Why App Store Reviews Reject Small Business Apps (and Fixes)
Short answer: Small business apps are most often rejected because they're essentially a wrapped website (guideline 4.2), were built from a commercial template and submitted by the template company (4.2.6), can't be fully reviewed because the reviewer has no working demo login (2.1), or let users create an account without offering in-app account deletion (5.1.1(v)). Missing privacy policies, inaccurate privacy labels and misused in-app purchase rules cause most of the rest. Almost all of them are cheap to fix if you check before submitting rather than after.
The guidelines in brief
Apple's App Review Guidelines (last updated October 16, 2026 at the time of writing) are long, but a small business app usually runs into the same handful. Below, each common rejection with what the guideline says and the fix.
Reason → fix table
| Guideline | What triggers it | Fix |
|---|---|---|
| 4.2 Minimum Functionality | The app is "a repackaged website": a web view of your site with a logo on top | Add genuine app value: bookings, accounts, push notifications for orders, offline content, loyalty cards, device features |
| 4.2.2 | The app is mainly marketing, ads, web clippings or a collection of links | Build around a task customers repeat (reorder, book, track), not around your brochure |
| 4.2.6 Template apps | Built with a commercial app builder and submitted by the builder on your behalf | Submit from your own developer account as the content provider, or use a builder that publishes one "picker" app hosting many businesses |
| 4.3 Spam | Separate apps for each branch or city, or a near-copy of widely available apps | One app with location selection inside; differentiate clearly |
| 2.1 App Completeness | Crashes, placeholder text, broken links, or the reviewer can't log in | Test on real devices; provide a working demo account with sample data and keep the back end switched on during review |
| 5.1.1(v) Account Sign-In | Users can create an account but can't delete it in the app; or login required for no good reason | Add "Delete account" in settings; let people browse without logging in if accounts aren't core |
| 5.1.1(i) Privacy Policies | No privacy policy link in App Store Connect or inside the app | Link both places; the policy must say what's collected, how, why, who receives it, and retention and deletion |
| App privacy details | Privacy "nutrition labels" don't match what the app and its SDKs actually collect | Audit every SDK (analytics, crash reporting, ads, chat) and answer the App Store Connect questionnaire accordingly |
| 5.1.2 Data Use and Sharing | Sharing personal data, including with third-party AI, without disclosure and permission | Disclose third parties clearly and get explicit permission; use App Tracking Transparency if you track |
| 4.8 Login Services | Google or Facebook sign-in as the main login with no privacy-friendly equivalent | Also offer an option meeting Apple's criteria (name and email only, private email option), such as Sign in with Apple |
| 3.1.1 In-App Purchase | Selling digital features or content through your own payment system | Use Apple's in-app purchase for digital content and subscriptions |
| 3.1.3(e) | The reverse: using in-app purchase for physical goods or real-world services | Use Apple Pay or card payment for meals, products, appointments and services consumed outside the app |
| 2.3.3 / 2.3.7 Metadata | Screenshots of the splash or login screen; app names stuffed with keywords | Show the app in use; keep the name to 30 characters and describe it honestly |
The big three, in more detail
"This is just your website" (4.2)
Apple's guideline says the app needs features, content and UI that take it beyond a repackaged website, and that an app which isn't useful, unique or "app-like" doesn't belong on the App Store. A hypothetical bakery app that only loads the bakery's website in a frame will struggle. The same bakery app with saved favorite orders, pickup time slots, a stamp card and a push notification when the order is ready is a different product.
Before building an app at all, ask whether a well-built mobile website would do the job. If your customers only visit you a few times a year, it probably would.
Template builders (4.2.6)
Guideline 4.2.6 says apps created from a commercialized template or app generation service will be rejected unless submitted directly by the provider of the app's content. In practice: if an app-builder company submits your app from its account, expect trouble. Enrol in the Apple Developer Program under your business name and submit from your own account. Apple also allows the "picker" model: one app hosting many clients, such as a restaurant finder with a page per restaurant.
The reviewer couldn't get in (2.1)
Apple asks for "demo account info (and turn on your back-end service!)" if your app has a login. Common failures: the demo account was deleted, needs a text-message code sent to your manager's phone, or the staging server was down over the weekend. Create a dedicated reviewer account with realistic data, no two-factor step, and write clear notes in the review information field: where to tap, what to test, and any hardware the reviewer won't have.
Account deletion: the quiet rejection
Guideline 5.1.1(v) says that if your app supports account creation, it must also offer account deletion within the app. It catches many first submissions. Requirements to plan for:
- A visible "Delete account" option in settings, not just a "contact us" email.
- Deletion of the account and associated personal data, apart from what you must keep by law, such as invoices.
- A clear explanation if deletion takes time or affects active subscriptions.
Build this into the first version; adding it later means another review cycle.
Pre-submission checklist
- Developer account in your business's name.
- Real app value beyond your website.
- Demo account with data, back end running, notes for the reviewer.
- Privacy policy linked in App Store Connect and in the app.
- Privacy labels checked against every SDK.
- In-app account deletion if accounts exist.
- Payment method matches what's being sold (digital vs physical).
- Screenshots of real screens, honest metadata.
- Tested on at least two real iPhones, including an older model.
If you're also publishing on Android, Google Play has its own hurdle for new personal developer accounts; see our guide to Google Play closed testing.
FAQ
How do I respond to a rejection?
Read the guideline cited in Resolution Center, fix the issue, and reply with a short explanation. If you believe the reviewer misunderstood, explain calmly with screenshots; you can also appeal to the App Review Board.
Can I explain my app to the reviewer in advance?
Yes. Use the notes field in App Store Connect for anything non-obvious: test logins, features that need a location, or why a permission is requested.
Do updates go through review too?
Yes. Every update is reviewed, and new guideline requirements apply to updates as well as new apps.
Is a progressive web app a way around App Review?
It avoids the App Store entirely, which can be fine for simpler needs. You lose App Store discovery and some device features.
If you'd like a second look at your app before it goes to review, send us the TestFlight link.