Publishing your first app: the 2026 store checklist
Everything the App Store and Google Play ask for before your first release in 2026, from build requirements to the URLs reviewers open.
Shipping a first app is mostly paperwork. The code is done, and then App Store Connect and Play Console ask for a dozen things that have nothing to do with the code. This checklist walks through them in the order you will meet them, with the rules as they stand in October 2026.
Before you open either console
Get the accounts sorted first, because some of them take weeks.
- Apple Developer Program. An individual enrollment is quick. An organization needs a D-U-N-S number, and Apple uses that record for your legal name and address.
- Google Play Console. Organization accounts also need a D-U-N-S number, which is free and can take 30 days or more to issue. Personal accounts verify a legal name, an address, a phone, an email and a government ID.
- Google Play closed testing. If you have a personal account created after November 13, 2023, you cannot go straight to production. You need 12 testers opted in for 14 consecutive days first. We wrote a separate guide on closed testing because it catches almost everyone.
Build requirements
Both stores refuse a build that targets an old platform, no matter how good the app is.
- Apple: since April 28, 2026, uploads must be built with Xcode 26 or later using the iOS 26 SDK. Since September 9, 2026, iOS and iPadOS apps must target iOS 13 or later.
- Apple privacy manifest: if your app or one of its SDKs calls a "required reason" API, the reason must be declared in
PrivacyInfo.xcprivacy. App Store Connect has refused undeclared uses since May 2024. - Google Play: since August 31, 2026, new apps and updates must target Android 16 (API level 36). Wear OS, Automotive, TV and XR have lower targets.
The URLs reviewers open
This is where most first submissions stumble. Each store asks for public web addresses, and a reviewer actually opens them.
| What | App Store | Google Play |
|---|---|---|
| Privacy Policy URL | Required, and also linked inside the app | Required, and also linked inside the app |
| Support URL | Required, must lead to real contact information | Contact email required, website optional |
| Account deletion | Required inside the app if users can create accounts | Required inside the app and as a web link |
| Marketing URL | Optional | Optional (website field) |
A few details that cause rejections:
- The privacy policy must be a public page. A PDF, a page behind a login or a document whose sharing settings changed will be rejected. More in our guide to the privacy policy URL.
- Apple's support URL "must lead to actual contact information". A landing page with no email address on it does not count. See the support URL guide.
- Google asks for an account deletion link that works without reinstalling the app. See account deletion URL and our article on account deletion rules on both stores.
The forms about your data
Both stores ask you to describe what your app collects, and both compare that answer with your privacy policy.
- App Store: App Privacy details (the "nutrition label") are required for new apps and updates, and they include what your third-party SDKs collect.
- Google Play: the Data safety form is required for every published app, including apps that collect nothing.
The usual mistake is answering the form from memory while the policy says something else. Analytics, crash reporting, ads and sign-in SDKs all collect data. Our Data safety form guide lists the mismatches reviewers flag most often.
Ratings and compliance details
- Age rating, Apple: the questionnaire changed in 2025, with new 13+, 16+ and 18+ bands. Answer the updated questions under App Information.
- Content rating, Google: every app needs an IARC rating from the questionnaire in Play Console. Apps without one are removed.
- EU trader status, Apple: to distribute in the EU you must declare whether you are a trader under the Digital Services Act. Traders show an address, phone and email on their product page.
- AI features: if your app sends user data to an AI service, Apple expects you to say so and ask for consent. See AI in your privacy policy.
A short pre-flight list
Open each of these in a private browser window before you press submit:
- Your privacy policy URL loads without a login, as a web page.
- Your support URL shows an email address or a form.
- Your account deletion page explains how to delete the account and what happens to the data.
- The links inside the app point to the same pages.
- Your Data safety and App Privacy answers match what the policy says.
If one of them fails, our list of common rejection reasons explains what the reviewer will write back.
Where Lanpage fits
Lanpage publishes the pages from that table on stable URLs: a landing page, the Privacy Policy, Terms, support and account deletion, in one place you can edit without redeploying anything. The dashboard checklist tracks which of them your app still lacks, against the store rules we follow. Lanpage is not a law firm and cannot promise an approval. What it does is keep every link a reviewer opens online.
Create your app's pages for free and have the URLs ready before you open App Store Connect.