Sometimes a submission is held by an automated message instead of a numbered guideline. In two of ours, automated analysis decided the app contains VPN functionality and asked in App Store Connect for answers to two questions: what user information does it collect, and for what purpose? One of them was a 1.0 and the app barely touches the network.
This is from our own submissions.
It is a questionnaire, not a rejection
It is cleared by supplying information, not by changing code. The best time to supply it is before you submit. It appears only after submission because the analysis reads signals, not your intent: linked frameworks, entitlements, strings in the binary. If the binary carries network-extension related capability it is a "machine with VPN functionality", even when a VPN is a side feature. Local build, tests and linting are green because no local gate asks "will this set of symbols trigger the review's VPN questionnaire?"
What to do, in order
- Answer exactly what is asked. It asks what is collected and why; organize the answer around those two. "We take privacy very seriously" answers neither.
- Scan the build before you write.
otool -Lshows which network-related frameworks are linked.codesign -d --entitlementsshows whether there is a network-extension or personal-VPN entitlement.grepthe localized strings for the keyword. If you can write "framework not linked, entitlement not present", that is a checkable fact. A promise like "we don't do that" is only a feeling. - Put the answer where the message points. Reply to the message, and also write it into App Review Information. If you only reply, the next person who reads the notes will not see it.
- Remove removable triggers. A framework linked but unused, a stale entitlement, leftover copy: delete it rather than explain around it. If the trigger stays, the next version receives the same question. Listing the network capabilities your binary carries, and asking of each whether it bears load, is the cheapest way never to be named by this questionnaire.
- Align with your privacy declaration. Say what the channel can see, what for, whether it is kept and where it goes. A questionnaire answer that contradicts your privacy label is worse than admitting the collection.
One-minute check
Before uploading, search the project for NEVPNManager, NETunnelProvider and any VPN entitlement, and run step 2 on the build you will upload. Every network capability you cannot explain is a review question that has not been sent yet.
These notes are from Obelisk Club's own submissions. Apple's process changes; check your own message and the current App Review Guidelines.