If your app supports creating an account, App Review checks that users can delete it from inside the app -- not just sign out, not just deactivate.
(v) Account Sign-In: If your app doesn’t include significant account-based features, let people use it without a login. If your app supports account creation, you must also offer account deletion within the app. Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law. If your core app functionality is not related to a specific social network (e.g. Facebook, WeChat, Weibo, X, etc.), you must provide access without a login or via another mechanism. Pulling basic profile information, sharing to the social network, or inviting friends to use the app are not considered core app functionality. The app must also include a mechanism to revoke social network credentials and disable data access between the app and social network from within the app. An app may not store credentials or tokens to social networks off of the device and may only use such credentials or tokens to directly connect to the social network from the app itself while the app is in use.
Can I direct people to a customer service flow to complete account deletion?
It depends. Apps in highly regulated industries, as described in App Review Guideline 5.1.1(ix), may use additional customer service flows to confirm and facilitate the account deletion process. Apps not operating in highly regulated industries should not require people to make a phone call, send an email, use a chat support flow, or go through other support flows.
Can I require reauthentication or add confirmation steps to ensure the account isn't deleted by accident or by someone other than the account holder?
Yes. It's appropriate to confirm the user genuinely intends to delete their account. You may add steps to verify the identity of the person making the request, and to confirm that they want to delete the account, such as by entering a code from an email or phone number already associated with the account. However, apps that make it unnecessarily difficult for someone to delete their account will not pass review.
My app uses Sign in with Apple to provide account creation and authentication. What changes are necessary to support people who delete their accounts?
Apps that support Sign in with Apple should use the Sign in with Apple REST API to revoke user tokens. Use server-to-server notification endpoints to process changes for Sign in with Apple accounts. Note that developers based in the Republic of Korea must provide a server‑to‑server notification endpoint when registering a new Services ID.
If my app links out to the default web browser for account creation, does it still need to offer account deletion within the app?
Yes. Additionally, linking out to the default web browser to sign in or register an account provides a poor user experience and isn't appropriate, per App Review Guideline 4.
My app automatically creates an account for the user. Do I need to include an option to initiate account deletion?
Yes. People should have the option to delete automatically generated accounts (sometimes called "guest" accounts) and the data associated with those accounts. Ensure any automatic account creation in your app complies with local laws where your app is available.
I manually delete accounts and this takes time. Does account deletion need to be immediate and automatic?
No. If your process for account deletion is manual or otherwise takes a reasonable amount of time to complete, this is acceptable. Inform the person how long it will take to delete the account and provide a confirmation when the deletion is complete. Ensure the time it takes to delete accounts complies with local laws where your app is available.
I allow account deletion in compliance with CCPA, GDPR, or other local laws in some of the locations where my app is available. Is this sufficient?
No. Everyone should be able to delete their accounts, regardless of where they're located. Existing account deletion flows you've created to comply with local legal requirements can be made available to everyone, as long as they meet the requirements of App Review Guideline 5.1.1(v).
How do I handle people with auto-renewable subscriptions? I don't want to accidentally charge someone after they've deleted their account.
If a person has an auto-renewable subscription, notify them that billing will continue through Apple and ask them to cancel their subscription before continuing. If you use App Store Server Notifications for auto-renewable subscriptions, you can verify the status of the person's subscription in real time, or use the Subscription Status API to identify subscription status.
Use showManageSubscriptions in iOS 15 and iPadOS 15, or later, or provide this link to let people manage their subscriptions: https://apps.apple.com/account/subscriptions/. For tvOS, provide onscreen instructions to change or cancel a subscription, as described in the Apple TV User Guide.
You can also use beginRefundRequest in iOS 15 and iPadOS 15, or later, or provide this Apple Support link to let customers submit refund requests: https://support.apple.com/118223.
Additionally, you can offer to schedule account deletion for a later date, aligned with the subscription's expiration, as long as there's also an option to delete the account immediately.
Auth is usually wired through Supabase, Firebase Auth, or Clerk, and the SDK ships a `signOut()` method that's easy to mistake for account deletion in a quick implementation. `signOut()` clears the local session; the account record and its data are untouched on the server. A reviewer testing this will sign back in with the same credentials and find the account still exists -- that's the rejection, every time.
If your app also offers a subscription, the deletion flow needs to say what happens to billing: Apple's own account-deletion guidance calls this out directly, and `5.1.1(v)`'s neighboring `3.1.2` covers the subscription-disclosure side of the same screen.
Add a server-side delete path that removes the auth user and owned rows -- most auth providers' client SDKs deliberately can't delete a user themselves (that needs a service-role key), so this has to be a server function, not a client call. Then wire a "Delete Account" control in Settings that calls it, shows a confirmation naming what gets deleted, and if the app has a subscription, tells the user how billing is affected before they confirm.
Play requires the in-app path and a web-accessible account-deletion URL, submitted separately in Play Console. An iOS-first team that ships the in-app flow and stops there passes Apple and fails the Play Data safety review.
A Claude Code plugin for React Native and Expo. Reads your project and store listing, checks them against the live App Store Review Guidelines and Google Play policies -- the same corpus quoted on this page -- and tells you the clause, the reviewer's likely wording, and the fix.
/plugin marketplace add BakerVentures/shipcheck
Free scan on every app. See pricing →