App Store or Google Play refused your build?

Rejection codes

What is ITMS-91053?

Apple's rejection for calling a required-reason API without declaring a reason in a privacy manifest. It arrives at upload, names the APIs it found, and there is no warning build beforehand. The store readiness audit is mostly about this class of problem. How to fix it

What is ITMS-90683?

Apple's refusal for a build that can reach the camera, location, contacts or another protected resource without a sentence in Info.plist saying why. It comes from the binary, not from what the app does: a plugin that links the camera brings the requirement in even if nothing ever opens it, so a build that runs fine on a phone never reaches TestFlight. We name the key and the plugin that brought it in. How to fix it

What does warning 90068 mean?

App Store Connect sends it when an app's MinimumOSVersion is below iOS 15. Today the build is delivered anyway, with the warning in the email afterwards; from spring 2027 the upload is refused. A Flutter project carries 13.0 unless somebody changed it, so most teams meet this one without having done anything wrong. How to fix it

What is ITMS-90208?

Apple's refusal when a framework inside the app declares, in its own Info.plist, an older minimum iOS than its binary was built for. Before Flutter 3.41 the usual one was App.framework, whose Info.plist was copied from ios/Flutter/AppFrameworkInfo.plist and kept an old MinimumOSVersion. Since 3.41 the build writes that key itself, so updating Flutter fixes it; on an older version, set it there to the version the binary was built for. How to fix it

What is ITMS-90809?

Apple's refusal for any reference to UIWebView. New apps have been refused since April 2020 and updates since December 2020. A reference is enough, even if no web view is ever shown; it almost always comes from an old SDK, and updating or removing that SDK is the fix. How to fix it

What is ITMS-90685?

Apple's refusal when two bundles inside the app share one CFBundleIdentifier: usually an app extension given the app's own identifier, or a framework embedded in the app and again inside an extension. Give each extension its own identifier under the app's, and embed each framework once. How to fix it

Kept current

App Store and Google Play deadlines, 2026–2027

Both stores move their requirements every year, and a checklist written last year quietly stops being a checklist. This is what applies today. The date below is when it was last read against what Apple and Google actually publish.

Last read against Apple's and Google's published requirements on 16 September 2026. When a level moves, the checks move with it, and every report names which checks ran and which did not.

What the store readiness audit checks

• A privacy manifest missing, or an SDK shipped without one
• Required-reason APIs called with no declared reason — the ITMS-91053 rejection, which arrives with no warning
• A plugin that reaches for the camera, location or contacts with no …UsageDescription in Info.plist — ITMS-90683, which stops the upload before TestFlight, often for a feature the app never uses
• An App Store icon with transparency in it, a framework that declares the wrong minimum iOS (ITMS-90208), or no answer on encryption, which leaves every build waiting as Missing Compliance
• A plugin registering for push without the entitlement, so notifications never arrive, a reference to UIWebView (ITMS-90809), or two bundles sharing one identifier (ITMS-90685)
• A third-party login with no equivalent beside it (Guideline 4.8)
• No way to delete an account from inside the app (Guideline 5.1.1(v), and Google's data deletion policy, which wants a second route outside it)
• A target API level Google Play has stopped accepting
• Native libraries that will not load on 16 KB memory pages — Google Play stops releasing such updates on 1 February 2027, and plugins with prebuilt code are the usual cause
• A release signed with the debug key, a debuggable build, or a Play Billing Library older than version 8
• Permissions Google Play reserves for certain kinds of app — background location, photos and videos, all installed apps, all files — and the ones it wants declared, precise location among them from 27 January 2027
• A privacy label or Data safety form that says less than the build does
• A support or privacy URL in the listing that no longer answers

The standards and store rules we audit against

App Store Review Guidelines

4.8 · 5.1.1(v) · 1.5, and what review rejects for

PrivacyInfo.xcprivacy

required since 1 May 2024 — the file behind ITMS-91053

MinimumOSVersion

warning 90068 today, refused from spring 2027

iOS 27 SDK

required for uploads from April 2027

Play target API level

36 since 31 August 2026 · 35 to stay listed

Play Data safety

and in-app account deletion

Send a build. Get a report by email.

Price

The store readiness audit is €190, 2 working days. For one specific rejection, or a question before you build, a consultation is €90/hour.

Get an audit

Email a build. Get a fixed price and a date.

Write to hello@checkapp.dev with the build, or a link to it, and one line on what you need: an accessibility audit, a store check, or both. You will get a fixed price and a date back the same working day.