# Apple App Store

iOS is the closer of the two stores. The code-side blockers are largely closed;
what remains is App Store Connect metadata and preparing for a biometric-AI
review.

## Legal & privacy

| Item | Status | Notes |
|---|---|---|
| Privacy policy hosted | Done (verify live) | `/privacy` + `/terms` served by the backend; confirm the **shipped** `onrender.com/privacy` URL returns 200 |
| Privacy URL entered in App Store Connect | Open (manual) | Console action |
| App Privacy "nutrition label" | Open (manual) | Declare Photos, Health & Fitness, User ID, Email, Name, Purchase history, Crash data — **and add PostHog analytics + session replay** |
| In-app account deletion (5.1.1(v)) | Done | `DELETE /api/account` + type-to-confirm UI; deletes Supabase files + biometric fields + consent; orders anonymized and retained per law |
| Support URL | Open / unknown | App Store Connect requires one; hosting unverified |
| BIPA / biometric disclosure | Done | Canonical consent in `legalText.ts`, enforced backend-side |

## Sign in with Apple (Guideline 4.8)

**Not required.** A grep of the app finds **zero** Google/Facebook/Apple/OAuth
social login — Drape uses email/password + MongoDB JWT only. Sign in with Apple is
only triggered by a third-party social login, which does not exist here.

## Technical

| Item | Status | Notes |
|---|---|---|
| Global error boundary | Done | Exported `ErrorBoundary` in `_layout.tsx` + Sentry capture (the functional equivalent of `app/+error.tsx`) |
| Crash-free launch | Likely done, needs device test | `body-photo.tsx` crash fixed; physical-device pass still pending |
| Orientation lock | Done | portrait in app.json + Info.plist |
| App icon 1024×1024 | Done | `icon.png` and `adaptive-icon.png` both 1024² |
| Sentry DSN in EAS secrets | **Verify** | Crash reporting is DSN-gated — if the secret is missing, it is silently off in production |
| Honest loading / no infinite spinner | Done | "Usually 1–2 minutes" copy + 3-minute timeout + error UI |

## Review scrutiny to prepare for

Body photos are sensitive biometric data, so expect enhanced review under
Guidelines 5.1.1 / 5.1.2. Prepare, as review notes rather than code changes:

- **Consent and processing story** — the BIPA consent names Fashn.ai / fal.ai; the
  body photo is fetched server-side and never accepted from the client.
- **Retention answer** — account duration plus a short window; not used for model
  training.
- **A working reviewer demo account** with a pre-loaded body photo and consent —
  verify it is live in production before each submission.
- **Age rating 12+** with "18+ required" language in onboarding and the
  description (BIPA self-attestation is 18+).
- **Screenshots** that show completed renders (not loading states), partner brands
  only, and neutral body photos.

:::warning[Upload moderation gap]
There is no content moderation or file-size limit on body-photo upload today. It
is a P1 review risk — mitigate with a Terms reference at the upload step and an
explanation in the App Review notes.
:::

## iOS remaining, in order

1. Enter the App Privacy label (with PostHog data), privacy URL, and support URL.
2. Verify the Sentry EAS secret.
3. Disable session replay in the production profile (see
   [shipping overview](./overview.md)).
4. Device-test a crash-free launch and a real try-on; confirm the demo account.
5. Set the age rating and add 18+ language.
6. Finalize screenshots and non-spammy copy.