Blocks submissionApp Store

An app with accounts lets people delete the account from inside the app

The question Does the app let a person create an account? If so, is there a way to delete it from inside the app that removes the account rather than deactivating it, without an email or a call? Answer from a device walk or the app's own screens, and name the screen.

A person or a model answers it from the app's texts and screens; the answer is kept only while the facts it saw are unchanged.

Applies to every app

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• Offering account deletion in your app: An app that creates accounts, including automatically created guest accounts, must let users start deleting the account from inside the app, for all users regardless of location; the option must be easy to find; the whole account record and associated data, including shared user-generated content, must be removed (legally required retention excepted); only deactivating is insufficient; apps outside highly regulated industries should not require a call, email or support flow; confirmation and re-authentication steps are allowed, and a manual or delayed process is acceptable if the user is told how long it takes and confirmed when done.
• App Review Guidelines: A privacy policy link is required in App Store Connect and inside the app; the policy must say what data is collected, how, and every use; confirm that any third party receiving user data (analytics, ad networks, SDKs, parent or related entities) gives equal protection; and explain retention, deletion, and how to withdraw consent or request deletion. Consent must be obtained for any data collection, even anonymous data; paid features may not depend on granting data access; users need an easy way to withdraw consent; purpose strings must fully describe data use. Collect only data the core function needs, prefer pickers and share sheets, never force or trick consent, and offer alternatives when a permission is declined. If the app has no significant account-based features it must work without login; if it supports account creation it must offer in-app account deletion; personal information may not be required except for core function or by law.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Google additionally requires a web deletion resource (URL entered in the Data safety form, must load and name the app or developer) and accepts a link to that web page as the in-app path; Apple has no web requirement but is stricter in-app: guest accounts count, deactivation is insufficient, and apps outside highly regulated industries may not route deletion through a call, email or support flow. Both require deleting associated data and allow disclosed legally required retention. partial
• Google adds the web-link requirement; Apple adds the ban on call/email/support-only flows and explicitly covers auto-created guest accounts. "Freezing does not count" (Google) equals "deactivating is insufficient" (Apple). partial
• Google's policy is far more detailed (web resource, Data safety deletion questions, TV/Wear/web exemptions, device-management exemption); Apple's 5.1.1 sentence is a pointer to apple.account-deletion. Apple has no exemption for enterprise device-management apps. partial
• Google requires the policy URL to be public, non-PDF and to name the developer with a contact, and bans selling data; Apple requires consent even for anonymous data, requires the policy to confirm third parties give equal protection, and bans making paid features depend on granting data access. partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as apple.account-deletion-in-app and says what to do, who does it, where, and how it knows.