# Flutter Store Review Checker > Pre-submission audit for Flutter apps targeting Apple App Store and Google Play Store. Trigger this skill when the user mentions "submit to App Store", "ready to publish", "TestFlight", "App Store review", "app rejected", "Guideline 5.1.1", "Guideline 4.8", "privacy manifest", "PrivacyInfo.xcprivacy", "Data Safety", "Privacy Policy", or before any production release. Runs a checklist covering App Privacy labels, privacy manifests, third-party SDK signatures, login requirements (5.1.1 e-commerce browse-before-login), Apple Sign-In requirement when offering social auth (4.8), subscription terms transparency, screenshot requirements, age rating, and Play Store Data Safety form. Identifies blockers BEFORE the rejection email arrives. Use when this capability is needed. - Skill: `tomevault-io/flutter-store-review-checker` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/flutter-store-review-checker` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/flutter-store-review-checker/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/flutter-store-review-checker --- # Flutter App Store + Play Store Review Checker This skill runs as a pre-flight audit. Its job is to find rejection causes BEFORE submitting, not after. ## Run Order 1. Read `pubspec.yaml`, `ios/Runner/Info.plist`, `android/app/build.gradle`, `android/app/src/main/AndroidManifest.xml` 2. Run the Apple checklist (most strict) 3. Run the Android checklist 4. Output a single combined report with blockers, warnings, and "okay" items Do not just list rules abstractly. For each item, ACTUALLY check the project's files and report status: PASS, FAIL, NEEDS_REVIEW. ## Apple App Store Checklist (2026 Rules) ### Privacy #### App Privacy Labels (App Store Connect) - [ ] Privacy labels submitted in App Store Connect, NOT empty - [ ] Every SDK that collects data is reflected: Firebase Analytics, Crashlytics, RevenueCat, AdMob, Google Sign-In, Apple Sign-In, third-party tracking SDKs - [ ] "Data Linked to User" vs "Data Not Linked" answered correctly - [ ] "Used for Tracking" answered: if app uses IDFA via AdMob/Facebook SDK, this is YES - [ ] Privacy Policy URL set in App Information section Action item: open App Store Connect → App Privacy → Get Started, run through the wizard. #### PrivacyInfo.xcprivacy Manifest Since 2024, Apple REQUIRES a privacy manifest for any third-party SDK that accesses certain "required reason APIs". As of 2026, missing manifests cause automatic rejection. Check: - [ ] `ios/Runner/PrivacyInfo.xcprivacy` exists - [ ] Manifest declares which "required reason API" categories the app uses - [ ] Common ones: `NSPrivacyAccessedAPICategoryFileTimestamp` (file modification timestamps), `NSPrivacyAccessedAPICategoryUserDefaults`, `NSPrivacyAccessedAPICategorySystemBootTime`, `NSPrivacyAccessedAPICategoryDiskSpace` - [ ] For each, a valid `NSPrivacyAccessedAPITypeReasons` code is listed Third-party SDK signatures: - [ ] All "privacy-impacting SDKs" in pubspec are versioned to releases that include their own PrivacyInfo.xcprivacy and signature - [ ] Common ones to verify on pub.dev: Firebase SDKs (firebase_core, firebase_auth, etc.), Google Mobile Ads, Facebook SDK, Crashlytics If user is unsure, point them to https://developer.apple.com/documentation/bundleresources/privacy_manifest_files #### Tracking (ATT) If the app uses any tracking SDK (AdMob, Meta, AppsFlyer, Adjust): - [ ] `NSUserTrackingUsageDescription` in Info.plist with clear explanation - [ ] `AppTrackingTransparency` permission requested before any tracking SDK initializes - [ ] App still functions if user declines ATT - [ ] App Privacy label "Used for Tracking" = YES for the relevant data types If no tracking: - [ ] No tracking SDKs in pubspec - [ ] No `NSUserTrackingUsageDescription` (Apple flags unused permissions) ### Login and Account #### Guideline 5.1.1 (most common rejection) "Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law." Check the app's login flow: - [ ] Can the user BROWSE main content without signing in? (e-commerce, content discovery, social feeds must allow guest browsing) - [ ] Is login required ONLY for account-specific features (purchases, saved items, social posting)? - [ ] If login is gated at app open, is the app's purpose account-based (banking, fitness tracking, productivity)? If a marketplace, content app, or browser-style app forces login before showing anything, REJECTION IS LIKELY. #### Guideline 4.8 (Sign in with Apple) If the app offers Google Sign-In, Facebook Login, or any third-party sign-in: - [ ] Sign in with Apple is ALSO offered with equal prominence - [ ] Apple Sign-In button is shown at the same level as other sign-in options (not hidden in "more options") If only email/password auth: 4.8 does not apply, skip this check. If `google_sign_in` is in pubspec but `sign_in_with_apple` is not, this is a BLOCKER. #### Guideline 5.1.1(v) Account Deletion - [ ] In-app account deletion is implemented (not just "email us") - [ ] Deletion is reachable from account settings within 3 taps - [ ] Deletion immediately deletes data OR provides a clear timeline Missing account deletion is a common rejection since 2022. ### Subscriptions and IAP #### Subscription Transparency (App Review 3.1.2) On the paywall, BEFORE the user can tap purchase: - [ ] Price is visible - [ ] Billing period is visible (monthly, annual, etc.) - [ ] "Auto-renewing subscription" wording is present - [ ] Link to Terms of Use is visible - [ ] Link to Privacy Policy is visible - [ ] Free trial length (if any) is visible - [ ] What's included in the subscription is clearly listed #### Restore Purchases - [ ] "Restore Purchases" button on paywall - [ ] "Restore Purchases" option in account settings #### Real Products - [ ] Products are configured in App Store Connect (not just RevenueCat) - [ ] Products have screenshots/review notes uploaded - [ ] At least one subscription is marked as the primary subscription ### App Content #### Age Rating - [ ] Age rating questionnaire completed in App Store Connect - [ ] If user-generated content exists, content moderation mechanism is documented - [ ] If user-to-user contact exists, blocking/reporting is implemented #### Screenshots - [ ] Screenshots match the latest version of the app (Apple rejects stale screenshots) - [ ] Screenshots show actual app UI, not marketing mockups - [ ] All required device sizes covered: 6.7" iPhone, 6.1" iPhone (optional but recommended), iPad 13" if app supports iPad #### App Icon - [ ] No transparency in the icon (Apple flattens with black background, breaks designs) - [ ] Icon does not include "App Store", "Apple", or other Apple branding - [ ] Icon is the same in App Store Connect and inside the app ### Technical #### Build - [ ] Built with current Xcode version (Apple deprecates old Xcode periodically) - [ ] Bitcode disabled (deprecated by Apple in 2022) - [ ] Minimum iOS version reasonable (iOS 13+ usually fine, iOS 15+ better for modern SDKs) #### Crash Reports - [ ] No crash on first launch in any region/locale - [ ] Crashlytics or similar configured - [ ] No print statements or debug logs in release builds ## Google Play Store Checklist ### Data Safety Form - [ ] Form completed in Play Console → App content → Data safety - [ ] Every data type the app collects is listed: device ID, IP, crash logs, purchase history, etc. - [ ] Encryption in transit declared - [ ] User can request data deletion (in-app or via documented process) ### Account Deletion Same as Apple: in-app account deletion required since 2024. ### Target SDK Level - [ ] `compileSdk` is set to the latest Android version (Android 14+ for 2026) - [ ] `targetSdk` matches Play Store's minimum requirement (check Play Console, typically Android 13+ in 2026) ### Permissions - [ ] Every permission in AndroidManifest.xml has a clear use case - [ ] Sensitive permissions (READ_CONTACTS, ACCESS_FINE_LOCATION, etc.) prompt at runtime, not at install - [ ] Background location use case is documented in Play Console if used ### Subscriptions Same general rules as Apple: - [ ] Restore Purchases button - [ ] Subscription terms visible on paywall - [ ] Cancellation instructions documented in the app ### Screenshots and Listing - [ ] At least 2 screenshots uploaded - [ ] Feature graphic 1024x500 uploaded - [ ] Short description and full description filled in ## Cross-Cutting ### Privacy Policy A hosted Privacy Policy URL is required by BOTH stores. The policy must: - [ ] Be reachable (not behind login, not 404) - [ ] List every data type collected and why - [ ] List every third-party SDK that processes data - [ ] Provide a contact for data requests - [ ] Mention GDPR rights if the app is available in EU - [ ] Mention CCPA rights if available in California If the user has no Privacy Policy yet, that is a BLOCKER. Tools like https://app-privacy-policy-generator.firebaseapp.com or a custom one can fix this in 15 minutes. ### Localized App Store Metadata - [ ] App name, subtitle, description, keywords translated for each locale the app supports - [ ] Screenshots localized (Turkish app should have Turkish screenshots, not English ones) ## Output Format When this skill runs, produce a structured report: ``` APPLE APP STORE — Status: BLOCKERS (must fix before submission): - [item] [why] WARNINGS (likely to delay review): - [item] [why] PASS: - [count] checks passed GOOGLE PLAY STORE — Status: BLOCKERS: ... WARNINGS: ... PASS: - [count] checks passed ``` Do not output the full checklist as-is, only the items that need attention plus a count summary. ## Volkan-Specific Context Volkan went through HST iOS submission recently and dealt with: - TestFlight issues likely rooted in incomplete banking setup - W-8BEN tax form - ATT tracking declaration - RevenueCat configured for auto-renewable + one-time purchases in multiple currencies When auditing HST, double-check that banking and tax forms are complete in App Store Connect → Agreements, Tax, and Banking. Missing tax info blocks paid app distribution even if the app passes review. --- > Source: [axisting/axistia-flutter-skills](https://github.com/axisting/axistia-flutter-skills) — distributed by [TomeVault](https://tomevault.io).