inside the app, where people can find it easily. The policy must say what the app collects, how, and every use of that data.
Third parties, retention and deletion
The policy must confirm that partners with access to user data, such as analytics tools, ad networks and SDKs, give the same protection. It must explain retention and deletion, and how a user can revoke consent or ask for deletion.
Account deletion and tracking permission
If the app lets people create an account, it must also let them delete it inside the app. To track people across other companies' apps and websites, the app must first ask through App Tracking Transparency.
What to account for
Policy in the listing and app
Apple requires an accessible policy in App Store Connect and in the app. Explain collection, uses, third parties, retention, deletion and how users revoke consent.
App Privacy includes partners
App Privacy answers cover your practices and integrated third parties. Classify data types, purposes, linkage to identity and tracking accurately.
Deletion and tracking are implemented features
Apps supporting account creation must let users initiate deletion within the app. Apple allows additional support flows in some highly regulated industries.
Common mistakes to check
Treating every permission as ATT
ATT concerns tracking across other companies’ apps or websites and access to the advertising identifier. A policy or cookie banner does not replace the required system permission.
A privacy label that omits the SDK
You remain responsible for partner collection. Check the actual SDK configuration before claiming that a data type is not collected.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Map the released app
Collect the current SDK list, permissions, account flows and server processors. Include a privacy contact and confirmed retention decisions.
Draft and compare
Use website evidence as a starting point. Add native facts in Ask and compare the resulting draft with App Store Connect answers.
Test on a device
Open the policy without a session. Exercise deletion, denied tracking and changed preferences on a real build; preserve the review notes.
Example
Fictional app: Harbor Planner
Assume email accounts, cloud reminders and a crash reporter without ads. The owner supplies the SDK facts; the website only supplies observations about the marketing site.
Separate evidence from answers
The reviewer compares the proposed crash-reporting purpose with the SDK configuration and the App Privacy answers. Any uncertainty stays an open question instead of becoming a confident policy sentence.
Questions before publishing
Is App Privacy the policy?
No. App Privacy is a structured disclosure in App Store Connect. It is maintained separately from the linked privacy policy.
Is ordinary analytics always tracking?
Apply Apple’s tracking definition to the actual data use. The label “analytics” by itself does not decide whether ATT applies.
Is deactivation enough?
No. Apple distinguishes deletion from temporary deactivation. Explain any data that must be retained and how the deletion request is completed.
Source review and changes
Review checks added from guidelines 5.1.1 and 5.1.2: the two policy links, third parties, deletion and tracking permission. Sources reviewed on the date above.