iOS App Store Submission Checklist (2026)

What do you need to enroll in the Apple Developer Program?

You need an Apple Account with two-factor authentication, a verified legal identity, and the annual fee. Organizations also need a D-U-N-S number, and enrollment can take longer than people expect, so start it before the app is finished.

Per Apple's enrollment page, individuals must use their legal name (no aliases or company names) and verify email, phone, and address. Organizations need a legal entity name (no DBAs or trade names), a work email on the organization's domain, a functioning website matching that domain, and a D-U-N-S number unless they are a government entity. The fee is $99 USD per membership year, varying by region. Nonprofits, accredited educational institutions, and government entities may qualify for a waiver.

One decision to make now: whose legal entity owns the account. The Account Holder controls the app, its listing, and its privacy answers. If an agency enrolls on your behalf and the app lives under the agency's account, moving it later is avoidable work. Enroll under the business that owns the app and add your developers as team members.

What does the build need before you upload it?

Build with Xcode 26 or later against the iOS 26 SDK, sign it with your team's distribution certificate and an App Store provisioning profile, and upload through Xcode. The toolchain date is a hard gate, not a recommendation.

Apple's upcoming requirements page states that since April 28, 2026, apps uploaded to App Store Connect must be built with Xcode 26 or later using an SDK for iOS 26 or the matching OS 26 release for other platforms. It also states that since September 9, 2026, iOS and iPadOS apps must target iOS 13 or later.

• ✓Unique bundle identifier registered to your team, matching the App Store Connect record exactly.
• ✓Distribution certificate and App Store provisioning profile (automatic signing in Xcode handles both for most teams).
• ✓Capabilities enabled on the App ID for what you use: push notifications, Sign in with Apple, in-app purchase.
• ✓Purpose strings written in plain language for every permission prompt (camera, location, contacts).
• ✓Version and build numbers incremented, archive validated, then uploaded to App Store Connect.

Signing steps are standard Xcode practice. We did not extract them from a fetched Apple page for this guide, so check Xcode's own prompts as the source of truth for your project.

What goes in the App Store Connect record?

Everything a reviewer or customer will touch must be real and working: a support URL, a privacy policy URL, accurate descriptions, and a demo account if your app has a login. Guideline 2.1 says submissions should be final versions with all necessary metadata and fully functional URLs, with placeholder text and empty websites scrubbed.

Guideline 1.5 asks for an easy way for people to contact you through the app and its Support URL. Apple's App Review page lists incomplete App Review Information, including missing demo accounts, among the common reasons for trouble. If a reviewer cannot get past your sign-in screen, the app cannot be reviewed, and you lose days.

Apple's upcoming requirements page also says developers were asked to answer updated age rating questions by January 31, 2026 to avoid interruption when submitting app updates. Answer them honestly in the record. Also decide pricing and availability now, and if you sell digital features, Guideline 3.1.1 requires in-app purchase for subscriptions, premium content, and similar.

What are privacy nutrition labels and the privacy manifest?

They are two separate requirements. The nutrition label is your App Privacy answers in App Store Connect. The privacy manifest is a file in your app (and in listed third-party SDKs) that declares data practices and approved reasons for certain APIs. You need both to be accurate.

Per Apple's App Privacy documentation, the Account Holder, Admin, or App Manager answers whether you or your third-party partners collect data. For each data type you pick, you say whether it is linked to the user, whether it is used for tracking, and why you collect it. Your answers must include the practices of third-party code you integrate, and you must keep them current when practices change. Analytics, crash reporting, ad, and login SDKs are the usual sources of surprise.

For the manifest, Apple's privacy update announcement says that starting May 1, 2024 you must include approved reasons for the listed APIs your code uses in order to upload a new or updated app, and if you are not using an API for an allowed reason, find an alternative. Apple's third-party SDK requirements say you must include a privacy manifest for listed commonly used SDKs when you submit a new app that includes them or an update that adds one, and that signatures are required where listed SDKs are used as binary dependencies. Practical step: list every SDK in your project, compare it with Apple's list, and make sure your label answers match what those SDKs actually do.

The label is also a legal statement. Guideline 5.1.1(i) requires a privacy policy that identifies what data the app collects, how, and all uses, and Guideline 5.1.2 requires permission before you use or share personal data, including explicit permission through the App Tracking Transparency APIs before tracking.

Do you need in-app account deletion and Sign in with Apple?

If your app supports account creation, you must offer account deletion inside the app (5.1.1(v)). If it offers a third-party or social login, you must also offer an equivalent login option that meets Apple's privacy terms (4.8), and Sign in with Apple is the usual answer.

Apple's account deletion guidance says deletion must remove the account record and associated personal data, and that offering only temporary deactivation is insufficient. Put the option in account settings. If deletion happens on a website, link directly to that page. You may require reauthentication or a confirmation step, and you should tell people how long deletion takes, how subscription billing is handled, and what you must retain by law. Apple notes that standard apps should not make people call or email support to finish deletion.

For login, the App Review Guidelines (4.8) require the equivalent option to limit data collection to name and email, let users keep their email private, and avoid collecting app interactions for advertising without consent. Adding Sign in with Apple after a rejection costs more than building it in from the start, since it touches your auth backend, your account-linking logic, and your deletion flow. Read the full 4.8 text for exceptions; we are summarizing only the core rule.

What screenshots and metadata does App Store Connect require?

One to 10 screenshots per device size, in .jpeg, .jpg, or .png, with no alpha channel. For iPhone, Apple requires at least one screenshot for the iPhone with Dynamic Island (medium display) size, and for iPad, the 13-inch display size if your app supports iPadOS.

Per Apple's screenshot specifications, the required iPhone size is 1179 by 2556 pixels portrait (2556 by 1179 landscape), and the required iPad 13-inch size is 2064 by 2752 pixels portrait (2752 by 2064 landscape). If your UI is consistent across device sizes, you only need the highest required resolution, and App Store Connect scales for smaller devices.

Guideline 2.3 says your metadata, including privacy information, description, screenshots, and previews, must accurately reflect the app's core experience and be updated with new versions. Screenshot the real app, not a marketing mockup of features that do not exist yet. Inaccurate screenshots are on Apple's own list of common issues.

How do TestFlight and export compliance fit in?

Run TestFlight first. Internal testing needs no review, external testing sends your first build to Beta App Review, and every build that uses encryption needs export compliance answers.

Per Apple's TestFlight overview, you can invite up to 100 internal testers (App Store Connect users) and up to 10,000 external testers. Builds are available for 90 days. When you add the first build to an external group, it goes to App Review; Apple says a review is required only for the first build, and later builds may not need a full review.

Apple's export compliance overview says documentation is needed if the app uses, accesses, contains, implements, or incorporates encryption. You answer encryption questions when submitting a version, and you can set the ITSAppUsesNonExemptEncryption key in Info.plist to declare your answer up front. Apple also states you are responsible for reviewing the Export Administration Regulations and deciding whether a formal classification is needed. Even HTTPS-only apps should read this page and answer deliberately rather than clicking through.

What gets apps rejected most often?

Apple's own page says over 40% of unresolved issues relate to Guideline 2.1, App Completeness. The fixes are boring: no crashes, no broken links, no placeholder content, and a working demo account.

The App Review page also lists privacy policy problems, unclear purpose strings for data access requests, inaccurate screenshots, a substandard interface, apps that are web clippings or content aggregators, copycats, misleading users, and not enough lasting value. Those map to Guidelines 5.1.1, 2.3, 4.0, and 4.2.

For scale, Apple's May 27, 2025 newsroom report says App Review handled over 7.7 million submissions in 2024 and more than 1.9 million were rejected for failing to meet standards, including 400,000 rejected for privacy violations and over 43,000 for hidden or undocumented features. Those figures imply roughly one in four submissions were rejected (our arithmetic, not Apple's statement). Apple states typical review timing as 50% of submissions in under 24 hours and 90% in under 48 hours.

What can this checklist not guarantee?

Approval. Guidelines are interpreted by people, rules change, and some categories (health, finance, kids, user-generated content, gambling) carry extra requirements we do not cover here.

FAQ

Keep reading: mobile app development in 2026, how much a mobile app costs, React Native vs Flutter vs native, and web app development.