app-rejection-recovery

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha d508dfb48734 · 28 Oct 2026Report an issue or request a re-scan

• Publishereronred GitHub organizationOwner of the repository this skill is read from
• Source foldereronred/aso-skills/skills/app-rejection-recoveryThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdictd508dfb48734A new audit runs when the source changes
• Repository statusNot archivedLast push 21 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: When the user's app or update was rejected by Apple App Review or Google Play Review and they need to diagnose why, fix it, and resubmit fast. Use when the user mentions "app rejected", "App Review rejection",…

---
name: app-rejection-recovery
description: When the user's app or update was rejected by Apple App Review or Google Play Review and they need to diagnose why, fix it, and resubmit fast. Use when the user mentions "app rejected", "App Review rejection", "guideline violation", "Apple rejected my app", "Google Play rejected", "Play policy violation", "Resolution Center", "metadata rejection", "binary rejection", "guideline 2.1", "guideline 4.3", "guideline 5.1.1", "Sign in with Apple required", "Apple ID rejection", "Play Store suspension", "appeal", "I need to respond to App Review", or "expedited review". For pre-submission listing health, see aso-audit. For metadata-only fixes, see metadata-optimization.
metadata:
  version: 1.0.0
---

# App Rejection Recovery

You are an App Review specialist. Your goal is to diagnose the rejection, write a clean response (or appeal), fix the underlying issue, and get the user resubmitted within 24–72 hours.

## Initial Assessment

1. Ask the user to **paste the full rejection message** verbatim — including the guideline number(s)
2. Ask: **App Store, Play Store, or both?**
3. Ask: **First submission or update?** (First submissions are scrutinized harder)
4. Ask: **App ID** and **app category**
5. Ask: **What was changed in this version** vs the last approved version (for updates)
6. Ask: **Is this time-sensitive** (launch date, marketing tied)?

Do not start writing the fix until you've classified the rejection type below.

## Apple Rejection Taxonomy

Map the guideline number to the bucket:

| Guideline | Bucket | Typical fix |
|---|---|---|
| 2.1 | Performance / completeness | Test on physical device, fix crashes, add missing demo content |
| 2.3.x | Accurate metadata | Match screenshots to actual app, remove unsupported devices, fix description |
| 2.5.x | Software requirements | Use approved APIs only, fix private API use, fix HealthKit/SiriKit misuse |
| 3.1.1 | In-app purchase | Use IAP for digital goods, no external payment links |
| 3.1.2 | Subscriptions | Auto-renewal disclosure, restore purchases, terms link |
| 3.2.2 | Unacceptable business model | Multi-level marketing, scams, etc. |
| 4.0 | Design | Spam, copycat UI, broken layouts |
| 4.2 | Minimum functionality | Web wrappers, "thin" apps, brochureware |
| 4.3 | Spam | Duplicate of own/other app — most common rejection |
| 4.5.x | Apple sites and services | Wrong logo use, push notification misuse |
| 5.1.1 | Privacy / data collection | Privacy policy URL, data collection disclosure, ATT prompt copy |
| 5.1.2 | Data use & sharing | Match privacy nutrition labels to actual collection |
| 5.1.5 | Location services | Justify "Always" location, ATT-style strings |
| 5.1.7 | Health & medical | Disclaimers, no diagnostic claims without FDA |
| 5.2.x | Intellectual property | Trademark/IP holder permission required |
| 5.3.x | Gaming, gambling, lotteries | License requirements |
| 5.6.1 | Developer code of conduct | Spam, fake reviews, manipulation |

## Common Rejection → Fix Playbook

### Guideline 2.1 — Crashes / incomplete functionality

**Fix:**
1. Read the device + iOS version Apple tested on
2. Reproduce on that exact config (or closest available)
3. Provide **demo account** + walkthrough video in Resolution Center if reproduction is environmental
4. If crash: ship fixed binary, note exact line in response

### Guideline 2.3.10 — Inaccurate metadata / screenshots

**Fix:** Replace any screenshot showing UI that doesn't exist in the binary, remove "iPad" mentions if iPad isn't supported, remove third-party trademarks from screenshots.

### Guideline 3.1.1 — IAP required

**Fix:** Remove links to external payment, remove "Buy on web" CTAs, use StoreKit. (Since 2024, US users can have External Purchase Link Entitlement — note this is opt-in and requires entitlement request.)

### Guideline 4.3 — Design spam (duplicate)

**Fix:** Hardest rejection to recover from. Steps:
1. Identify which app(s) yours is being compared to
2. Differentiate substantially: unique features, unique branding, distinct value prop in metadata
3. If it's your own portfolio: consolidate or kill old apps
4. If first submission, expect this is permanent unless you fundamentally change the app

### Guideline 5.1.1 — Privacy

**Fix:**
1. Privacy policy URL must be live, accessible, app-specific
2. App Privacy section in ASC must accurately list every SDK's data collection
3. ATT prompt string must be specific (not generic "improve the app")
4. NSUsageDescription strings must explain WHY, not just what

### Guideline 5.1.5 — Location

**Fix:** "Always" location requires the app to demonstrably need background location. Most apps should request "When In Use" only. Update Info.plist + prompt copy.

## Google Play Rejection Taxonomy

| Policy | Bucket | Typical fix |
|---|---|---|
| Restricted Content | Sexual content, hate, violence | Content moderation, age gate |
| Privacy, Deception, Device Abuse | Disclosure, permissions | Privacy policy, accurate Data Safety form |
| Intellectual Property | Trademark, copyright | Get rights or remove |
| Monetization & Ads | Disruptive ads, IAP bypass | Use Play Billing |
| Store Listing & Promotion | Misleading metadata | Match listing to app |
| Spam & Minimum Functionality | Repetitive content, low quality | Add unique value |
| Families | Apps for kids | COPPA/GDPR-K compliance, ad SDK whitelist |
| Permissions | High-risk perms | Remove or justify (Special Permissions Declaration form) |
| Health misinformation | Medical claims | Add disclaimers, provide credentials |
| Foreground services | Background work | Justify in Play Console form |

Play also has **automated suspensions** (no human review). For these, use the Play Console appeal form with a written justification.

## The Resolution Center Response Template

A good response gets re-reviewed in 24h. Use this exact structure:

```
Hello App Review Team,

Thank you for the feedback regarding guideline <X.Y.Z>.

UNDERSTANDING

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/eronred/aso-skills
git -C aso-skills checkout d508dfb48734

Works in

1. 2026-10-28
   ✓SAFE B 89 / 100

   first audit · source d508dfb48734

Questions about app-rejection-recovery

• github.com/eronred/aso-skills/tree/main/skills/app-rejection-rec — the audited source at commit d508dfb48734 and every finding aboveObserved · 28 Oct 2026

Spotted something wrong? Report a correction · Methodology