# Fixed Guideline 4.2 and still rejected? The 4 App Store rules AI-built apps hit next

You wrapped your AI-built app properly, fixed the "repackaged website" problem (Guideline 4.2), resubmitted, and a day later App Store Connect says **Rejected** again, for a rule you hadn't heard of.

That's common. AI builders like Lovable, Bolt and Rork handle a lot, but there are four rules they leave to you, and they tend to surface on a later submission, once the obvious problems are fixed:

1. **5.1.2(i)**: sending personal data to an AI service without asking
2. **4.8**: Google login without Sign in with Apple
3. **3.1.1**: selling digital features through Stripe
4. **1.2**: letting people post with no way to report or block

Here's what each one says, and the fix.

## First: read the rejection properly

Every rejection has the same three parts:

- **A guideline number**, such as 4.2. That's the rule the reviewer applied, and it maps to a section of Apple's [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/).
- **A short explanation** of what the reviewer saw.
- **Sometimes, screenshots** of where they got stuck.

Check the status too:

- **Metadata Rejected**: App Review didn't accept your listing. Edit the metadata in App Store Connect and reply to the message. No new build.
- **Rejected**: the problem is in the app itself. If the fix is in the app, upload a new build.

Also make sure the common six are fixed first, because a rejection note can list more than one guideline: 4.2 (website in an app), 2.1 (crashes or no demo account), 5.1.1(v) account deletion, 4.3 spam, 5.1.1 privacy and permissions, and 2.3 metadata. They're covered in [why Apple rejects AI-built apps](https://letsdeploy.it/guides/why-apple-rejects-ai-built-apps).

## 1. Guideline 5.1.2(i): sharing data with AI

A lot of AI-built apps call an AI API somewhere: a chat assistant, a summary, a "write it for me" button. Since November 13, 2025, Apple's guideline names third-party AI explicitly:

> "You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."
> Apple App Review Guideline 5.1.2(i)

**The fix:** before the first AI request, show a screen that says which data goes to which provider, and wait for the user to agree. Apple has no template, but a good consent screen:

- names who gets the data
- says what is sent
- waits for a tap
- offers a way out

Here's a minimal gate in React Native. Call it before the first request goes out:

```tsx
import AsyncStorage from "@react-native-async-storage/async-storage";
import { Alert } from "react-native";

const AI_CONSENT_KEY = "ai-consent-v1";

export async function ensureAiConsent(): Promise<boolean> {
  if ((await AsyncStorage.getItem(AI_CONSENT_KEY)) === "granted") return true;

  return new Promise((resolve) => {
    Alert.alert(
      "Before you ask",
      "Ask AI sends your messages to OpenAI to write replies. Don't include anything you don't want shared.",
      [
        { text: "Not now", style: "cancel", onPress: () => resolve(false) },
        {
          text: "Allow",
          onPress: async () => {
            await AsyncStorage.setItem(AI_CONSENT_KEY, "granted");
            resolve(true);
          },
        },
      ],
      { cancelable: false }
    );
  });
}

// before calling your AI endpoint
if (!(await ensureAiConsent())) return;
```

Name the provider in your privacy policy too, which Guideline 5.1.1(i) already requires you to link inside the app. If you switch providers, change the key (`ai-consent-v2`) so people are asked again. The [third-party AI consent guide](https://letsdeploy.it/guides/ai-app-third-party-ai-consent) has the full screen, the wording and the privacy policy lines.

## 2. Guideline 4.8: do you need Sign in with Apple?

Yes, if your app's main account uses Google, Facebook or another third-party login. Guideline 4.8 says such apps must also offer an equivalent option that:

- limits data collection to name and email
- lets people keep their email private
- doesn't collect their interactions for advertising without consent

Sign in with Apple meets all three, which makes it the usual choice.

Apple also lists cases where no extra option is needed, starting with an app that "exclusively uses your company's own account setup and sign-in systems", such as plain email and password.

**The fix:** if your app has Google sign-in, either add Sign in with Apple next to it, or remove Google and keep only your own email sign-in.

## 3. Guideline 3.1.1: can you use Stripe instead of In-App Purchase?

Only for physical goods and real-world services. The guideline:

> "If you want to unlock features or functionality within your app, (by way of example: subscriptions, in-game currencies, game levels, access to premium content, or unlocking a full version), you must use in-app purchase."

In practice:

| You're selling | Use |
|---|---|
| Digital features, content, subscriptions | In-App Purchase (a service like RevenueCat handles much of the setup) |
| Physical goods, or services used outside the app (a delivery, a booked yoga class) | Stripe is fine |
| Digital goods, US storefront | In-App Purchase, and you may also link out to your own checkout |

In other storefronts, linking out needs one of Apple's entitlements, which only apply in specific storefronts and app types. The [Stripe or In-App Purchase guide](https://letsdeploy.it/guides/stripe-or-in-app-purchase) goes through each case.

## 4. Guideline 1.2: user-generated content

If people can post anything others will see, Guideline 1.2 requires four safeguards:

- a method for filtering objectionable material from being posted
- a mechanism to report offensive content, and timely responses to reports
- the ability to block abusive users
- published contact information

Community, chat and marketplace apps from AI builders often ship with posting but none of these.

**The fix:** a Report option on every post and profile, a Block option on every profile, a word filter on posts and a contact email in settings. Then mention all four in the review notes so the reviewer doesn't have to hunt for them.

## What to write to App Review after a rejection

Resubmitting the same build unchanged and hoping for a different reviewer doesn't work. A good reply names the guideline, says what changed and where to see it:

```text
Hi, thanks for the review. We've addressed Guideline [X]: [what you
changed, in one sentence]. You can see it at [screen or steps]. The demo
login is in the review notes. Happy to clarify anything.
```

Then give the reviewer everything they need in the App Review notes, so the next review doesn't stall on a sign-in screen:

```text
Demo account: demo@yourapp.com / [password]. It's pre-filled with sample
data. To test [main feature]: [step 1], [step 2], [step 3]. [Feature]
needs [a location, the camera or a second account], so here's a short
video: [link]. Questions: [email]
```

Use a demo account that doesn't expire.

## Google Play rejects differently

Google Play's common blockers are mostly forms and declarations:

- **The Data safety form doesn't match** what the app and its SDKs actually collect. Google says it will require you to fix it, and apps that don't can have updates blocked or be removed. Remember the form covers every SDK, not just your own code.
- **Sensitive permissions**, such as background location, are used without a declaration in Play Console.
- **The target API level** isn't recent enough.

And one that isn't a rejection but delays every new personal account: personal developer accounts created after November 13, 2023 need a **closed test with at least 12 testers, opted in for 14 days in a row**, before publishing to production. That adds at least two weeks to a launch, so start recruiting testers before your build is final.

## Check your app before you submit

- **Before you submit:** the [rejection-risk check for Lovable apps](https://letsdeploy.it/lovable-app-store-checker) (takes a lovable.app link) and the [pre-submission checklist](https://rapidnative.com/tools/app-store-submission-checklist) for any app.
- **After a rejection:** paste the message into the [App Store rejection decoder](https://rapidnative.com/tools/app-store-rejection-decoder) to see what it means and how to fix it.

All free.

## Wrapping up

None of these fixes is hard on its own. Together they can add up to weeks of work that has nothing to do with the app you built.

That's why we built [LetsDeployIt](https://letsdeploy.it/?utm_source=hashnode&utm_medium=article&utm_campaign=rejection_autopsy): send us your app, whether you built it with Lovable, Bolt, Rork or by hand, and preview the native version on your own phone for free. Then we take it through the native build, compliance, submission and every reviewer reply until it's approved. But everything above works without us.

Which of these four caught you out? I'd like to hear it in the comments.

---

*Sources, checked November 11, 2026: [Apple App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/), [Apple: Updated App Review Guidelines, November 13, 2025](https://developer.apple.com/news/?id=ey6d8onl), [App Store Connect: app and submission statuses](https://developer.apple.com/help/app-store-connect/reference/app-information/app-and-submission-statuses), [Google Play: testing requirements for new personal accounts](https://support.google.com/googleplay/android-developer/answer/14151465), [Google Play: Data safety section](https://support.google.com/googleplay/android-developer/answer/10787469).*

*This post first appeared on the [LetsDeployIt blog](https://letsdeploy.it/guides/app-store-rejection-autopsy).*