How does App Review work, what causes common rejections, and what are export compliance, the privacy labels and usage descriptions about?

25.3.2 · L3 · Interview

Predict first

An Info.plist gets the encryption declaration and a camera usage description from a script. Is it valid and what do the keys read?

// === Info.plist ===
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>CFBundleIdentifier</key><string>com.example.app</string>
</dict></plist>
  • Valid; the flag reads false and the camera reason reads back
  • Invalid: usage descriptions cannot be added by script
  • The encryption flag must be true

Mental model. App Review is a building inspector. Inspections go fastest when the plans are labelled, the exits work and the paperwork matches the building you actually constructed.

Every version goes through App Review, which checks the app against the App Store Review Guidelines (safety, performance, business, design and legal). The common rejections are mundane: crashes and obvious bugs, broken or placeholder content, a login the reviewer cannot use (always give demo credentials and notes), links to missing pages, a missing or inaccessible privacy policy, requesting permissions without a clear reason or usage description, selling digital goods without in-app purchase (Q381), apps that offer account creation but no way to delete the account in the app, misleading metadata and screenshots, and using private APIs. Write reviewer notes that explain anything unusual (hardware needed, a hidden feature, the demo account), keep the privacy policy URL working, and respond to a rejection calmly through Resolution Center with a fix or a clear explanation; appeal only when you are sure.

Three declarations must match what the app does. Export compliance: because apps use encryption (HTTPS counts as using it), App Store Connect asks whether the app uses encryption beyond what is exempt; add the ITSAppUsesNonExemptEncryption key to Info.plist (false if you only use the system’s standard encryption such as HTTPS, as in the check below) so the question is answered automatically, and check the requirements with legal if you ship your own cryptography. Privacy nutrition labels (App Privacy details) declare what data the app and its SDKs collect and why, and must be accurate, consistent with the privacy manifest and required-reason API declarations (Q345) and with the policy. Usage descriptions (NSCameraUsageDescription and its relatives) must say why in plain language, specific to your feature. Third-party SDKs count: you are responsible for what they collect. Keep a pre-submission checklist (demo account works, links work, no crashes on a clean install, screenshots current, labels accurate), and build time for a rejection into the schedule.

These are ordinary plist keys; the build pipeline can set them, and the declarations still have to be true.

Common traps

  • No working demo account for features behind a login. The reviewer cannot test the app and rejects it.
  • Privacy labels that disagree with what the app or its SDKs actually do. That is a rejection and a trust problem.

They might follow up with

  • What does ITSAppUsesNonExemptEncryption do? It answers the export-compliance question in advance so builds do not stop for it.
  • What should reviewer notes contain? Demo credentials and anything the reviewer cannot discover alone.

Related questions

  • 25.3.1 What is the path from an archive to users: TestFlight internal and external testing, review, release options…
  • 25.1.2 What is the difference between a capability, an entitlement and an Info.plist key, and what breaks when they…
  • 25.3.3 What can and cannot be rolled back after release, and how do you respond to a bad release: pause, flags…
  • 14.3.1 What is a privacy manifest, what are required-reason APIs, and what must third-party SDKs declare?
  • 17.4.2 How does StoreKit 2 work: products, purchases, transaction verification, entitlements, refunds, and what must…

← What is the path from an archive to users: TestFlight internal and…   What can and cannot be rolled back after release, and how do you… →