Will Your App Get Rejected?

1. 01

   Users authenticate through a secure backend (not hardcoded credentials).

   Yes Partially No
2. 02

   Sessions/tokens are managed with refresh + secure storage (no plaintext in SharedPreferences).

   Yes Partially No
3. 03

   API keys for AI / paid services live on a server, never in client code. critical

   Yes Partially No
4. 04

   Network calls go over HTTPS with certificate pinning or trusted roots.

   Yes Partially No
5. 05

   Subscriptions/entitlements are validated server-side (not trusted client-side). critical

   Yes Partially No
6. 06

   Restore purchases and purchase error states are handled.

   Yes Partially No
7. 07

   You track a deliberate funnel: signup → purchase → activation.

   Yes Partially No
8. 08

   Crash/error monitoring (Sentry / Crashlytics) is wired in.

   Yes Partially No
9. 09

   Privacy consent is collected where required (GDPR / CCPA / ATT). critical

   Yes Partially No
10. 10

    Account deletion and data export are implemented (App Store / Play requirement). critical

    Yes Partially No
11. 11

    Info.plist permissions include usage descriptions (no empty NSUsage strings).

    Yes Partially No
12. 12

    Data safety form, target SDK, and privacy policy URL are configured.

    Yes Partially No
13. 13

    Labels, contrast, and dynamic type meet WCAG AA where practical.

    Yes Partially No
14. 14

    Lists are virtualized and images are lazy/cached (no jank on scroll).

    Yes Partially No
15. 15

    Onboarding, empty states, and retry/offline states are designed.

    Yes Partially No

Your answers stay in your browser — nothing is sent to a server.