Review Guidelines

Policy checks for your app type.

Source: Xcode project (local, heuristic). AuditStore infers an app-type profile from a token scan of your source, then emits only the guideline items that apply to your app. Because a trait is detected in code but compliance can’t be proven statically, every item is a Recommended “verify” finding (a few are Info heads-ups) — never Blocking — and each cites an Apple guideline with a deep link into the App Store Review Guidelines.

How traits are detected

The analyzer scans your Swift/ObjC sources for tokens and sets profile flags:

Trait	Detected from tokens like
Sign in with Apple	ASAuthorizationAppleIDProvider, SignInWithAppleButton
Third-party login	GIDSignIn, FBSDKLoginKit, FacebookLogin, FirebaseAuth, Auth0
Tracking	ATTrackingManager
In-app purchase	SKPaymentQueue, SKProduct, Product.products, Transaction.currentEntitlements, AppStore.sync
Push notifications	UNUserNotificationCenter, registerForRemoteNotifications

An “account system” is inferred from the presence of login traits.

Sign in with Apple (4.8)

ID: guideline-siwa · Emitted when: a third-party / social login is detected

• Passed — a third-party login is present and Sign in with Apple is also offered.
• Recommended — third-party login detected, but no Sign in with Apple. Guideline 4.8 requires an equivalent privacy-focused option alongside a social login.

Don’t re-request data after Sign in with Apple (4.8 / 5.1.1)

ID: guideline-siwa-data · Emitted when: Sign in with Apple is detected

• Info — Sign in with Apple lets users hide their name and email. Forcing them to type it into a separate form afterward defeats the privacy guarantee and is rejected. Use the name/email returned by ASAuthorization, and honor the private-relay email — don’t require a “real” address.

In-app account deletion (5.1.1(v))

ID: guideline-account-deletion · Emitted when: an account system is detected

• Recommended — the app appears to support account creation, so it must let users initiate account deletion from within the app. A “contact us to delete” flow is not sufficient.

App Tracking Transparency (5.1.2 / ATT)

ID: guideline-att · Emitted when: tracking APIs are detected

• Recommended — verify the ATT prompt (ATTrackingManager.requestTrackingAuthorization), an NSUserTrackingUsageDescription purpose string, and that the data is flagged “Used to Track You” in App Privacy — all three must be present and consistent.

In-app purchase for digital goods (3.1.1)

ID: guideline-iap · Emitted when: StoreKit is detected

• Recommended — verify digital content is sold only through in-app purchase. Buttons or links steering users to an external purchase flow for digital goods are rejected. Physical goods consumed outside the app should not use IAP — confirm which applies.