Bucket 3 · Independent service, not affiliated with Apple Inc. or Google LLC.

App Rejection Fix Pack · Guide

How do I fix an App Store rejection under guideline 5.1.1 data collection and storage?

Guideline 5.1.1 covers how your app asks for, uses and stores personal data. Most rejections come from a missing or unreachable privacy policy, vague permission purpose strings, asking for data the app does not need, forcing account creation for features that do not need it, or offering account creation without in-app account deletion. Find which of these your notice names, fix it in the build and metadata, and say what changed in your reply.

Steps to fix a 5.1.1 rejection

  1. Match the notice to the sub-point. Read which part of 5.1.1 the message quotes, such as (i) privacy policies, (ii) permission, (iii) data minimization, (iv) access or (v) account sign-in, which includes account deletion. Fix that point first, then check the others before resubmitting.
  2. Check the privacy policy link. Make sure a working privacy policy URL is in your App Store Connect metadata and is also reachable inside the app. The policy should say what data you collect, how you use it, who you share it with, how long you keep it and how users can revoke consent or ask for deletion.
  3. Rewrite permission purpose strings. Each usage description in Info.plist, such as camera, location or contacts, should say plainly why the app needs that access and what the user gets. Replace generic text like "This app needs your camera" with the specific feature.
  4. Remove requests you do not need. Drop permissions and data fields the app does not use for a current feature, and request each permission at the moment the related feature is used rather than all at launch.
  5. Let people in without an account where possible. If parts of the app do not depend on an account, let users reach them without signing up. Ask for personal details only when a feature needs them.
  6. Add in-app account deletion. If users can create an account in the app, they need a way to start deleting it from inside the app, not only by email. Put it somewhere easy to find, such as account settings, offer to delete the whole account rather than only deactivate it, and test it end to end.
  7. Align the privacy labels. Compare the App Privacy answers in App Store Connect with what the app and any third-party SDKs actually collect, and update them so they match.
  8. Reply with exact locations. In your reply, list each fix and where the reviewer can find it, for example Settings, then Account, then Delete Account, so the next review can confirm it quickly.

When a done-for-you pack helps

A done-for-you pack helps when the notice is short and you are not sure which sub-point of 5.1.1 you failed, or when third-party SDKs make it hard to see what the app collects. We map the notice to the guideline text, list the build, metadata and review-note changes, and draft the reply and a resubmission checklist for you to submit from your own account. This is not legal advice on privacy law.

US$49 all-in, one-time.
No subscription and no extra fees. Delivered by email within 24 hours of your order. Covers one rejection notice for one app.
See the App Rejection Fix Pack · US$49

Questions

Is an email address for deletion requests enough?

For most apps, no. Guideline 5.1.1(v) says apps that support account creation must offer account deletion within the app. Apple's guidance adds that apps outside highly regulated industries should not make people phone, email or use a support chat to delete an account. If deletion finishes on your website, link from the app directly to that page.

Do I need a privacy policy if my app collects no data?

Yes. Apple asks for a privacy policy link for all apps, in the App Store Connect metadata and within the app. If you collect nothing, the policy can say so clearly. Remember that analytics, crash reporting and advertising SDKs often collect data, so check what your dependencies do before stating that none is collected.

Why was I rejected for a permission I explained?

Reviewers often reject purpose strings that are generic or do not match what the app visibly does with the data. Rewrite the text to name the specific feature and benefit, and make sure the permission prompt appears when the user reaches that feature. If the app does not need the permission for a current feature, remove the request.

Contact

Email james@bucket3.ai. We reply within one business day.
Bucket 3 · bucket3.ai, 300 Sheppard Ave W, Unit 101-65, Toronto, ON M2N 1N5, Canada
See all products, refunds and contact.