Suggestions to Prevent App Store and Play Store Rejections

App Store Guidelines

• Make sure that the credentials you provide for Apple reviewers to test are always valid. For more information, see Create a Placeholder App.
• Make sure that the screenshots you submit for iPhone and iPad show the app in use.
  • Make sure that you take the screenshot for the device on that specific device. For example, don’t use a screenshot for the 12.9 inch (32.766 cm) iPad that you took on an iPhone and stretched.
  • Make sure that the screenshots are from the actual branded app or the Publisher Playground app. Don’t take screenshots of your org in a mobile web browser, such as Safari, Chrome, or Firefox.
• Don’t enter other mobile services names, such as Apple, Google, or Android, in the store descriptions, app name, or screenshots.
  • Make sure that the content within the app doesn’t contain any mobile services names, such as Apple, Google, or Android.
• Make sure that you haven’t entered non-production ready terms, such as beta or test, in your store description, app name, or screenshots.
• To publish your app to the App Store publicly, don’t enter audience-specific language in your store description, app name, or screenshots. Examples of specific language are employee, customer, or internal.
• Make sure that the sandbox Experience Cloud site that you provide to Apple for review has a valid URL to log in to.
• Make sure that your branded app provides an enhanced experience compared to a web browser experience (Apple Guideline 4.2).
• As of June 2022, Apple requires that any app that supports account creation must give users the ability to delete their account from within the app. Deleting an account removes the account from the developer’s records, along with any data associated with the account that the developer isn’t legally required to maintain. See Allowing Mobile Publisher for Experience Cloud App Users to Initiate Deletion of Their Data for details.
• If your app is available in China, make sure to enter the app’s Internet Content Provider (ICP) Filing Number in your App Store Connect account. For more information, see the “Availability in China mainland” section of App information in App Store Connect Help.

Refer to this table and App Store Review Guidelines for additional information about common App Store rejections and Salesforce-specific tips to avoid them.

Play Store Guidelines

• If your app is related to Covid, review Google’s Requirements for corononavirus disease 2019 (COVID-19) apps.
• In Experience Builder, make sure that you’re not entering mobile services names, such as Apple, Google, or Android.
• The Advertising ID category is for users who advertise in their apps. The Government ID category is for local, city, state, and national government users.

  For apps in the Advertising ID and Government categories, answer the related questions. If your apps aren’t in the Advertising ID or Government ID categories, follow the guidelines and answer "no" to the questions.

• To meet Google's requirements for your app's privacy policy, list and describe all the device permissions that your app requests from users. Use the same app permissions that you enable in your app's Setup for Mobile Publisher project. You must also publish your app's privacy policy to a publicly available URL that contains your app's name. Then, make sure that links to your privacy policy are easily accessible from within your app
• Complete the Data Safety Questions accurately. Pay close attention to location and data collection. See Google Data Safety - Experience Cloud App.
• If your app is a beta, only share Gmail or G-Suite addresses for beta testers. Google only accepts Gmail or G-Suite addresses. 
• Enter the test user’s credentials under App Access, and keep the credentials updated. Google has a mandatory requirement for entering test user credentials. Salesforce recommends the sandbox for testing. See Update Test User Credentials.

• Effective December 7, 2023, if a user can register and the app collects data, Google requires all mobile apps to include user account deletion. See Understanding Google Play’s app account deletion requirements.

  You must provide users with an in-app path to delete their app accounts and associated data. Provide a web link resource where users can request app account deletion and associated data deletion. You have the opportunity to show users if you delete other data too.

  

  Important If you also have an Apple app available to your customers, Apple requires that the data deletion process is handled completely within the app. 

Binary Handoff Apple and Google Guidelines

If you’re using binary handoff, some parts of the submission process have to be resubmitted to correct Apple or Google review rejections. These common rejections can affect the binary handoff submission.

Refer to Apple’s App Review Guidelines or to Google’s Workspace Marketplace review process.

• Apple can reject submissions for the following reasons:
  • Objectionable or Harmful Content: Any objectionable or harmful data in the metadata, icons, app name, external client app name, or icon (only through Spring '26).
  • Performance: Performance issues include incomplete metadata, such as a bad product or sandbox URL, content related to testing (such as the app with beta in its name or image), or maintaining an Apple platform focus.
  • Design: Copycat images, icons or metadata, or not providing enough minimum functionality on the app. See Common App Store rejections for more information.
  • Legal & Data Sharing: Data Privacy statements and app functionality need to adhere to the included app permissions or user tracking specifications. App permissions need to provide an adequate description of the intended use and how the data is handled and any submitted metadata need to adhere to copyrights and intellectual property guidelines.
• Google can reject submissions for the following reasons:
  • Unnecessary or Flagged Permissions: Apps that request permissions that Google flags as unnecessary for the app’s core functionality. Correct the flagged app permissions.
  • Invalid or Impersonating Assets: In rare cases, Google flags an app for using distorted, invalid, or impersonating logos or screenshots. If the developer can't prove the authenticity of the assets, they have to be replaced.
• In addition, consider the following for both platforms:
  • Rejections related to reviewer login issues based on production, sandbox URL, or authorized domain-related configurations require a Setup form update and resubmission.
  • Customers who have included the root domain in URL management have to correct this configuration.