App Store Rejections: ATT 2.1, Kids Category, ITMS-90683, First IAPs

Written by Claude (Opus 5.5) and checked by Claude (Fable 5.2), from the repos, their notes and the session transcripts. Earlier Claude sessions built, submitted and fixed the apps; dested made the calls and edited. The first person below is dested's voice.

Marble Hop sat in App Review for 25 days. Then Apple wrote back:

The app uses the AppTrackingTransparency framework, but we are unable to locate the App Tracking Transparency permission request.

The prompt existed. It just never showed up where the reviewer was looking.

This autumn I sent five small Expo apps to Apple: Store Brand Puzzles, Kid Size, Marble Hop, Paint Paws and Squiggletale. Two were rejected, four builds were refused before they reached a reviewer, and App Store Connect's API refused to attach in-app purchases for three of the apps. Both rejected apps were resubmitted and were still waiting on November 8.

#Every rejection, its real cause and the fix

#The ATT prompt was there, on a path the reviewer never took

Marble Hop asked for tracking permission after the first finished run, and never in its ad-free mode. My review notes told reviewers to switch that mode on first. So they never saw the prompt, while AdMob was already loading ads behind them.

Apple asked for a recording from a physical device, on a fresh install, showing the prompt before any tracking data is collected.

The fix moves ATT to launch and puts it in front of the ad SDK:

canRequest = (await g.AdsConsent.gatherConsent()).canRequestAds
await askTracking()          // waits for AppState 'active' first
if (!canRequest) return false
await mobileAds.initialize() // nothing loads before this line

The wait matters. If you request ATT before the app is active, iOS answers "denied" and shows no dialog. Paint Paws also asked after the first win. Apple approved it that way, and 1.0.1 moved ATT to launch anyway.

#Kids Category apps get four questions before anyone reviews them

Squiggletale is in the Kids Category. About 14 hours after submit, an automated message asked four things and marked the version Rejected, though nothing was wrong with the build:

1. Do you use third-party analytics?
2. Do you use third-party advertising? If so, link the network's kids policy.
3. What data do you share with third parties, why, and where is it stored?
4. What other user or device data do you collect, and how is it used?

I answered each one from the code, put the answers in the review notes and resubmitted build 5 unchanged. Name the real third party. Squiggletale sends a story's words to Anthropic to draw it, so the answer says Anthropic, not "an AI service".

#ITMS-90683 came from a framework, not my code

Squiggletale only wanted to save a video to Photos. Builds 1 and 2 failed processing: expo-media-library links the full photo-library API, and its photosPermission: false had dropped the read key. Build 3 added it back.

Then I cut the Photos feature for 1.0, removed expo-media-library, and made the archive script fail if any NSPhotoLibrary key came back. Build 4 failed with ITMS-90683 again. ExpoFileSystem.framework, precompiled, references PHPhotoLibrary and PHAsset, and Apple checks the binary, not your intent.

The fix is a string that tells the truth:

infoPlist: {
  // ExpoFileSystem links PHPhotoLibrary/PHAsset; processing rejects the binary without this key.
  NSPhotoLibraryUsageDescription: `${BRAND.name} never opens your photo library.`,
},

#The API can't attach a first-time in-app purchase

Paint Paws went in on October 22 with all 8 IAPs. A resubmission the next day carried only the version, while the review notes still said eight were attached. I pulled it to fix that, and inAppPurchaseSubmissions answered 409, "has no pending version for submission", with a draft submission open. Apple then approved 1.0.0 with all 8 left out, so 1.0.1 shipped them.

Squiggletale got FIRST_CONSUMABLE_MUST_BE_SUBMITTED_ON_VERSION from the same endpoint, and its version page had no IAP section at all. What works, in the web UI:

1. On each IAP's page, press "Add for Review". The later ones offer "Draft Submission (n)".
2. Add the version to the same draft.
3. Press "Submit for Review" once the draft lists the version and every IAP.

Removing a version from review and resubmitting drops every attachment. Check the draft panel before you press Submit.

#The preflight checks that would have caught each one

I built an App Review gate on October 27: a checklist plus preflight.ts, a grep-based script that also makes read-only App Store Connect calls. It had 28 checks on November 1. Two of the problems below added checks since, so it now has 30, plus 10 App Store Connect checks. It exits 0 with no FAIL, 1 with any FAIL.

A PASS means "found it", not "Apple will accept it". asc-iap-attached also warns while the IAPs sit in a draft submission, which it can't see.

#What I check now before pressing Submit

• ATT, if you track at all, runs on first launch, after the app is active and before any ad or analytics SDK starts. Never behind gameplay or a mode your notes send reviewers into.
• A Kids Category app answers Apple's four data questions in its review notes on the first submit.
• Every framework you link gets a purpose string for what it links, even one your app never uses. An honest "never opens your photo library" passes.
• First-time IAPs go through the web UI's draft submission. Look at the draft panel before Submit.