# Expo App Store Guideline Check

> Pre-submission checklist for iOS App Store and Google Play Store. Use this skill whenever the user mentions: app store submission, app store rejection, pre-submission checklist, app review, store guidelines, privacy manifest, data safety section, app permissions, usage descriptions, privacy policy, LGPD, GDPR, data protection, mobile app security check, or any mention of preparing an app for publication in iOS or Android stores. Also trigger when the user asks about app permissions, data collection, or privacy requirements for mobile apps.

- Skill: `nandofalcao/expo-app-store-guideline-check` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add nandofalcao/expo-app-store-guideline-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nandofalcao/expo-app-store-guideline-check/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nandofalcao (https://skillmd.com/u/nandofalcao)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nandofalcao/expo-app-store-guideline-check

---


# Expo App Store Guideline Check

Skill to verify compliance of React Native/Expo apps with Apple App Store,
Google Play Store, LGPD, GDPR, and privacy/security best practices guidelines.

---

## What This Skill Does

1. **Analyzes the project automatically** via bash scripts
2. **Classifies issues** as: CRITICAL / WARNING / INFO / OK
3. **Generates actionable report** with suggested fixes for each issue
4. **Covers four domains:** Apple App Store, Google Play, Privacy/Data Protection (LGPD + GDPR), Security

---

## Execution Flow

### Automated Analysis (recommended)

```bash
# At the root of the React Native/Expo project:
bash /path/to/skill/scripts/scan-project.sh .

# The report will be generated at:
# ./.compliance-report/report_YYYYMMDD_HHMMSS.md
```

### Analysis by Domain (when needed to check only one area)

```bash
# Expo configuration only
bash scripts/check-expo-config.sh /project/path

# Permissions only
bash scripts/check-permissions.sh /project/path

# iOS Privacy Manifest only
bash scripts/check-privacy-manifest.sh /project/path

# Google Data Safety only
bash scripts/check-data-safety.sh /project/path

# Security only
bash scripts/check-security.sh /project/path

# Dependencies only
bash scripts/check-dependencies.sh /project/path
```

---

## When to Use Each Resource

| Situation | Resource |
|----------|----------|
| Preparing app for submission | `scripts/scan-project.sh` + relevant checklists |
| Apple rejection | `references/apple-app-store.md` + `references/common-rejections.md` |
| Google Play rejection | `references/google-play-store.md` + `references/common-rejections.md` |
| Configure iOS Privacy Manifest | `references/react-native-expo.md` + `scripts/check-privacy-manifest.sh` |
| Fill Google Data Safety | `templates/data-safety-form.md` + `scripts/check-data-safety.sh` |
| Fill Apple Privacy Labels | `templates/app-privacy-labels.md` |
| Create Privacy Policy (LGPD) | `templates/privacy-policy-en.md` (EN) or `templates/privacy-policy-pt-br.md` (PT-BR) |
| Create Privacy Policy (GDPR) | `templates/privacy-policy-gdpr-en.md` |
| Create Terms of Use | `templates/terms-of-use-en.md` (EN) or `templates/terms-of-use-pt-br.md` (PT-BR) |
| Verify LGPD compliance | `references/lgpd-privacy.md` + `checklists/privacy-compliance.md` |
| Verify GDPR compliance | `references/gdpr-privacy.md` + `checklists/privacy-compliance.md` |
| Compare LGPD vs GDPR | `references/lgpd-vs-gdpr.md` |
| Complete iOS checklist | `checklists/pre-submission-ios.md` |
| Complete Android checklist | `checklists/pre-submission-android.md` |
| Verify data security | `checklists/security-checklist.md` + `scripts/check-security.sh` |

---

## Results Structure

Each verification produces results with the following structure:

```json
{
  "id": "EXPO-001",
  "severity": "CRITICAL",
  "category": "apple",
  "title": "Short description of the problem",
  "description": "Detailed explanation",
  "fix": "How to fix",
  "reference": "URL or reference doc",
  "file": "relevant file"
}
```

### Severity Levels

| Level | Symbol | Required Action |
|-------|--------|-----------------|
| CRITICAL | 🔴 | Fix before submitting — will cause rejection |
| WARNING | ⚠️ | Review — may cause rejection or future problem |
| INFO | ℹ️ | Consider — best practice but not mandatory |
| OK | ✅ | Compliance verified |

---

## Verification Domains

### Apple App Store
- **Basic configuration:** bundle identifier, version, build number
- **iOS Permissions:** NS*UsageDescription strings
- **Privacy Manifest:** PrivacyInfo.xcprivacy / expo.ios.privacyManifests
- **App Tracking Transparency:** implementation for tracking
- **Account Deletion:** mandatory if account creation exists
- **IAP/Subscriptions:** restore purchases, visible prices

References: `references/apple-app-store.md`

### Google Play Store
- **Basic configuration:** package name, versionCode
- **Target API Level:** Android 15 (API 35) for new apps 2025+
- **Data Safety Section:** preparation and filling
- **Android Permissions:** `<uses-permission>` justified
- **Content Rating:** questionnaire filled

References: `references/google-play-store.md`

### Privacy / Data Protection

#### LGPD (Brazil — Law 13.709/2018)
- **Privacy Policy:** presence, accessibility, language (Portuguese for Brazilian users)
- **Consent:** explicit mechanism before collecting data (Art. 8º)
- **Data subject rights:** access and deletion within 15 days (Art. 18)
- **DPO:** data protection officer — mandatory for all controllers (Art. 41)
- **Sharing:** list of third parties receiving data

References: `references/lgpd-privacy.md`

#### GDPR (EU/EEA — Regulation 2016/679)
- **Privacy Policy:** mandatory Art. 13/14 elements, language of target member state
- **Consent:** freely given, specific, demonstrable, withdrawable (Art. 7)
- **Data subject rights:** access, erasure within 30 days, restriction, objection (Art. 15–22)
- **DPO:** conditional — required for large-scale, public authorities, special categories (Art. 37)
- **DPIA:** mandatory for high-risk processing (Art. 35)
- **DPA:** written agreement mandatory with all processors (Art. 28)
- **Breach notification:** 72 hours to supervisory authority (Art. 33)

References: `references/gdpr-privacy.md` | Dual-market: `references/lgpd-vs-gdpr.md`

### Data Security
- **Storage:** no sensitive data in AsyncStorage
- **Communication:** HTTPS mandatory, SSL pinning recommended
- **Secrets:** no hardcoded API keys or committed .env files
- **Logs:** no sensitive data in console.log

References: `checklists/security-checklist.md`

---

## Project Configuration

The skill automatically detects:

| Indicator | Project Type |
|-----------|--------------|
| `app.json` with `"expo"` key | Expo Managed Workflow |
| `app.json` + `ios/` or `android/` folder | Expo Bare Workflow |
| `package.json` with `react-native` without `expo` | Pure React Native |

---

## Interpreting the Report

The generated report (`compliance-report.md`) is divided into sections:

1. **Executive Summary** — count by severity
2. **Apple App Store** — iOS-specific issues
3. **Google Play Store** — Android-specific issues
4. **Privacy / Data Protection** — LGPD (Brazil) and/or GDPR (EU/EEA)
5. **Security** — data vulnerabilities
6. **Dependencies** — risks in third-party packages
7. **Next Steps** — recommended action order

### Fix Prioritization

```
1. Fix all 🔴 CRITICAL
2. Review all ⚠️ WARNING (decide if applies to context)
3. Consider ℹ️ INFO for better compliance
4. ✅ OK needs no action
```

---

## Important Limitations

- Scripts analyze configuration and static code — they do not test runtime
- Security verification identifies common patterns, not a pentest
- LGPD and GDPR analysis covers technical requirements; legal aspects require a lawyer
- Store guidelines change — check update dates in reference files
- Does not replace manual review of checklists before submitting

---

## Updating the Skill

Reference files have update dates in the header. When guidelines change,
update files in `references/` and corresponding checks in scripts. Keep
`version` and `updated` in this SKILL.md current.

---

## Additional Resources

- `references/` — condensed guidelines by platform
- `checklists/` — interactive pre-submission checklists
- `templates/` — legal document templates and forms
- `scripts/` — bash automation for project analysis
- `evals/evals.json` — test cases to validate the skill