Changelog
- 1.0.0, 21 October 2026: first release
kits / app-store-submission-kit
Checklists, size tables and privacy worksheets for App Store and Google Play submissions.
MIT License
Copyright (c) 2026 Snowkit
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.Version 1.0.0
Getting an app through review is mostly about preparation: the right assets at the right sizes, accurate privacy answers, a working demo account and metadata that matches the app. This kit puts all of that in one place for both the Apple App Store and Google Play.
apple-submission-checklist.md or google-play-submission-checklist.md. Skim it to see what you'll need.rejection-reasons.md. Most rejections come from a short list of avoidable problems.privacy-worksheet.md and data-inventory.csv early. They take longest because you need to check every SDK in your app.store-listing-templates.md, which shows every character limit.review-notes-template.md and work through release-checklist.md.| File | What it is |
|---|---|
apple-submission-checklist.md | Everything App Store Connect asks for, in order |
google-play-submission-checklist.md | Everything Play Console asks for, including closed testing for new personal accounts |
rejection-reasons.md | The most common rejection reasons on both stores and how to avoid them |
store-listing-templates.md | Fill-in listing copy with character limits for both stores |
asset-sizes.md | Screenshot, icon, feature graphic and preview video reference tables |
privacy-worksheet.md | A worksheet for Apple's privacy details and Google's Data safety form |
data-inventory.csv | A spreadsheet to list every data type and SDK, which feeds the privacy worksheet |
review-notes-template.md | Review notes with demo account, test steps and explanations reviewers need |
release-checklist.md | A repeatable checklist for every release after the first |
Store requirements change often: screenshot sizes, SDK versions, policy wording and form questions. Everything in this kit was checked against the official documentation in October 2026, and the places most likely to change are marked. Always confirm with the store's current pages before you submit. Following this kit lowers the chance of rejection, but approval is always the store's decision.
MIT License. See LICENSE.txt.
Work through this from top to bottom. Items follow roughly the order App Store Connect asks for them. Requirements change, so confirm anything marked (check current) on Apple's developer site before you submit, especially the Upcoming Requirements page and the App Review Guidelines.
App: ______________________ Version: ________ Build: ________ Target date: ____________
---
CFBundleShortVersionString) and build number (CFBundleVersion) are higher than any previous upload.Info.plist (for example NSCameraUsageDescription) that explains why, in plain language.PrivacyInfo.xcprivacy) included, declaring any required-reason APIs you use. Third-party SDKs on Apple's list include their own signed manifests.ITSAppUsesNonExemptEncryption to NO in Info.plist skips the question on each upload. If you use other encryption, check whether you need documentation.privacy-worksheet.md.asset-sizes.md.2026 Your Company Ltd.review-notes-template.md.rejection-reasons.md once more.Review times vary. Many apps are reviewed within a day or two, but plan for longer, especially around holidays and major iOS releases.
These tables reflect Apple's and Google's published specifications as of October 2026. Both stores add new device sizes and adjust rules regularly. Check the store's current requirements before you export your final assets:
---
| Asset | Size | Format | Notes |
|---|---|---|---|
| App Store icon | 1024 x 1024 px | PNG | No transparency, square corners (the system applies the mask), included in your app's asset catalogue |
Optional dark and tinted icon variants can be added in the asset catalogue.
You need screenshots for at least one large iPhone size. If your interface is the same across devices, provide the largest size and App Store Connect scales it down for smaller devices.
| Display | Portrait sizes (px) | Landscape sizes (px) | Required? |
|---|---|---|---|
| 6.9" | 1320 x 2868, 1290 x 2796, or 1260 x 2736 | 2868 x 1320, 2796 x 1290, or 2736 x 1260 | Provide this or 6.5" |
| 6.5" | 1284 x 2778 or 1242 x 2688 | 2778 x 1284 or 2688 x 1242 | Required if your app runs on iPhone and you don't provide 6.9" |
Smaller iPhone sizes are optional and are scaled from the next size up if you don't provide them. App Store Connect may also list a 6.1" set; check which sets it asks for when you open your version page.
| Display | Portrait sizes (px) | Landscape sizes (px) | Required? |
|---|---|---|---|
| 13" | 2064 x 2752 or 2048 x 2732 | 2752 x 2064 or 2732 x 2048 | Required if your app runs on iPad |
| Aspect ratio | Sizes (px) | Required? |
|---|---|---|
| 16:10 | 1280 x 800, 1440 x 900, 2560 x 1600, or 2880 x 1800 | Required for Mac apps |
| Rule | Value |
|---|---|
| Number per device size | 1 to 10 |
| Formats | .jpeg, .jpg, .png |
| Transparency | Not allowed. Flatten images and remove the alpha channel |
| Content | Must show the app. Marketing captions are fine, but the app's interface should be the focus |
| Rule | Value |
|---|---|
| Number per device size | Up to 3 |
| Length | 15 to 30 seconds |
| Content | Footage captured from the app itself |
App previews have their own resolution table per device. Check Apple's "App preview specifications" page for the exact sizes, frame rates and file limits before exporting.
---
| Asset | Size | Format | Notes |
|---|---|---|---|
| App icon | 512 x 512 px | 32-bit PNG (with alpha) | Up to 1,024 KB. Google applies the rounded mask, so design a full square without your own rounded corners or shadow. No badges or text suggesting ranking, price or Play categories |
| Feature graphic | 1024 x 500 px | JPEG or 24-bit PNG (no alpha) | Required. Shown at the top of your listing in some places. Keep important content away from the edges |
| Rule | Value |
|---|---|
| Number | At least 2 to publish (across device types), up to 8 per device type |
| Formats | JPEG or 24-bit PNG, no alpha |
| Dimensions | Each side between 320 px and 3,840 px |
| Aspect ratio | The long side can be at most twice the short side |
| Recommended for app promotion | At least 4 screenshots at 1080 px or more: 1080 x 1920 portrait (9:16) or 1920 x 1080 landscape (16:9) |
| Recommended for games | At least 3 landscape screenshots at 1920 x 1080, or portrait at 1080 x 1920 |
| Rule | Value |
|---|---|
| Number | At least 4 if you provide them for large screens |
| Dimensions | Between 1,080 px and 7,680 px |
| Aspect ratio | 16:9 landscape or 9:16 portrait |
| Tip | Avoid text that isn't part of the app, since it may be cropped on some screens |
Wear OS, Android TV, Android Automotive and Android XR have their own screenshot rules. Check the Play Console Help page if you support them.
| Rule | Value |
|---|---|
| Format | A YouTube link to a single video (not a playlist or channel) |
| Visibility | Public or unlisted |
| Ads | Monetisation must be off |
| Age restriction | Must not be age-restricted |
| Autoplay | Only the first 30 seconds autoplay, so put the best part first |
---
01-home.png, 02-search.png) so upload order is easy.Data type,Example,Collected by (your code or SDK name),Sent to,Purpose,Linked to user (Apple),Used for tracking (Apple),Shared with third party (Google),Ephemeral (Google),Required or optional (Google),Retention,Can user delete,Notes
Email address,Account sign-up,Your code,Your backend,"App functionality, account management",Yes,No,No,No,Required,Until account deletion,Yes,
Name,Profile,Your code,Your backend,App functionality,Yes,No,No,No,Optional,Until account deletion,Yes,
User ID,Account identifier,Your code,Your backend,"App functionality, analytics",Yes,No,No,No,Required,Until account deletion,Yes,
Crash logs,Crash reports,[Crash reporting SDK],[SDK provider],App functionality,No,No,No,No,Required,[per SDK docs],[per SDK docs],Check SDK data disclosure page
Diagnostics,Performance traces,[Crash reporting SDK],[SDK provider],Analytics,No,No,No,No,Required,[per SDK docs],[per SDK docs],
Device or other IDs,App instance ID,[Analytics SDK],[SDK provider],Analytics,Yes,No,No,No,Required,[per SDK docs],[per SDK docs],
App interactions,Screens viewed,[Analytics SDK],[SDK provider],Analytics,Yes,No,No,No,Required,[per SDK docs],[per SDK docs],
Purchase history,In-app purchases,[Payments SDK],[Store or SDK provider],App functionality,Yes,No,No,No,Required,[period],No,
Approximate location,City-level content,Your code,Your backend,Personalisation,No,No,No,Yes,Optional,Not stored,n/a,
Photos,User uploads,Your code,Your backend and storage,App functionality,Yes,No,No,No,Optional,Until user deletes,Yes,
Other in-app messages,Support chat,[Support SDK],[SDK provider],App functionality,Yes,No,No,No,Optional,[period],[per SDK docs],
,,,,,,,,,,,,
,,,,,,,,,,,,
,,,,,,,,,,,,Work through this from top to bottom. Items follow roughly the order Play Console asks for them. Google updates its requirements and policies regularly, so confirm anything marked (check current) in the Play Console Help Center and the Developer Program Policy before you submit.
App: ______________________ Version name: ________ Version code: ________ Target date: ____________
---
New personal developer accounts must run a closed test before they can publish to production.
Organisation accounts and older personal accounts may not have this requirement, but a closed or internal test is still a good idea.
.aab). Required for new apps.versionCode is higher than any previous upload.QUERY_ALL_PACKAGES) need a declaration form and a core-feature reason. Where a system picker can do the job, use it instead of a broad permission.Every item here must be completed before you can publish.
review-notes-template.md.privacy-worksheet.md. Required even if you collect no data.AD_ID permission.asset-sizes.md.rejection-reasons.md once more.Review times vary. New apps and new developer accounts can take several days or longer. Plan for at least a week on your first submission.
Apple's App Privacy details (often called the privacy nutrition label) and Google Play's Data safety form ask similar questions in different ways. This worksheet helps you answer both from one set of facts.
Answers must cover data collected by your code and every third-party SDK in the app: analytics, crash reporting, ads, login, payments, chat, maps and so on. Wrong answers can lead to rejection or removal, and they affect user trust.
The categories below follow each store's forms as of October 2026. Both forms are updated from time to time, so check the current questions in App Store Connect and Play Console as you fill them in.
---
Open data-inventory.csv in any spreadsheet app. The filled rows are examples: keep the ones that apply, correct them, delete the rest, and add one row for every type of data that leaves the device, whether it goes to your servers or to a third party. For each SDK, read its documentation for "data collection", "privacy" or "Data safety". Most large SDK providers publish a page listing exactly what they collect.
Things people often miss:
| Term | Apple | |
|---|---|---|
| Collected | Data sent off the device in a way that lets you or partners access it for longer than needed to handle the request in real time | Data sent off the device by your app |
| Shared | Covered through "used for tracking" and third-party use | Data transferred to a third party. Transfers to service providers processing data on your behalf usually don't count as sharing |
| Linked to the user | Data connected to the user's identity, account or device | Not asked in the same way |
| Tracking | Linking your data with other companies' data for targeted ads or ad measurement, or sharing it with data brokers | Not a separate question |
| Ephemeral | Not a separate question | Data processed only in memory and kept only as long as needed for the request |
| Optional | Not a separate question | Whether users can choose not to provide it |
Read each store's full definitions before you answer. These summaries are a guide only.
For each data type you collect, answer: what it's used for, whether it's linked to the user's identity, and whether it's used for tracking.
| Category | Data types | Collected? | Linked? | Tracking? | Purposes |
|---|---|---|---|---|---|
| Contact info | Name, email address, phone number, physical address, other contact info | ||||
| Health and fitness | Health, fitness | ||||
| Financial info | Payment info, credit info, other financial info | ||||
| Location | Precise location, coarse location | ||||
| Sensitive info | Racial or ethnic data, sexual orientation, pregnancy, disability, religious or philosophical beliefs, union membership, political opinion, genetic or biometric data | ||||
| Contacts | Contacts | ||||
| User content | Emails or text messages, photos or videos, audio data, gameplay content, customer support, other user content | ||||
| Browsing history | Browsing history | ||||
| Search history | Search history | ||||
| Identifiers | User ID, device ID | ||||
| Purchases | Purchase history | ||||
| Usage data | Product interaction, advertising data, other usage data | ||||
| Diagnostics | Crash data, performance data, other diagnostic data | ||||
| Other data | Any other data types |
Google asks whether you collect or share each data type, then for each one: is it collected, shared or both; is it processed ephemerally; is it required or optional; and what purposes it's used for.
| Category | Data types | Collected? | Shared? | Ephemeral? | Required or optional? | Purposes |
|---|---|---|---|---|---|---|
| Location | Approximate, precise | |||||
| Personal info | Name, email address, user IDs, address, phone number, race and ethnicity, political or religious beliefs, sexual orientation, other info | |||||
| Financial info | User payment info, purchase history, credit score, other financial info | |||||
| Health and fitness | Health info, fitness info | |||||
| Messages | Emails, SMS or MMS, other in-app messages | |||||
| Photos and videos | Photos, videos | |||||
| Audio files | Voice or sound recordings, music files, other audio files | |||||
| Files and docs | Files and docs | |||||
| Calendar | Calendar events | |||||
| Contacts | Contacts | |||||
| App activity | App interactions, in-app search history, installed apps, other user-generated content, other actions | |||||
| Web browsing | Web browsing history | |||||
| App info and performance | Crash logs, diagnostics, other app performance data | |||||
| Device or other IDs | Device or other IDs |
data-inventory.csv appears in both forms.Completed by: ______________ Date: ____________ App version: ________
Most rejections aren't about clever policy edge cases. They come from a short list of avoidable problems: a crash, a missing login, privacy answers that don't match the app, or metadata that promises something the app doesn't do.
This guide summarises the most common ones in plain language. Section numbers refer to Apple's App Review Guidelines and the policy areas in Google Play's Developer Program Policy. Both documents change, so read the current versions for anything you're unsure about.
---
Apple: 2.1 App Completeness. Google: broken functionality and minimum functionality.
Reviewers test on real devices, often on the newest OS version, sometimes on iPad even if you designed for iPhone, and often on a fresh install with no data.
Avoid it:
Apple: 2.1 (information needed). Google: App access.
If any part of the app needs an account, reviewers need one too. This is one of the most common reasons for a delay or rejection.
Avoid it:
Use review-notes-template.md.
Apple: 5.1.1 Data Collection and Storage, 5.1.2 Data Use and Sharing. Google: User Data policy, Data safety.
Both stores compare your privacy declarations with what the app and its SDKs actually do. Analytics, crash reporting, ads and login SDKs often collect data you didn't think about.
Avoid it:
data-inventory.csv and read each one's data disclosure documentation.Apple: 5.1.1(v). Google: account deletion requirement.
If users can create an account in your app, they must be able to delete it from inside the app. Google also requires a web page where users can request deletion without the app. Deactivating or hiding an account doesn't count.
Avoid it: Put "Delete account" somewhere easy to find, usually Settings > Account, and explain what gets deleted and what you keep for legal reasons.
Apple: 2.3 Accurate Metadata. Google: Metadata policy, Store listing and promotion.
Avoid it:
Apple: 4.2 Minimum Functionality. Google: minimum functionality and spam policies.
An app that only shows a website, or does very little, is often rejected.
Avoid it:
Apple: 4.3 Spam. Google: Spam and Impersonation policies.
Many near-identical apps from the same or different developers get rejected. Apps built from templates or generators that look like hundreds of others are at risk.
Avoid it: Make one strong app rather than many variations. Customise design and features meaningfully. Don't imitate another app's name, icon or look.
Apple: 3.1.1 In-App Purchase. Google: Payments policy.
Digital content and features used inside the app generally have to use the store's in-app purchase system. Physical goods and real-world services (food delivery, taxis, physical shop orders) use normal payment methods.
Avoid it:
Apple: 3.1.2 Subscriptions. Google: Subscriptions policy.
Avoid it:
Apple: 1.2 User-Generated Content. Google: User Generated Content policy.
Chat, comments, profiles, uploads and machine-made content shared between users all count.
Avoid it: Provide a filter for objectionable content, a way to report content, a way to block abusive users, timely responses to reports and published contact details.
Apple: 2.1 and 2.3. Google: minimum functionality.
"Coming soon" screens, filler text, empty states with no data, test content and "beta" labels lead to rejections.
Avoid it: Remove or hide unfinished features. Seed demo content for the reviewer if the app is empty on first launch.
---
4.8 Login Services. If you use a third-party or social login service for the main account, you generally also need to offer another login option that meets Apple's privacy criteria. Sign in with Apple is one such option. There are exceptions, for example when the app only uses your own company's account system. Check the current wording.
5.1.1. Every permission must come with a clear purpose string that explains what it's for. "This app needs your camera" isn't enough. Say what the user gets: "Scan receipts to add them to your expense report."
5.1.2. If you track users across other companies' apps and websites, including for targeted ads or sharing with data brokers, you must ask permission with App Tracking Transparency first, and respect the answer.
2.5 Software Requirements. Use only public APIs, don't download executable code that changes how the app works after review, and keep the app self-contained.
1.3 Kids Category. Apps for children have strict limits on ads, third-party analytics and links out of the app, and need parental gates for purchases and external links.
---
SMS, call log, all files access, background location, photos and videos, QUERY_ALL_PACKAGES, accessibility services and exact alarms all have restrictions. Each needs a declaration explaining why it's essential to your app's core feature. If a system picker or a less sensitive API can do the job, Google expects you to use it.
If your target audience includes children, ads and SDKs must be from approved programmes, and data collection is restricted.
Uploads targeting an API level below Google's current requirement are rejected automatically. Update your targetSdkVersion before each annual deadline.
Apps must do what the listing says, must not imitate system notifications or other apps, and ads must not appear unexpectedly or be hard to close.
---
Use this for every release after your first. Copy it into your issue tracker or notes for each version, so you have a record of what was checked.
Version: ________ Build / version code: ________ Release owner: ______________ Date: ____________
---
privacy-worksheet.md updated, and App Privacy and Data safety answers changed before submitting.review-notes-template.md).Neither store lets you roll users back to an older binary. The fix is always a new build, which is why staged rollouts and feature flags matter.
____________________________________________________________
____________________________________________________________
Reviewers have limited time with your app. Clear notes help them see everything quickly and avoid rejections for "we couldn't access this feature". Paste the filled-in version into App Review Information > Notes in App Store Connect, and into App content > App access in Play Console (Google has separate fields for each set of credentials and instructions).
Keep it short, factual and easy to scan. Write it for someone who has never seen your app.
Never put real customer data, your personal password or production admin credentials in review notes. Create a dedicated review account.
---
ABOUT THE APP
[App name] helps [who] [do what]. [One more sentence on the main feature.]
DEMO ACCOUNT
Username: [[email protected]]
Password: [password]
This account has [full access / an active premium subscription / sample data] so
you can test every feature. It does not need two-factor authentication.
HOW TO TEST THE MAIN FEATURES
1. Sign in with the demo account above.
2. [Tap X to see Y.]
3. [To test Z, go to Settings > ... and ...]
4. [To test in-app purchase, use a sandbox account. The demo account already has
premium unlocked if you prefer to skip purchase.]
ACCOUNT DELETION
Settings > Account > Delete account. [What gets deleted, and how long it takes.]
PERMISSIONS
- Camera: used to [scan receipts]. Only requested when you tap [Scan].
- Location: used to [show nearby stores]. The app works without it.
- Notifications: used for [order updates]. Optional.
THINGS THAT MAY NOT BE OBVIOUS
- [Feature X only appears after you add at least one item.]
- [Content is limited to [region]. The demo account is set to [region] so you can see it.]
- [The app connects to [hardware]. A video showing this is attached / at [link].]
- [User-generated content: report via the ... menu on any post, block via the
user's profile. Reports are reviewed within [24 hours].]
CHANGES IN THIS VERSION
- [Short list of what changed, especially anything related to a previous rejection.]
CONTACT DURING REVIEW
[Name], [phone], [email]. Available [hours and time zone].
---
ABOUT THE APP
[App name] helps [who] [do what].
HOW TO TEST
No account is needed. [Steps to reach the main features.]
PERMISSIONS
[As above.]
CONTACT DURING REVIEW
[Name], [phone], [email].Fill in your listing copy here before you open App Store Connect or Play Console. Limits are shown for each field. Limits can change, so check the current figures in each console, which also counts characters as you type.
App: ______________________ Language: ______________
---
| Field | Apple App Store | Google Play |
|---|---|---|
| App name | 30 characters | 30 characters |
| Subtitle | 30 characters | Not available |
| Short description | Not available | 80 characters |
| Promotional text | 170 characters | Not available |
| Description | 4,000 characters | 4,000 characters |
| Keywords | 100 characters | Not available (Google uses your listing text) |
| What's New or release notes | 4,000 characters | 500 characters |
---
Your brand name, optionally with a short descriptor.
[Brand]: [what it does]
Draft: ________________________________ Count: ___ / 30
The main benefit in a few words. Don't repeat words from the name, since both are already indexed for search.
[Benefit in plain words]
Draft: ________________________________ Count: ___ / 30
Appears above the description. You can change it any time without submitting a new version, so use it for timely news.
[New this month: one sentence about a feature, event or improvement.]
Draft: ________________________________________________ Count: ___ / 170
Comma-separated, no spaces after commas. Don't repeat words already in your name or subtitle, don't use competitor names, and don't include plurals of words you've already used.
[keyword],[keyword],[keyword],[keyword],[keyword]
Draft: ________________________________________________ Count: ___ / 100
Only the first few lines show before "more", so lead with what matters.
[One or two sentences: what the app does and who it's for.]
[Short paragraph: the main problem it solves and how.]
WHAT YOU CAN DO
- [Feature, written as a benefit]
- [Feature]
- [Feature]
- [Feature]
[Optional short paragraph: what makes it different, privacy approach, offline use.]
[If subscriptions: plan names, what's included, price and billing period, auto-renewal terms, how to cancel.]
Terms of use: [URL]
Privacy policy: [URL]
Questions? [support email or URL]
[Version number]
- [New: one line about the most useful change]
- [Improved: one line]
- [Fixed: one line]
---
[Brand]: [what it does]
No emoji, no "#1" or "best", no "free" or price text, no all caps unless it's your brand.
Draft: ________________________________ Count: ___ / 30
The first text people read on your listing. One clear sentence.
[Action verb] [what] [for whom or with what benefit].
Draft: ________________________________________________ Count: ___ / 80
Google indexes this text for search, so use the words people search for naturally. Repeating keywords unnaturally breaks the Metadata policy.
[One or two sentences: what the app does and who it's for.]
[Short paragraph on the main problem it solves.]
Features
• [Feature, written as a benefit]
• [Feature]
• [Feature]
• [Feature]
[Optional: privacy approach, offline use, accessibility.]
[If subscriptions: plans, what's included, price and billing period, how to cancel.]
Support: [email or URL]
Privacy policy: [URL]
Google Play supports a limited set of HTML tags (such as bold and italic) in the full description. Check the current list before using formatting.
- [New: one line]
- [Improved: one line]
- [Fixed: one line]
Draft: ________________________________________________ Count: ___ / 500
---