App launch checklist: 24 things to check before you launch an app
Sources checked
You probably already know your app needs hosting, a domain and some analytics. This checklist covers the other things: the rules and limits that catch people on their first launch and cost them days, money or an App Store rejection.
Each item names the rule and the reason it matters, and links the official page it comes from. It covers web apps and iPhone and Android apps, whichever tools you built them with.
Get this checklist by email
We'll email you a printable copy of all 24 items. If you like, we'll also tell you when one of these rules changes.
We send one email first to confirm your address. Every email has a one-click unsubscribe, and the privacy page lists what we keep.
Your developer accounts
Your Apple developer account, opened early
Apple's developer program costs $99 a year, and Apple checks who you are before you can publish anything, so open the account before your app is finished. Joining as a company needs a D-U-N-S number first, and Apple says to allow up to 5 business days for Dun & Bradstreet to issue it, then up to 2 more before Apple can see it.
Google Play makes new accounts test for 14 days first
A new personal Google Play account has to run a closed test with at least 12 testers, opted in for 14 days in a row, before it can publish to everyone. If you find this out on launch day, you launch at least 14 days later than you planned.
EU trader status, or no EU App Store
Apple asks every developer to declare whether they're a trader under EU law, and since February 17, 2025 apps without an answer have been removed from the App Store in the EU. If you declare as a trader, your address, phone number and email are shown on your app's EU store page.
Apple's lower fee only if you sign up for it
Apple takes 15% instead of its standard commission from developers who made up to 1 million US dollars in proceeds last year, through its App Store Small Business Program. You only get the lower rate after you enroll, and developers new to the App Store qualify too.
Sign-in, email and payments that only break for real users
Sign-up emails that reach people outside your team
Supabase's built-in email only delivers to members of your own project team, at 2 messages an hour. Your sign-ups work when you test them and then never arrive for real users, until you connect your own email service.
Google sign-in left in test mode
Google limits an app whose sign-in is still in test mode to 100 users, and each person's sign-in expires after 7 days. Everything looks fine with you and a few friends, and then it stops working for everyone else.
Google sign-in on apps installed from Google Play
Google Play signs the copy of your Android app that people download with a different key from the one your test builds use. If that key isn't registered with Google too, Google sign-in works on your phone and fails for everyone who installs from the store.
Sign-in links that still point at localhost
Login and confirmation links follow the addresses set in your sign-in provider, and Supabase starts with your laptop's address by default. If your live address isn't on that list, a new user taps the link in their email and lands on a page that doesn't exist.
A payment webhook for live payments
The webhook you tested with probably pointed at your laptop or used test mode, and Stripe gives live mode its own secret. If live payments don't reach your real address, people pay and never get what they paid for.
Hosting plans and surprise bills
A hosting plan that allows selling
Vercel's free Hobby plan is for personal, non-commercial use only. Once your app takes money, check that your host's plan allows it before your first customer pays.
Databases that go to sleep
Supabase will pause a project on its free plan after 7 days with little activity. That's easy to hit with an app that's waiting on App Review or hasn't found users yet, and the app is down until you wake the project up.
The database key in your app is public
The key your app uses to talk to Supabase or Firebase ships inside the app, so anyone can find it. Your database's access rules are the only thing between a stranger and your users' data, and it's easy to launch with them switched off or wide open.
AI features a stranger can run up
If your app calls a paid AI model and nothing limits how often, one person with a script can run up your bill overnight. Put a spending cap or a usage alert in place before launch, wherever your provider offers one.
App Review
A demo account for the reviewer
If your app has a login, Apple's reviewers need a working demo account, and your backend has to be on while they test. Without one, the review stops there and the app comes back rejected.
Permission before sending personal data to AI
If your app sends what people type or upload to an outside AI service, Apple's rules say you have to tell them and get their explicit permission first. That covers almost every app with an AI feature that handles personal data.
Account deletion inside the app
Apple requires any app that lets people create an account to also let them delete it from inside the app. Google Play also asks for a web page where people can request deletion, so it still works after they've uninstalled.
Sign in with Apple when you offer Google login
If your iPhone app lets people sign in with Google, Facebook or another service, Apple requires an equivalent option that limits the data it collects and lets people keep their email private. Sign in with Apple is one option that has these features.
A clear reason for every permission
When your app asks for the camera, photos or location, the popup has to explain exactly why, and Apple's review checks that the reason is clear and complete. On iPhone, an app that asks for one of these without a reason crashes the moment it asks.
Your app on an iPad
Apple's guidelines ask that iPhone apps run on iPad whenever possible, and if your app runs on iPad, the App Store also needs iPad screenshots. Look at it on an iPad before you submit, because that's where a layout built for phones usually breaks.
Privacy labels that include your tools' data
Apple and Google both make you answer a form about the data your app collects, and the answers show on your store page. They have to cover what your analytics, crash, login and ad tools collect, and not only what your own code does.
Apple's age rating questions
Every app answers Apple's age rating questions, and Apple rewrote them in 2025. Since September 2026 they also ask about social features like feeds of things other people post, and new apps and updates can't be submitted without the answers.
Apple's rules for selling inside the app
In most countries, anything people unlock inside an iPhone app has to go through Apple's in-app purchase, though apps in the US App Store can now also link out to pay on the web. You can't create an in-app purchase until Apple's Paid Apps Agreement is signed, and Apple expects a restore purchases button for people who switch phones.
Before your first real user
Backups you've restored once
A backup you've never restored is a guess. Restore one onto a spare copy once, so you know it works before the day you need it.
A privacy policy in the app and a real support page
Apple and Google both require a privacy policy link, even for apps that collect no data, and both want it inside the app too. Every App Store listing also needs a support link that leads to real contact details.
Questions people ask before they launch
- Google Play 12 testers for 14 days: the closed testing rule
- App Store account deletion requirement: Apple's in-app rule
- Is Vercel free for commercial use? No, Hobby is for personal use
- Privacy policy for an app that collects no data: still required
- App Store Small Business Program: 15% commission only if you enroll
- Apple EU trader status: declare it or leave the EU App Store
- D-U-N-S number for an Apple developer account: only for companies
- App Store rejection reasons: the ones that catch first apps