appeal.handled.tools · All rejection guides
In-app account deletion stopped being optional on 30 June 2022. Apps that create an account have to let people delete it from inside the app, and this single requirement accounts for more 5.1.1 rejections than everything else under the heading.
An email address to write to. A link out to a web form. A chat widget. A deactivate that quietly keeps the record. Each of these gets rejected, and each of them shows up weekly.
What counts is a control inside the app that a reviewer can find and press, which removes the account and the data behind it.
Where you put it matters as much as whether it exists. When a reviewer writes that they could not find the option, they usually could not. Anything you are legally obliged to retain is fine to retain, but name the obligation in your reply rather than leaving it as a gap.
Every permission needs a string explaining why your app needs it. "This app requires access to your camera" is rejected. "Used to scan the barcode on a book so it can be added to your shelf" is not. Name the feature and what the person tapping Allow gets.
Audit every usage key in the Info.plist, including ones a dependency added on its own. Location gets read hardest of all, and NSLocationAlwaysAndWhenInUseUsageDescription with no visible always-on feature behind it is close to automatic.
Requiring registration to see content that has no reason to be behind an account is a 5.1.1. So is collecting fields the core feature never touches. A photo-filter app asking for date of birth, contacts and a phone number is asking for this rejection specifically.
The test being applied: could the app do its main job without this field. If yes, make it optional.
Your privacy nutrition label describes what the app collects in practice, and that includes whatever your SDKs collect on their own. Analytics, attribution, advertising and crash-reporting SDKs routinely send identifiers nobody declared, and this gets checked. Read the current data-collection documentation for every third-party SDK in the build before arguing the label is accurate.
The path to the delete control written out as Settings, then Account, then Delete Account. What deletion removes, plus anything retained and why. The rewritten purpose strings, quoted. Which SDK caused a label change, if one did. A recording of the deletion flow costs two minutes and settles the question outright.
Paste your rejection and what the app does. You get an appeal letter written for that exact notice, back within an hour, for $29 CAD. A full sample letter is on the front page so you can judge the writing before paying.
It is not legal advice and it is not a promise Apple says yes. When the rejection is one no letter fixes, the letter tells you that and what to change instead.