App Store review / Guidelines / 5.1.1
App Review Guideline · first-hand cases · checked Oct 24, 2026
Guideline 5.1.1: Data Collection and Storage (privacy policy)
Short answerGuideline 5.1.1 requires a privacy policy, linked in App Store Connect and inside the app, that says exactly what you collect and why, plus consent for any collection. We hit it twice on one app: Minder, whose cartoon eyes follow your face, had to put "one x/y face position from Apple's on-device Vision framework, never stored" in the policy itself, not just the reply. A week later the policy URL stopped loading and it was rejected again. Fixed in 6 minutes, approved 24.8 hours later.
“All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner.” Guideline 5.1.1(i)
What it means
5.1.1(i) lists what the policy must say: what data, how it is collected, every use, who it is shared with, retention and deletion, and how to withdraw consent. Camera, microphone, location and face data draw the closest reading. The policy must load at review time: a dead link is a 5.1.1 rejection on its own.
What happened to us
First round (September 22): the reviewer asked what face data Minder collects, keeps and shares. We answered and updated the policy with the exact data point. Second round (September 29): the update was rejected because the privacy policy page was down. We fixed the hosting and resubmitted six minutes after the email.
Every case on our account (3)
| App | Type | Submitted | Decided | Wait | Outcome | What happened |
|---|---|---|---|---|---|---|
| Minder | New app | Sep 19, 2026 | Sep 22, 2026 | 73.9 h | Not approved | Asked exactly what face data the eye animation collects, keeps and shares |
| Minder | Update | Sep 26, 2026 | Sep 29, 2026 | 64.3 h | Not approved | Rejected again: the privacy policy URL itself had stopped loading |
| Minder | Update | Sep 28, 2026 | Sep 30, 2026 | 24.8 h | Approved | Approved 24.8 hours after a resubmit sent 6 minutes after the email |
Wait = from the "Submitted" time in the Apple email to the decision email. Source: our App Review decision emails.
What worked
- Name the exact data point and where it lives (on device, never stored, never sent).
- Check the privacy policy URL loads before every submission. One dead link cost us a full round.
If you got Guideline 5.1.1: do this
- Write the policy for this app, naming each data type and API (Vision, Camera, HealthKit).
- Link it in App Store Connect and inside the app (Settings).
- Match the App Privacy answers ("nutrition label") to the policy.
- Load the URL right before you press Submit.
Related
- Guideline 2.5.1: Public APIs, used for their intended purpose (HealthKit)
- Guideline 2.1: App Completeness (and "Information Needed")
- Guideline 1.4.1: Medical and health accuracy claims
- App Store review times, monthly report
- Every guideline and message we hit
Sources
- Apple App Review Guidelines, 5.1.1: developer.apple.com/app-store/review/guidelines/#5.1.1 (read Oct 24, 2026)
- Our decision data (every App Review email, CSV): tensorust.com/reports/app-store-review-times/2026-10/decisions.csv (through Oct 23, 2026)
Need the whole pipeline (signing, screenshots, review notes, fastlane submission from Windows)? Fixed-price iPhone app builds.
Up next
Often comes with this oneGuideline 2.5.1: Public APIs, used for their intended purpose (HealthKit)The next rule our apps ran into, with the cases and the fix.Read it next →Did this answer your question?