tomevault-io Flutter App Store + Play Store Review Checker
This skill runs as a pre-flight audit. Its job is to find rejection causes BEFORE submitting, not after.
Run Order
- Read
pubspec.yaml,ios/Runner/Info.plist,android/app/build.gradle,android/app/src/main/AndroidManifest.xml - Run the Apple checklist (most strict)
- Run the Android checklist
- Output a single combined report with blockers, warnings, and "okay" items
Do not just list rules abstractly. For each item, ACTUALLY check the project's files and report status: PASS, FAIL, NEEDS_REVIEW.
Apple App Store Checklist (2026 Rules)
Privacy
App Privacy Labels (App Store Connect)
- Privacy labels submitted in App Store Connect, NOT empty
- Every SDK that collects data is reflected: Firebase Analytics, Crashlytics, RevenueCat, AdMob, Google Sign-In, Apple Sign-In, third-party tracking SDKs
- "Data Linked to User" vs "Data Not Linked" answered correctly
- "Used for Tracking" answered: if app uses IDFA via AdMob/Facebook SDK, this is YES
- Privacy Policy URL set in App Information section
Action item: open App Store Connect → App Privacy → Get Started, run through the wizard.
PrivacyInfo.xcprivacy Manifest
Since 2024, Apple REQUIRES a privacy manifest for any third-party SDK that accesses certain "required reason APIs". As of 2026, missing manifests cause automatic rejection.
Check:
-
ios/Runner/PrivacyInfo.xcprivacyexists - Manifest declares which "required reason API" categories the app uses
- Common ones:
NSPrivacyAccessedAPICategoryFileTimestamp(file modification timestamps),NSPrivacyAccessedAPICategoryUserDefaults,NSPrivacyAccessedAPICategorySystemBootTime,NSPrivacyAccessedAPICategoryDiskSpace - For each, a valid
NSPrivacyAccessedAPITypeReasonscode is listed
Third-party SDK signatures:
- All "privacy-impacting SDKs" in pubspec are versioned to releases that include their own PrivacyInfo.xcprivacy and signature
- Common ones to verify on pub.dev: Firebase SDKs (firebase_core, firebase_auth, etc.), Google Mobile Ads, Facebook SDK, Crashlytics
If user is unsure, point them to https://developer.apple.com/documentation/bundleresources/privacy_manifest_files
Tracking (ATT)
If the app uses any tracking SDK (AdMob, Meta, AppsFlyer, Adjust):
-
NSUserTrackingUsageDescriptionin Info.plist with clear explanation -
AppTrackingTransparencypermission requested before any tracking SDK initializes - App still functions if user declines ATT
- App Privacy label "Used for Tracking" = YES for the relevant data types
If no tracking:
- No tracking SDKs in pubspec
- No
NSUserTrackingUsageDescription(Apple flags unused permissions)
Login and Account
Guideline 5.1.1 (most common rejection)
"Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law."
Check the app's login flow:
- Can the user BROWSE main content without signing in? (e-commerce, content discovery, social feeds must allow guest browsing)
- Is login required ONLY for account-specific features (purchases, saved items, social posting)?
- If login is gated at app open, is the app's purpose account-based (banking, fitness tracking, productivity)?
If a marketplace, content app, or browser-style app forces login before showing anything, REJECTION IS LIKELY.
Guideline 4.8 (Sign in with Apple)
If the app offers Google Sign-In, Facebook Login, or any third-party sign-in:
- Sign in with Apple is ALSO offered with equal prominence
- Apple Sign-In button is shown at the same level as other sign-in options (not hidden in "more options")
If only email/password auth: 4.8 does not apply, skip this check.
If google_sign_in is in pubspec but sign_in_with_apple is not, this is a BLOCKER.
Guideline 5.1.1(v) Account Deletion
- In-app account deletion is implemented (not just "email us")
- Deletion is reachable from account settings within 3 taps
- Deletion immediately deletes data OR provides a clear timeline
Missing account deletion is a common rejection since 2022.
Subscriptions and IAP
Subscription Transparency (App Review 3.1.2)
On the paywall, BEFORE the user can tap purchase:
- Price is visible
- Billing period is visible (monthly, annual, etc.)
- "Auto-renewing subscription" wording is present
- Link to Terms of Use is visible
- Link to Privacy Policy is visible
- Free trial length (if any) is visible
- What's included in the subscription is clearly listed
Restore Purchases
- "Restore Purchases" button on paywall
- "Restore Purchases" option in account settings
Real Products
- Products are configured in App Store Connect (not just RevenueCat)
- Products have screenshots/review notes uploaded
- At least one subscription is marked as the primary subscription
App Content
Age Rating
- Age rating questionnaire completed in App Store Connect
- If user-generated content exists, content moderation mechanism is documented
- If user-to-user contact exists, blocking/reporting is implemented
Screenshots
- Screenshots match the latest version of the app (Apple rejects stale screenshots)
- Screenshots show actual app UI, not marketing mockups
- All required device sizes covered: 6.7" iPhone, 6.1" iPhone (optional but recommended), iPad 13" if app supports iPad
App Icon
- No transparency in the icon (Apple flattens with black background, breaks designs)
- Icon does not include "App Store", "Apple", or other Apple branding
- Icon is the same in App Store Connect and inside the app
Technical
Build
- Built with current Xcode version (Apple deprecates old Xcode periodically)
- Bitcode disabled (deprecated by Apple in 2022)
- Minimum iOS version reasonable (iOS 13+ usually fine, iOS 15+ better for modern SDKs)
Crash Reports
- No crash on first launch in any region/locale
- Crashlytics or similar configured
- No print statements or debug logs in release builds
Google Play Store Checklist
Data Safety Form
- Form completed in Play Console → App content → Data safety
- Every data type the app collects is listed: device ID, IP, crash logs, purchase history, etc.
- Encryption in transit declared
- User can request data deletion (in-app or via documented process)
Account Deletion
Same as Apple: in-app account deletion required since 2024.
Target SDK Level
-
compileSdkis set to the latest Android version (Android 14+ for 2026) -
targetSdkmatches Play Store's minimum requirement (check Play Console, typically Android 13+ in 2026)
Permissions
- Every permission in AndroidManifest.xml has a clear use case
- Sensitive permissions (READ_CONTACTS, ACCESS_FINE_LOCATION, etc.) prompt at runtime, not at install
- Background location use case is documented in Play Console if used
Subscriptions
Same general rules as Apple:
- Restore Purchases button
- Subscription terms visible on paywall
- Cancellation instructions documented in the app
Screenshots and Listing
- At least 2 screenshots uploaded
- Feature graphic 1024x500 uploaded
- Short description and full description filled in
Cross-Cutting
Privacy Policy
A hosted Privacy Policy URL is required by BOTH stores. The policy must:
- Be reachable (not behind login, not 404)
- List every data type collected and why
- List every third-party SDK that processes data
- Provide a contact for data requests
- Mention GDPR rights if the app is available in EU
- Mention CCPA rights if available in California
If the user has no Privacy Policy yet, that is a BLOCKER. Tools like https://app-privacy-policy-generator.firebaseapp.com or a custom one can fix this in 15 minutes.
Localized App Store Metadata
- App name, subtitle, description, keywords translated for each locale the app supports
- Screenshots localized (Turkish app should have Turkish screenshots, not English ones)
Output Format
When this skill runs, produce a structured report:
APPLE APP STORE — Status: <READY|BLOCKED|NEEDS_REVIEW>
BLOCKERS (must fix before submission):
- [item] [why]
WARNINGS (likely to delay review):
- [item] [why]
PASS:
- [count] checks passed
GOOGLE PLAY STORE — Status: <READY|BLOCKED|NEEDS_REVIEW>
BLOCKERS:
...
WARNINGS:
...
PASS:
- [count] checks passed
Do not output the full checklist as-is, only the items that need attention plus a count summary.
Volkan-Specific Context
Volkan went through HST iOS submission recently and dealt with:
- TestFlight issues likely rooted in incomplete banking setup
- W-8BEN tax form
- ATT tracking declaration
- RevenueCat configured for auto-renewable + one-time purchases in multiple currencies
When auditing HST, double-check that banking and tax forms are complete in App Store Connect → Agreements, Tax, and Banking. Missing tax info blocks paid app distribution even if the app passes review.
Source: axisting/axistia-flutter-skills — distributed by TomeVault.