- Home
- Rejection types
- Guideline 5.1.1
Guideline 5.1.1: "Data Collection and Storage"
Apple's privacy guideline. It covers four things that trip up almost every AI-built app: a privacy policy that's missing, a login that's required for no reason, no way to delete an account, and permission requests that don't say why.
We noticed that your app requires users to register or log in before they can access features that are not account-based.
Next steps: Please revise your app to let users freely access your app's non-account-based features.
What this rejection means
Guideline 5.1.1 is about respect for the person using the app: tell them what you collect, don't collect more than you need, don't make them sign up unless there's a reason, and let them leave. The message will point at one of these:
- Privacy policy. There is no privacy policy link in the app, or in the store listing, or the link goes to a page that isn't a privacy policy.
- Login without need. The app makes people create an account before showing anything, even the parts that don't need one.
- Account deletion. People can create an account in the app but can't delete it from inside the app.
- Permissions and purpose strings. The app asks for the camera, photos, location, contacts or microphone, and the explanation shown to the user is missing, vague, or the app doesn't use what it asks for.
- Consent for data collection. The app tracks or collects data without asking first.
Each of these is concrete and Apple is consistent about them. They are rarely a judgment call, which is good news for fixing them.
Why apps built with AI tools get this so often
AI builders add login first and ask questions later. A privacy policy is nobody's favorite screen. And the defaults that come with a generated app are written for the web, where none of these rules exist.
- Everything is behind a loginThe builder put authentication on day one, so even the home screen needs an account. Apple sees a wall where there should be a front door.
- No privacy policy, or a placeholder oneGenerated projects ship with a "Privacy Policy" page that says "coming soon", or no page at all, while the backend quietly stores emails and usage.
- Accounts you can create but never deleteSign-up is one prompt away in any AI tool. Deleting an account, with everything that goes with it, almost never gets built.
- Default permission textWrappers and templates ship with generic or empty explanations for camera, photo and location access, or ask for things the app doesn't use.
- Analytics added without askingA tracking script that was fine on the website becomes "collecting data without consent" inside an app.
What Apple is actually asking for
"All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner."App Store Review Guidelines, 5.1.1(i) — developer.apple.com
The rest of the guideline follows the same spirit. The privacy policy has to be real and reachable from inside the app. People should be able to use the parts of the app that don't depend on an account without creating one. If they can sign up, they must be able to delete the account from inside the app, not by emailing you. And every permission the app asks for needs an honest, specific reason that the app actually lives up to.
Apple applies these rules to every app, including tiny ones that "don't really collect anything". If there is a login, there is data.
What we fix
We check your app against every part of 5.1.1, not only the one in the message, because reviewers tend to find the next one on the next round. The usual issues:
We make the changes inside your project and your own developer account, and the app is resubmitted from your account. If you don't have a privacy policy yet, we tell you exactly what yours needs to cover and get it in place as part of the fix.
How long it takes
Most 5.1.1 fixes are quick. Account deletion is the biggest piece when it's needed, because it touches your backend as well as the app.
- Day 0You share your project and the rejectionA share link or invite from your builder, plus an invite to your developer account.
- Day 1We check every part of 5.1.1You get a short list of what's missing, in plain English, in your dashboard.
- Days 1–4We make the changesPolicy and permission fixes are usually done in a day or two. Account deletion can take a few days more.
- ThenResubmitted from your accountApple reviews it again, usually within one to three days.
- DoneApproved, or we go againUnlimited resubmissions are included. Full refund if it is never approved.
What happens if you ignore it
Your submission stays rejected. There is no penalty for a first privacy rejection, but these rules also apply to apps that are already live: Apple can remove an app later for a missing privacy policy or a missing account-deletion option, and it does. Updates to a live app get checked against 5.1.1 every time.
There is also a legal side that has nothing to do with Apple. If your app collects emails or usage data from people in Europe, California or many other places, you need a privacy policy anyway. Apple is just the first one to check.
Questions about Guideline 5.1.1
My app doesn't collect anything. Do I still need a privacy policy?
Yes. Apple requires a privacy policy for every app, including ones that collect nothing. A short, honest policy that says so is enough. And if your app has a login, it does collect something.
Why does Apple care that people can delete their account?
Because creating an account takes seconds and leaving should too. Since 2022 Apple requires apps that offer account creation to also offer account deletion from inside the app, not just by email or on a website.
Can I keep the login required?
If the whole app is genuinely account-based, like a banking app or a team tool, yes. If there are parts people could use without an account, Apple wants those parts open. We tell you which applies to your app.
Will you write my privacy policy?
We tell you what it needs to say based on what your app actually does, and we make sure a real policy is linked in the app and in your listing. For legal wording specific to your business you may want a lawyer; for getting approved, this is enough.
What is a "purpose string"?
It's the sentence people see when your app asks for the camera, photos, location and so on. Apple requires it to be specific and true. Generic text, empty text, or asking for things the app doesn't use all lead to a 5.1.1 rejection.
Does Google Play have the same rules?
Very similar ones: a privacy policy, an accurate Data safety form, and account deletion for apps with sign-up. See our Google Play rejection page.
Privacy rejection? We'll close every gap.
Share your project in two minutes. We check your app against the whole guideline and fix it inside your own account.