← notes · 2026-08-30 · 2 min read · app store
App Store rejection lessons from ten apps
3.1.2, 2.1, 4.3 and the cart lock. Most rejections live in metadata, not code; you get one appeal per submission, so build the gate before you submit.
Ten apps, maybe thirty submissions in two years, a dozen rejections. Almost none were code bugs. Most came from metadata, the privacy text, and two lines on a purchase screen. The ones I see most:
3.1.2 (c): billed amount and links
The most expensive lesson. Every screen that sells a subscription must show the product name, duration, the real billed price, the auto-renewal sentence, and links to Terms of Use and Privacy. If a computed "2.99 a week" dominates while the yearly billed amount is small, that is a rejection. LensLoop had all of it on the paywall; but the last onboarding step was also a purchase surface and had none. The reviewer never reached the paywall. Lesson: every purchase surface is reviewed separately; bind the disclosure to one shared component.
2.1: a missing privacy section
Wakora's photo-match mission uses Vision's face API. Apple required a separate "Face data" section in the policy: what is collected, where it is processed, whether it is stored. Even when it is processed on device and never stored, it has to be written.
4.3: the similarity signal
Ship two apps from the same template and the signal is in metadata: similar screenshots, similar descriptions. Show the difference on the store page first, then in code.
The cart lock
If the review cart holds an IN_REVIEW product, that version cannot be resubmitted; tearing the cart apart and rebuilding it takes longer. Wait. A rejected submission locks the version; cancel first, then open a new submission.
One appeal
One appeal per submission. Fixing an ambiguous rejection by best guess and resubmitting is faster than burning the appeal. Keep the appeal for the one case where you are certain the rejection is wrong.
The gate
All of this became a script that runs before submission: is there an IAP, is the price set in 175 territories, does every locale have a privacy URL, is the privacy label published, are the screenshot sets complete. A version that fails the gate is not submitted. The last five submissions passed in one round each.