Getting an app onto the App Store in 2026 takes an enrolled developer account, a build made with the current tools, a complete App Store Connect record and an app that passes a human review against Apple's guidelines. None of it is difficult, but each step has requirements that changed recently, and the order matters. This is the sequence we follow for client launches.
1. Enrol in the Apple Developer Program
Membership costs US$99 a year. As with Google Play, the choice between enrolling as an individual and as an organisation decides whose name appears as the seller and who owns the app:
| Individual | Organisation | |
|---|---|---|
| Seller name on the App Store | Your personal name | The organisation's legal name |
| What enrolment needs | An Apple Account with two-factor authentication and identity details | A D-U-N-S number, legal entity status, a public website and the authority to bind the organisation |
| Team members | Just you | Roles for developers, marketers and finance |
For a business, enrol the business. An app published from a developer's or agency's personal account belongs, in practice, to that account; moving it later is possible but slow. The ownership questions are the same ones we covered in source code, data ownership and handover.
2. Build requirements in 2026
- Xcode 26 and the 26 SDKs. Since 28 April 2026, apps uploaded to App Store Connect must be built with Xcode 26 or later, using the iOS 26 and iPadOS 26 SDKs (and the matching SDKs for other platforms). Building with the new SDK applies the new system look to standard interface components by default, so test the interface after upgrading rather than assuming it is unchanged.
- Privacy manifests. Apps and third-party SDKs that use APIs Apple classes as "required reason" APIs must declare an approved reason in a privacy manifest, and SDKs on Apple's list of commonly used third-party SDKs must include their own manifest and signature. Missing declarations are flagged when you upload.
- Purpose strings. Every permission the app requests needs a specific, honest explanation in its Info.plist text. "This app needs your location" is not an explanation.
- Encryption. Answer the export compliance questions; if the app uses only exempt encryption, declaring it in the Info.plist saves answering on every build.
3. The App Store Connect record
| Item | Notes |
|---|---|
| App name and subtitle | Up to 30 characters each; no references to other apps or pricing |
| Keywords | Up to 100 characters; no competitor names or irrelevant terms |
| Promotional text and description | Up to 170 and 4,000 characters; promotional text can change without a new submission |
| Screenshots | Up to 10 per size; supply the largest iPhone size and let smaller sizes scale from it; supply iPad screenshots if the app runs on iPad; show the actual app in use |
| Age rating | Apple's updated questionnaire and ratings (4+, 9+, 13+, 16+ and 18+) apply; developers had to answer the new questions by 31 January 2026 to keep submitting updates |
| App Privacy details | The privacy "label": which data is collected, whether it is linked to the user, and whether it is used for tracking |
| Privacy policy and support URLs | Both live, both specific to the app |
| Trader status (European Union) | Since February 2025, apps whose developers have not provided trader status information are not available on the EU storefronts |
| App Review information | A working demo account (or a built-in demo mode), contact details and notes explaining anything that is not obvious: hardware, locations, test data |
4. What reviewers check first
Beyond crashes and placeholder content, these requirements catch more apps than any others:
- Account deletion (guideline 5.1.1(v)). An app that lets users create an account must let them start deleting it inside the app, not only by email.
- Login options (guideline 4.8). An app that offers third-party or social login must also offer an equivalent option that limits data collection to name and email, lets users keep their email private, and does not track them for advertising without consent. Sign in with Apple meets these conditions. Apps that use only their own account system are not affected.
- Digital purchases (guideline 3.1). Digital content and features unlocked in the app use in-app purchase; physical goods and services consumed outside the app use other payment methods. Several storefronts, including the United States, the European Union and Japan, now have storefront-specific payment options, so check the current terms for each storefront you sell in before designing the payment flow.
- User-generated content (guideline 1.2). Apps with user content need filtering, reporting, blocking and published contact information; since February 2026 this explicitly includes random and anonymous chat.
- Personal data and AI (guideline 5.1.2(i)). Sharing personal data with third parties, including third-party AI services, needs clear disclosure and explicit permission.
- Real-money games (guideline 5.3). Real-money gaming apps need the licences for every location where they are used, must be geo-restricted to those locations, and must be free on the App Store; in-app purchase cannot be used to buy credit for real-money play.
5. TestFlight
TestFlight distributes builds to up to 100 internal testers from your team and up to 10,000 external testers. The first build for external testers goes through a short beta review. External testing is the cheapest way to find the problems App Review would otherwise find for you, and the feedback is useful in the same way as a formal acceptance test (acceptance testing and sign-off).
6. Review and release
Apple says that, on average, 90% of submissions are reviewed in less than 24 hours. First submissions, apps in sensitive categories and busy periods take longer, so plan for a few days and for at least one rejection on a first submission. Three release controls help:
- Manual release holds an approved version until you publish it.
- Phased release rolls an update out to users with automatic updates over seven days, and can be paused.
- Expedited review can be requested for a critical bug fix or a time-sensitive event; it is a request, not a right, and should be used rarely.
When a submission is rejected, the message in App Store Connect cites the guideline. Reply there if something needs explaining, fix and resubmit if it does not. The recurring reasons are in the predictable rejections, and the Google Play equivalents in Google Play policy violations.
7. The checklist
- Organisation enrolment in the business's name; D-U-N-S requested early
- Build made with Xcode 26 and the 26 SDKs; interface retested after the upgrade
- Privacy manifest complete for the app and every SDK
- Purpose strings written for every permission
- Name, subtitle, keywords and description within limits and free of competitor references
- Screenshots at the required sizes showing the real app
- Updated age rating questionnaire answered
- App Privacy details matching the app and its SDKs
- Account deletion inside the app, if accounts exist
- Equivalent privacy-focused login option, if third-party login is offered
- Payment flows checked against guideline 3.1 for each storefront
- Demo account and review notes supplied
- External TestFlight round completed; manual release selected for the first version
Related Manboo Services
- Android App Development, including Play Console set-up, release tracks and policy declarations.
- iOS App Development, including App Store Connect, TestFlight and App Review preparation.
- Flutter App Development when one codebase must pass both stores' reviews.
- Software Maintenance for existing apps that need target API, SDK or policy updates.
- Request a scope review and estimate for a store launch or a rejected submission.