RejectProofRun the free check

Free check · No account · Built for Rork, a0, Bolt, Expo and first-time submitters

Know what Apple will reject — before you submit.

Drop your .ipa and get a guideline-by-guideline rejection report in under a minute. Every flagged item comes with the Apple guideline number, the evidence (which file, which string) and a plain-English fix for Expo, Rork, Bolt or Xcode.

See a sample report (30 sec)Email me the link for my MacSee a sample reportSee the 43 checks

Have the .ipa on this phone? Run the free check

10 free questions · 43 binary checks · Report in under a minute

Prefer the terminal? npx rejectproof MyApp.ipa npm · GitHub Action

Your IPA never leaves your browser. We only ever see a small JSON summary of what was found — never your binary.

  • Your IPA never leaves your browser
  • No account
  • One-time payment
  • Built by an iOS developer

Security & privacy

Your build stays on your machine.

Developers should not have to upload their builds to a random website. The scan runs inside a Web Worker in your tab, and the only thing that reaches our server is a few KB of JSON — which you inspect on screen before it is sent.

What we see

Sent only after you click “Send” — shown in full on screen first.

  • Info.plist key names

    Values are kept for a fixed allowlist of Apple keys (bundle id, version, usage texts). Every other value is replaced by “[redacted]”.

  • Keyword counters

    How many times each of our ~40 keywords (e.g. ATTrackingManager, SKPaymentQueue) appears in the main executable, plus a short snippet.

  • Embedded framework names

    The folder names under Frameworks/ — so we can spot ad/analytics SDKs that ship without a privacy manifest.

  • Privacy manifest & profile summary

    PrivacyInfo.xcprivacy keys, the profile’s team id, expiry and Apple entitlements. Custom entitlements are redacted.

What we never see

None of this exists on our server — there is no file-upload endpoint.

  • Your .ipa or .app binary

    It is unzipped and scanned in your browser. No upload, no chunking, no “temporary” copy.

  • Your source code or assets

    We match strings inside the executable locally and only send the counts.

  • Signing certificates, provisioning keys, private keys

    We read the profile’s expiry date and entitlements; the certificate blobs are never transmitted.

  • An account, a password, a stored file

    No signup. Nothing is retained after the scan except the JSON summary that powers your report link.

Verify it yourself: Open DevTools → Network while scanning. You will see exactly one POST with the JSON you approved — and nothing else.

Who this is for — and who it is not for

We would rather tell you now than after you paid.

Built for

  • Vibe-coders

    You built the app with Rork, a0, Bolt, or Expo + Claude Code / Cursor, and you have never opened an Info.plist.

  • First-time submitters

    You have an .ipa and no idea what App Review will look at first.

  • Indie iOS developers

    You know the guidelines but want a 60-second sanity check before every submission.

Not for

  • Android / Google Play

    v1 is iOS only. Drop an APK and we will tell you politely.

  • Design, content or business-model rejections

    Those are human judgement calls. We check the mechanical, preventable causes.

  • Anyone who wants “guaranteed approval”

    No tool can promise that. A clean report removes the avoidable rejections — nothing more.

How it works

Four steps. Payment comes after you have seen your free report.

  1. Free

    Step 1

    Drop your .ipa

    From Expo EAS, Xcode Archive, Rork, a0 or Bolt — it does not matter. The archive is opened in a Web Worker in your browser. Nothing is uploaded.

  2. Free

    Step 2

    Answer 10 questions, get a free report

    Account deletion, demo login, Sign in with Apple, privacy policy — the metadata-level things reviewers check first. Instant, no account.

  3. $12 / $39

    Step 3

    Unlock the full 43-point scan

    $12 for one app or $39 for five. Paddle secure checkout, no account. We then check privacy manifests, permission texts, Restore Purchases, ATT, provisioning and more.

  4. 3-day re-scan

    Step 4

    Fix, rebuild, re-scan free

    Every finding comes with a plain-English fix (plus Expo and Swift hints). Re-scan the same app as often as you need for 3 days at no extra cost. Your report link is emailed to you.

Run the free check

The 43 binary checks

Each one maps to an App Review guideline and comes with the evidence we found in your build plus a plain-English fix.

Privacy 15

Guidelines 5.1.1 · 5.1.2

Purchases 2

Guideline 3.1.1

Sign-in 1

Guideline 4.8

Provisioning 2

Code signing

Runtime & metadata 8

Guidelines 2.5.2 · 4.2 · 2.3 · Export compliance

Declared but unused 5

Guidelines 5.1.1 · 2.5.1 · 2.5.4

App completeness — crashes & dead links 6

Guideline 2.1 · 2.4.1

Apple's automated binary check 2

ITMS-90338 · ITMS-90809

Judgment-call risks 2

Guidelines 4.3 · 5.1.1(v)

Every rule shows the date it was last verified against Apple’s current App Store Review Guidelines (currently 2026-09-16). Apple changes guidelines; when a rule is re-checked, the date updates. Plus 10 metadata questions in the free check.

What this catches — and what it cannot

Roughly half of App Store rejections come from things that are visible before you submit. That half is what RejectProof checks. The other half is judgment calls only a reviewer can make.

  • 2.1 App Completeness

    largest single cause

    Mostly checked

    Crash-on-launch risks (missing embedded framework, wrong architecture, iOS version mismatch), dead links, dev-server leftovers, placeholder content, iPad layout, demo account (survey).

  • 5.1.1 / 5.1.2 Privacy

    very common

    Checked

    Privacy manifest, permission strings vs real API use, ATT, required-reason APIs, account deletion, App Privacy label vs SDKs in the build.

  • 2.3 Metadata

    common

    Checked

    Other platform or app names, placeholder wording, pricing claims, field limits, promised features missing from the build — when you paste your listing.

  • ITMS-90338 / 90809 upload checks

    blocks upload

    Checked

    Non-public API symbols and UIWebView references that Apple's automated check rejects before a human looks.

  • 3.1.1 In-app purchases

    common

    Partly

    Missing Restore Purchases path, external payment links. Whether your paywall wording passes is a reviewer call.

  • 4.3 Spam / 4.2 Minimum functionality

    common

    Partly

    Template fingerprints and WebView-wrapper signals as warnings. The final call is subjective.

  • Design, content, safety (1.x, 4.x)

    remaining

    Not possible statically

    Reviewer judgment on your UI, content and value. No static scan can predict it — and we do not pretend to.

Simple, one-time pricing

No subscription. Pay for a report when you need one — after you have seen your free report.

Free check

$0

no account

  • 10-question metadata review
  • App name, bundle id, version read from your build
  • Instant, no account
Run the free check

One app

$12

one app · 3 days of re-scans · one-time

  • Full 43-point scan of the build
  • Guideline number + evidence + fix for every item
  • Unlimited re-scans of the same app for 3 days — fix, rebuild, confirm
  • Permanent report link by email
Unlock for $12

Secure checkout by Paddle

Best value

Five apps

$39

5 apps · $7.80 each · one-time

  • Everything in One app, for 5 different apps
  • 3 days of re-scans per app
  • Credits never expire
  • Best for freelancers & agencies
Get 5 for $39

Secure checkout by Paddle

Studio

$99

20 apps · $4.95 each · one-time

  • Everything in One app, for 20 different apps
  • 3 days of re-scans per app
  • Credits never expire, shared by one email
  • For agencies and app studios shipping every week
Get 20 for $99

Secure checkout by Paddle

Rejection guarantee

If Apple rejects the build you scanned for something on our checklist that your report marked as passing, you get a full refund.

  • One-time payment, no subscription
  • VAT handled at checkout by Paddle
  • Receipt and report link by email

Payment happens after you see your free report. Orders are processed by Paddle.com as merchant of record; your card details never touch our server.

Questions

Is my app file actually being uploaded to your servers?

No. The .ipa is opened locally in your browser: a Web Worker reads the zip index, inflates only Info.plist, PrivacyInfo.xcprivacy and embedded.mobileprovision, and streams the main executable through a keyword matcher. The only thing sent to our server is a small JSON summary — typically 2–20 KB: Info.plist key names (values of unknown keys are replaced by “[redacted]”, so ad-network ids, Maps keys or custom API keys never leave), how many times each of our keywords appears in the binary, and the names of embedded frameworks. Before it is sent, you see that exact JSON on screen and confirm; you can also watch the request in DevTools → Network.

Where do I even get my .ipa file?

Expo/EAS: run `eas build --platform ios` and download the build from the EAS dashboard or the link it prints. Xcode: Product → Archive, then Distribute App → Export, and use the exported .ipa or zip the .app. Rork/a0/Bolt: use the “Export” or “Download build” option in your project settings — if you cannot find it, check their docs; some tools submit directly to Apple without giving you a downloadable file (in that case the free 10-question check still works without a file).

If I pass all 43 checks, is my app guaranteed to be approved?

No. We check the causes behind the majority of rejections we could find evidence for, but App Review also includes human judgement calls (design quality, content policy, business-model fit) that no automated tool can predict. What we do guarantee: if Apple rejects the build you scanned for something on our checklist that your report marked as passing, you get a full refund.

Do you support Android / Google Play?

Not yet. v1 is iOS / IPA only. If there is enough demand we will consider it for v2 — tell us if you need it.

I fixed things — do I pay again?

No. One credit covers one app (bundle id) for 3 days: re-scan as often as you need while you fix things. After 3 days, or for a different app, a new credit is used. Unused credits never expire.

How does payment work? Do I need an account?

No account. After your free report you enter an email, pick One app ($12), Five apps ($39) or Studio ($99, 20 apps) and pay in a Paddle overlay — card, PayPal or Apple Pay depending on your country. Paddle is the merchant of record, handles VAT / sales tax and emails your receipt. Credits are attached to the email you entered; the report link is emailed to the same address.

What is your refund policy?

If the scanner fails to produce a report for your file (a technical error on our side), email support@rejectproof.com within 14 days for a full refund. We do not refund because you fixed everything we flagged and Apple still rejected you for something outside our checklist — see the guarantee question above. Full policy in the footer.

Find out what Apple will flag — before they do.

Free 10-question check. No account. Your build never leaves your browser.

Run the free check