---
title: "Mobile apps checklist: all 35 rules ยท Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/checklist
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---
# Mobile apps checklist
For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Mobile apps](https://agentwranglers.se/playbook/mobile-apps.md).
By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.
Every rule in the mobile apps playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact).
**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers mobile apps playbook`. In code you write, add a comment next to it with the same link.
## Store review and listing
- [ ] MOB-3 **Required** [Let people delete their account inside the app](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/in-app-account-deletion): An app that lets people create an account also lets them start deleting it inside the app. Publish a web page for the same request, as Google Play asks for one.
- [ ] MOB-4 **Required** [Sell digital goods through the store's billing](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/store-billing): Unlock digital features and content in the app only through the store's in-app purchase. Physical goods and services used outside the app use your own checkout.
- [ ] MOB-5 **Required** [Verify every store purchase on your server](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/verify-store-purchases): Grant paid access only after your server has checked the purchase with the store's server API. Keep it current from the store's server notifications.
- [ ] MOB-1 **Recommended** [Give reviewers a working demo account](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/demo-account): Every submission behind a sign-in carries a demo account, or a full demo mode, in the review notes. The backend it talks to is live during review.
- [ ] MOB-2 **Recommended** [Describe every change in the review notes](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/review-notes): List each new feature and changed flow in the review notes, with the steps to reach it. Ship no hidden or dormant features.
- [ ] MOB-6 **Recommended** [Offer a private sign-in next to social sign-in](https://agentwranglers.se/playbook/mobile-apps/store-review-and-listing/private-sign-in-option): An iOS app with a third-party login, such as Google, also offers a login that shares only name and email. That login lets people hide their email.
## Signing and release
- [ ] MOB-7 **Required** [Let the store hold the signing key and back up the upload key](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/signing-keys): Use Play App Signing so Google holds the Android app signing key. Keep the upload key and its passwords in a secrets store with a second copy offline.
- [ ] MOB-8 **Recommended** [Sign release builds only in CI](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/sign-in-ci): Build and sign every store upload in CI, with keys read from the secrets store at build time. No developer laptop signs a release.
- [ ] MOB-9 **Recommended** [Raise the build number on every upload](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/build-numbers): Give every store upload a build number higher than the last one, taken from CI. Keep the version people see separate from the build number.
- [ ] MOB-10 **Recommended** [Test every build with internal testers first](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/internal-testing): Send every release candidate to an internal test group through TestFlight and the Play internal testing track before you submit it for review.
- [ ] MOB-11 **Recommended** [Release to a share of users first](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/phased-release): Release every update with Apple's phased release and a Google Play staged rollout. Stop the rollout when crash or error rates rise.
- [ ] MOB-12 **Recommended** [Plan to fix forward](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/fix-forward): Keep a fix path that does not need a store rollback, because installed builds stay on phones. Every risky feature ships behind a flag the server can turn off.
## Updates and versions
- [ ] MOB-13 **Required** [Keep old app versions working against the API](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/old-versions-keep-working): Every app version you still support works against every API release. A server change never breaks a supported build that people have not updated.
- [ ] MOB-18 **Required** [Sign over-the-air updates and match them to the native build](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/signed-over-the-air-updates): The app runs a downloaded code bundle only when its signature checks against a public key built into the app. Each bundle names the native build it was made for.
- [ ] MOB-14 **Recommended** [Stop versions you no longer support](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/minimum-version): Keep the lowest supported app version on the server and check it at every app start. Below it, the app shows one screen with a link to the store.
- [ ] MOB-15 **Recommended** [Build with the SDK the stores require](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/store-sdk-deadlines): Track each store's build and target deadlines in your release calendar. Move to the new SDK at least 60 days before the date.
- [ ] MOB-16 **Recommended** [Choose the lowest OS version from your users' data](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/minimum-os-version): Set the lowest supported iOS and Android versions from your own usage numbers. Review them once a year, and announce a drop 30 days ahead.
- [ ] MOB-17 **Recommended** [Ship over-the-air updates only within store rules](https://agentwranglers.se/playbook/mobile-apps/updates-and-versions/over-the-air-limits): Use over-the-air updates only for interpreted code and assets that fix or adjust existing features. New features go through store review.
## Data on the device
- [ ] MOB-19 **Required** [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore): Store session tokens, refresh tokens and keys only in the iOS Keychain or behind a key in the Android Keystore. Never in plain preferences, files or JavaScript storage.
- [ ] MOB-20 **Required** [Ship no secrets in the app package](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-secrets-in-app): The app package holds no secret keys, passwords or private certificates. Anything the app needs that must stay secret lives behind your own server.
- [ ] MOB-21 **Recommended** [Check that requests come from your app](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/app-attestation): Send an attestation token from App Attest or Play Integrity with calls that cost money or unlock content. The server refuses calls without a valid token.
- [ ] MOB-22 **Recommended** [Keep secrets out of device backups](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/backup-exclusions): Exclude tokens, keys and caches of personal data from cloud backups and device transfers. Keep what the person made, so a new phone restores it.
- [ ] MOB-23 **Recommended** [Keep personal data out of device logs](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-personal-data-in-device-logs): Release builds write no tokens, passwords or personal data to the system log or to log files. Debug logging is compiled out of release builds.
- [ ] MOB-24 **Recommended** [Encrypt local data that holds personal data](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/encrypted-local-data): Keep personal data only in the app's private storage, with the platform's file protection on. Encrypt databases of health, money or messages with a key from the Keystore or Keychain.
- [ ] MOB-25 **Recommended** [Wipe local data at sign-out](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/wipe-on-sign-out): Signing out removes the person's tokens, local database, caches and files from the phone. The next person to sign in sees none of it.
- [ ] MOB-26 **Recommended** [Queue offline changes and resolve conflicts on the server](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/offline-sync): Save changes made offline in a local queue and send them in order when the network returns. Each change carries an idempotency key and the version it was based on.
## Privacy declarations
- [ ] MOB-27 **Required** [Fill in the store privacy forms from an SDK list](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/store-privacy-forms): Answer Apple's App Privacy questions and Google Play's Data safety form from a list of every SDK in the build. Update both forms in the same release that changes what is collected.
- [ ] MOB-29 **Required** [Ask before any tracking](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/tracking-permission): Link no data with other companies' data for ads, and read no advertising ID, until the person allows tracking. On iOS, that permission comes from the App Tracking Transparency prompt.
- [ ] MOB-28 **Recommended** [Declare required reason APIs in a privacy manifest](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/privacy-manifest): Ship a `PrivacyInfo.xcprivacy` file in the iOS app that lists each required reason API the app's own code uses, with an approved reason. Use SDK versions that carry their own manifest.
- [ ] MOB-30 **Recommended** [Ask for each permission when the feature needs it](https://agentwranglers.se/playbook/mobile-apps/privacy-declarations/permission-in-context): Ask for camera, location, contacts and other permissions at the moment a feature needs them, never at first launch. Each iOS purpose string says what the data is used for.
## Crashes and quality
- [ ] MOB-34 **Required** [Test every screen with VoiceOver and TalkBack](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/screen-reader-tests): Every control has a spoken label, role and state, and every main flow works with VoiceOver and TalkBack. Automated accessibility checks run in the UI tests of every build.
- [ ] MOB-31 **Recommended** [Upload symbols for every build](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/crash-symbols): Report crashes from every release build to a crash service. Upload that build's dSYM files and R8 or ProGuard mapping files in the same CI job.
- [ ] MOB-32 **Recommended** [Stay under the store's crash and freeze limits](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/vitals-thresholds): Keep the share of daily users who see a crash below 1.09%, and a freeze (ANR) below 0.47%. Halt a rollout that passes either.
- [ ] MOB-33 **Recommended** [Keep cold start under a set budget](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/startup-budget): Set a time to first screen budget for a cold start on a mid-range test phone, such as 2 seconds. A benchmark in CI fails the build when a change passes it.
- [ ] MOB-35 **Recommended** [Follow the system text size](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/system-text-size): All text scales with the person's text size setting, up to 200%, without being cut off or overlapping. Layouts reflow instead of shrinking text back.
## Show the badge on your project
When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.
```html
```
```markdown
[](https://agentwranglers.se/playbook/mobile-apps/checklist)
```