App rejected or removed by a store
Crashes at review, guideline violations, missing privacy labels, payment rule breaches.
Severity: distribution. Attached to 27 of 46 published product types, backed by 16 evidence records.
Product types that carry it
| Product type | Grade | Note for this type | Evidence |
|---|---|---|---|
| mobile banking app | secondary by design analysis | By design analysis: the banking app update is held at review when the financial services declaration or the bank's licensing details do not match the listing. | |
| neobank | secondary by design analysis | By design analysis: the app is the only way to open the account, so a held release blocks sign-ups when partner bank or licence details on the listing are incomplete. | |
| peer-to-peer payment app | secondary by design analysis | By design analysis: a send-money app update is held at review when the money transmitter licence or financial services declaration on the listing is missing. | |
| crypto exchange | primary | The exchange app is pulled from a country's store listing because the exchange lacks that country's crypto exchange licence or registration. | |
| stock trading app | secondary by design analysis | By design analysis: a brokerage app must be submitted by the licensed broker entity and declare its financial features, or review rejects the order-placing build. | |
| telemedicine app | secondary by design analysis | The store reviewer signs in with the demo account, finds no clinician available to start a visit, and rejects the build as incomplete. | |
| mental health app | secondary by design analysis | The store rejects the build because mood data feeds ad targeting, or the listing claims to treat anxiety while the health apps declaration says wellness tool. | |
| pharmacy delivery app | primary | A reviewer adds a prescription-only medicine to the cart and checks out without uploading or transferring a prescription, and the store pulls the app. | |
| wearable companion app | secondary by design analysis | The reviewer has no band to pair, the app stops at the 'searching for device' screen, and the build is rejected for incomplete functionality. | |
| ecommerce store | secondary by design analysis | The shopping app is a wrapped copy of the mobile website with no app-specific features, and review rejects it as a repackaged site. | |
| online marketplace | secondary by design analysis | The reviewer opens buyer-seller messages and listings and finds no way to report a listing or block a seller, which the user-generated content rule requires. | |
| grocery delivery app | secondary by design analysis | Store review runs a test basket through slot booking and checkout; a crash when every slot is full blocks the release. | |
| travel booking app | secondary by design analysis | Store review books a test stay; a crash when the supplier returns no availability for the reviewer's dates blocks the release. | |
| ride-hailing app | secondary by design analysis | Both the rider app and the separate driver app go through store review, and either one crashing at review blocks the release. | |
| loyalty program app | secondary by design analysis | Selling points, digital vouchers or paid tiers inside the app falls under store billing rules unless they redeem only for physical goods. | |
| email marketing platform | primary | Gmail and Yahoo spam-folder or refuse a bulk campaign whose sending domain lacks SPF, DKIM, DMARC alignment or a one-click List-Unsubscribe header. | |
| video conferencing tool | secondary by design analysis | The macOS client or its auto-join helper fails notarization, or the mobile build asks for camera and microphone without a stated purpose, and review blocks the release. | |
| SDK or client library | primary | An SDK on Apple's list of commonly used SDKs ships without a privacy manifest or signature, so App Store Connect rejects host app submissions and updates that add it. | |
| desktop application | secondary by design analysis | An unnotarized macOS build, or a Windows package that fails Microsoft Store certification, opens with a Gatekeeper warning or never reaches the store. | |
| smart home or IoT app | secondary by design analysis | App review cannot get past device onboarding without a physical hub, so the build needs a demo home with simulated lights and locks. | |
| EV charging app | secondary by design analysis | A reviewer without a car or charger cannot reach the start-session screen, so the build needs a demo station and a test account. | |
| social network | secondary by design analysis | The build ships without a way to report a post or block a user, which store review requires of every app with user-generated content. | |
| dating app | primary | A build without report and block on profiles and chats is rejected as a user-generated content app with one-to-one messaging. | |
| messaging app | primary | A build without report and block inside a conversation is rejected under the user-generated content rules. | |
| mobile game | primary | A loot box that does not show the odds of each item before purchase, or a kids-rated game with an uncertified ad SDK, is rejected. | |
| language learning app | secondary by design analysis | The paywall that appears after a lesson unlocks premium lessons outside in-app purchase, or the trial screen hides the renewal price, and review rejects the build. | |
| kids app | secondary by design analysis | A Kids Category build includes third-party analytics, or a purchase or outbound link sits outside a parental gate, and review rejects or removes it. |
Tests that address it
- release smoke tests: mandatory for this risk on 27 product types.
- device and browser compatibility: mandatory for this risk on 13 product types.
- compliance checks: mandatory for this risk on 13 product types.
- end-to-end functional tests: mandatory for this risk on 4 product types.
- integration tests: mandatory for this risk on 1 product types.
- payment and money-flow testing: mandatory for this risk on 1 product types.
Evidence
ev-0001store-guidelineprimary
App Review Guidelines, Apple
Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).
published undated · verified 2026-10-07
ev-0002store-guidelineprimary
Developer Program Policy, Google Play
Google Play applies these policies to every Android app it distributes and can reject, suspend or remove apps that violate them.
published undated · verified 2026-10-07
ev-0003store-guidelineprimary
Designing apps for children and families, Google Play
Google Play Families policy sets extra requirements (ads, data collection, SDKs) for apps whose target audience includes children.
published undated · verified 2026-10-07
ev-0004store-guidelineprimary
Financial Services policy, Google Play
Google Play requires declarations and licensing information from apps offering loans, trading, crypto and other financial services.
published undated · verified 2026-10-07
ev-0005store-guidelineprimary
Payments policy, Google Play
Google Play requires its billing system for digital goods and in-app purchases, with listed exceptions for physical goods and some services.
published undated · verified 2026-10-07
ev-0008store-guidelineprimary
Microsoft Store Policies, Microsoft
Apps submitted to the Microsoft Store are certified against these policies, including stability and functionality requirements.
published undated · verified 2026-10-07
ev-0009store-guidelineprimary
Notarizing macOS software before distribution, Apple
Apple requires Developer ID software distributed outside the Mac App Store to be notarized; Gatekeeper blocks software that is not.
published undated · verified 2026-10-07
ev-0035store-guidelineprimary
Email sender guidelines, Google
Gmail requires bulk senders to authenticate mail and offer one-click unsubscribe; mail that does not comply can be rejected or sent to spam.
published undated · verified 2026-10-07
ev-0069store-guidelineprimary
Understanding Google Play's Cryptocurrency Exchanges and Software Wallets Policy, Google Play
Non-custodial wallets are out of scope of the Cryptocurrency Exchanges and Software Wallets policy.
Google Play requires custodial software wallets and exchanges to declare the feature and hold country-specific registration, and excludes non-custodial wallets. Supports store-rejection for custodial crypto wallets and for crypto exchange apps on Android.
published undated · verified 2026-10-07
ev-0110store-guidelineprimary
Health Content and Services, Google Play
We don't allow apps with health and medical related functionalities that are misleading or potentially harmful.
Google Play policy for health apps: a health apps declaration is required, Health Connect data is personal and sensitive user data, apps regulated as medical devices must show clearance, and clinical service payments have their own rules. Applies to every health app distributed on Google Play, so it supports store-rejection for mental health, fitness and telemedicine apps and data-breach for fitness apps that read Health Connect.
published undated · verified 2026-10-07
ev-0143store-guidelineprimary
Health Content and Services, Google Play
We do not allow apps that facilitate the sale or purchase of prescription drugs without a prescription.
Google Play removes apps that let a user buy a prescription drug without a prescription, so the prescription gate in a pharmacy delivery app is a distribution requirement as well as a legal one.
published undated · verified 2026-10-07
ev-0220store-guidelineprimary
User Generated Content, Google Play
Provides an in-app system for reporting and blocking objectionable UGC and users, and taking action against UGC or users where appropriate.
Supports store-rejection: the policy requires report and block for features with one-to-one user interaction such as direct messages, which is the core of a dating app and a messaging app.
published undated · verified 2026-10-07
ev-0229store-guidelineprimary
Sender [...] Practices, Yahoo
Mailbox provider requirements for bulk senders: SPF, DKIM, a published DMARC policy and a working one-click List-Unsubscribe header. Supports store-rejection (mail filtered or refused by the mailbox provider) for email marketing platforms that send on customers' behalf.
published undated · verified 2026-10-07
ev-0230standardprimary
RFC 8058: Signaling One-Click Functionality for List Email Headers, IETF
Standard for one-click unsubscribe: it exists because anti-spam software that fetches URLs in email headers triggered unsubscriptions nobody asked for. Supports data-corruption of subscriber status and the header requirement for email marketing platforms.
published undated · verified 2026-10-07
ev-0265store-guidelineprimary
Create and manage subscriptions (Play Console Help), Google
You must also include in your app(s) access to an easy-to-use, online method to cancel the subscription.
Supports store-rejection and money-loss for a language learning app sold by subscription on Google Play: the page requires explicit offer terms, billing frequency and an in-app cancel method for every subscription.
published undated · verified 2026-10-07
ev-0293store-guidelineprimary
Third-party SDK requirements, Apple
As a reminder, when you use a third-party SDK with your app, you are responsible for all the code the SDK includes in your app, and need to be aware of its data collection and use practices.
Store guideline: host apps submitted to App Store Connect must include the privacy manifest for each listed SDK, and Xcode validates SDK signatures. Supports store-rejection for mobile SDKs directly, not by transfer.
published undated · verified 2026-10-07