Full-lifecycle Apple App Store review for iOS and iPadOS apps. Use for pre-submission audits, rejection diagnosis and Resolution Center replies, Guideline 4.3 spam or similarity recovery, human-craft and low-effort audits, App Review Notes, privacy manifests, Info.plist permission strings, subscriptions, Sign in with Apple, account deletion, UGC, third-party AI consent, TestFlight or App Store readiness, and vague requests such as "review my app" or "will Apple approve this" when an Xcode, Expo, React Native, or Flutter project is present. Produces evidence-tagged Markdown, JSON, and a self-contained visual HTML report, runs a read-only deterministic scan first, and only offers grouped fixes after the report.
95
94%
Does it follow best practices?
Impact
99%
1.67xAverage score across 3 eval scenarios
Passed
No findings from the security scan
Use this only after preserving Apple's exact message and the submitted build or metadata context. Apply references/evidence-policy.md to every claim.
Begin the recovery analysis with:
Mode B: Rejection recovery
Apple's message (verbatim):
> <copy every supplied line exactly>
Response classification: <exactly one of FIX, CLARIFY, APPEAL, REQUEST INTERPRETATION>Do not rename the classification, add adjectives to it, or replace evidence-confidence labels with strength ratings.
Capture before advising:
Do not infer the rejected build from the current branch when they differ.
| Apple wording or situation | Likely family | First investigation |
|---|---|---|
| Bug, crash, blank screen, or unable to proceed | 2.1 completeness | Reproduce the exact path, device, account, network, and backend state |
| Unable to sign in or information needed | Review access, often 2.1 | Credentials, region blocks, MFA, demo mode, setup, and reviewer notes |
| Screenshot, description, keyword, or platform mismatch | 2.3 metadata | Compare every claim and image with the rejected build |
| External payment or purchase method | 3.1 | Classify the good, storefront, entitlement, and exact purchase path |
| Subscription terms or restore issue | 3.1.2 | Inspect billed price, period, trial conversion, links, and restore behavior |
| Minimum functionality or web-wrapper concern | 4.2 | Identify native value, core depth, and whether product work is required |
| Similar binary, metadata, concept, or spam | 4.3 | Preserve the phrase and use the 4.3 playbook below |
| Commercialized template or generation service | 4.2.6 | Establish content-provider eligibility and code or template provenance |
| Login alternative | 4.8 | Check the current text and exceptions, then inspect all login choices |
| Collection, consent, deletion, or data sharing | 5.1 | Trace the exact data and user-control flow |
| Third-party AI data sharing | 5.1.2(i) | Identify data, provider, disclosure, permission, and call order |
| UGC, chat, reporting, or abuse | 1.2 | Exercise filtering, report, block, contact, and moderation operations |
If the wording is ambiguous, ask one precise interpretation question. Do not make several unrelated changes in the hope that one satisfies Apple.
Choose when the finding is correct or the submitted evidence cannot satisfy the rule.
Provide:
Choose when the feature exists but Apple could not find, access, or understand it.
Provide:
DOCUMENTED CASE: Developers have reported approvals after exact navigation and visual evidence clarified a paywall or purchase route. This supports the tactic, not a guaranteed outcome.
Choose only when:
An appeal is not a substitute for fixing a clear crash, purchase, consent, or access defect. Do not promise a specific Board timeline.
Choose when Apple's message does not identify the capability, comparator, or expected change well enough to act safely.
Ask one concrete question, for example:
Could you identify the specific capability or screen that does not satisfy Guideline 4.2 so we can address the issue directly?
Use a Resolution Center call request or Meet with Apple to understand the rule's application, not as an approval shortcut.
OFFICIAL: Apple's public wording covers multiple Bundle IDs of the same app and apps that are indistinguishable from what is already widely available. Apple and its forum guidance also discuss source, assets, templates, metadata, and concept in spam cases.
OBSERVED PATTERN: Very fast 4.3 decisions are consistent with automated or assisted similarity triage.
INFERENCE: Public evidence does not reveal Apple's classifier, feature weights, comparison corpus, or whether a particular decision was fully automated. Never present symbol hashing, metadata embeddings, device graphs, or asset hashing as confirmed implementation details.
Every 4.3 analysis must name both subsections, identify the cited subsection, and explain that 4.3(a) usually calls for consolidation or provenance evidence while 4.3(b) usually calls for stronger product distinction. Prefix this policy explanation with OFFICIAL.
The remedy differs. 4.3(a) often requires consolidation or provenance evidence. 4.3(b) often requires stronger product distinction, not a longer appeal.
| Dimension | What to establish | Confidence |
|---|---|---|
| Portfolio overlap | Sibling apps, Bundle IDs, shared features, white-label variations | OFFICIAL when it maps to 4.3(a) |
| Template provenance | Commercial template, generator, starter kit, content owner, license, transformation | OFFICIAL for 4.2.6; case-specific for 4.3 |
| Source lineage | Upstream project, inherited namespaces, dependencies, prior owners | DOCUMENTED CASE when supported by the app's history |
| Assets | Icon and major asset reuse across the portfolio or source kit | DOCUMENTED CASE as a remediation signal, not a universal trigger |
| Metadata and concept | Audience, first sentence, screenshots, first-run flow, category framing | OFFICIAL that metadata and concept matter in cited spam wording |
| Framework | How much behavior is unique beyond Flutter, React Native, Capacitor, Godot, or another engine | INFERENCE unless Apple's message or provenance supports it |
| Account association | Prior ownership, transfers, contractors, or an alleged terminated-account match | Case-specific; do not guess hidden identifiers |
| Action | Recommendation | Evidence confidence |
|---|---|---|
| Consolidate near-identical apps into one configurable app | Strong when 4.3(a) concerns a portfolio of variants | OFFICIAL |
| Build a meaningfully different workflow for a specific audience | Strong when 4.3(b) is factually justified | OFFICIAL principle |
| Prove ownership and provenance | Strong for a false match or inherited project | DOCUMENTED CASE |
| Replace a reused or near-identical icon and key assets | Consider when asset overlap is real | DOCUMENTED CASE, isolated outcomes |
| Explain framework-common code and enumerate unique behavior | Use for a plausible framework false positive | DOCUMENTED CASE, limited sample |
| Rewrite generic metadata around a specific user and job | Useful for 4.3(b), but insufficient for a thin product | OFFICIAL principle plus OBSERVED PATTERN |
| Recolor screens or rename controls without product change | Do not treat as sufficient | OBSERVED PATTERN |
| Obfuscate code to evade similarity checks | Do not recommend | Unsupported and deceptive |
| Move an unchanged app to another account | Do not recommend | High enforcement risk and does not solve provenance |
| Repeatedly resubmit an unchanged build | Do not recommend | Adds no new evidence and can prolong the loop |
Include only evidence that exists:
Do not say "built from scratch" unless repository history and provenance support it.
Apple's current App Store Connect Help confirms that developers can correspond with App Review and attach screenshots or supporting documents. It does not prescribe an ideal word count.
Use this shape:
Thank you for the review of version <VERSION>, build <BUILD>, under Guideline <NUMBER>.
We <fixed the issue | would like to clarify the review path>:
1. <Exact screen and control>
2. <Next action>
3. <Expected result>
<For a fix: state the root cause and exact change.>
<For access: provide credential placeholders, region, setup, and attachment names.>
<For 4.3: summarize specific audience, unique workflow, and provenance evidence.>
Please let us know if you need <one specific missing detail>, or re-review build <BUILD> using the steps above.Quality checks:
After resolution:
When contributing the case back to this skill, include the wording, changes, outcome, date, and URL. A case without an outcome belongs in an open-evidence queue, not the remediation table.