PutThrough Product engineering studio
Book a build call

Service 02

Mobile and App Store launch

Your app packaged, compliant and submitted — through review, not just uploaded.

Prefer to write? Send your requirements

A web app and a shipped mobile app are separated by more work than most founders are told. Packaging is the easy part. What takes the time is the compliance surface: the SDK floors Apple and Google raise every year, the privacy declarations, the review guidelines that reject a wrapper with no native value. We take an app from working-in-a-browser to live in both stores, and we stay on it through the review cycle.

Packaging

  • Expo, Capacitor or native — chosen for your app, with the reasoning written down
  • Native shell, splash, icons, deep links and universal links
  • Push notifications, wired to your backend and tested on real devices
  • In-app purchase and subscription wiring where the stores require it
  • Offline and poor-network behavior, which review actively tests for

Store compliance

  • Android target API 36, and the edge-to-edge and orientation changes it forces
  • iOS 26 SDK build requirement and the UI regressions it introduces
  • Privacy manifests, required-reason APIs and third-party SDK declarations
  • Play Data Safety and App Store privacy questionnaires, completed accurately
  • Age rating, content declarations and in-app account deletion

Submission

  • Signing, provisioning and release track setup on both stores
  • Store listing metadata and screenshot specifications
  • Submission, and a written response to each review rejection until it is resolved
  • Staged rollout and a release process you can run yourself afterwards

Afterwards

  • Crash reporting and release health monitoring
  • A written release runbook for your team
  • Store deadline tracking, if you take a care retainer

Works with

  • Expo
  • React Native
  • Capacitor
  • Flutter
  • Swift / SwiftUI
  • Kotlin / Jetpack Compose
  • App Store Connect
  • Google Play Console

What this is not

  • Approval is not guaranteed and cannot be. Apple and Google decide. We handle everything on our side of that line and keep responding until the app is through or the remaining objection is one only you can answer.
  • Developer account fees, store artwork and app design are yours.
  • A web app with no native purpose may be rejected for minimum functionality no matter how well it is packaged. If we think that is the risk, we tell you before you pay us, not after.

01Self-assessment

Signs you need this

Things that are either true of your situation or not. Any one of the first four is enough on its own.

  • Your submission has been rejected and the notice cites a guideline number you had to look up.
  • Play refused your upload before review, which means a target API level problem rather than a content one.
  • You are building with an Xcode older than 26, so App Store Connect will not accept the binary.
  • Your app lets people create an account but not delete it from inside the app.
  • Your data safety answers were filled in from memory rather than from the network calls the build makes.
  • You do not know which of your third-party SDKs ship privacy manifests.
  • Push notifications, deep links or in-app purchases work in the simulator and have not been tested on a real device with a release build.
  • You have a launch date and have not submitted yet, because review is days and can repeat.
  • Your app is a web view and nobody has asked whether it does anything a browser cannot.

02Approach

How we approach it

The deadlines are real, and two of them are live right now

Both stores raise their floors on a schedule, and missing one does not produce a warning — it produces a refusal at upload, before a human ever looks at your app.

Since 31 August 2026, new apps and updates submitted to Google Play must target Android 16, API level 36. Existing apps must target at least API 35 to stay available to new users on newer devices; below that they simply stop being offered to most of the market while appearing perfectly healthy in your console. Developers who requested one had until 1 November 2026 to comply.

On the Apple side, since 28 April 2026 App Store Connect rejects any app or update not built with the iOS 26 SDK, which in practice means Xcode 26 or later. Separately, and since May 2024, an app that does not declare its use of required-reason APIs in a privacy manifest is not accepted at all.

None of this is difficult. All of it is invisible until you try to ship, which is why it so often lands in the same week as a launch date.

Minimum functionality is the rejection people do not see coming

Apple’s guideline 4.2 says an app should offer something a website cannot. A web view in a native shell, with no capability beyond what a browser tab already gives, is the textbook case for refusal — and it is exactly what "wrap my app for the stores" produces if nobody thinks about it.

The mistake is treating this as a wording problem. Resubmitting the same build with a better description does not change the outcome, and each attempt costs a review cycle measured in days. The fix is architectural: the app has to do something native and do it visibly. Push notifications, biometric unlock, offline behavior, native share, camera or location where the product genuinely uses them.

We would rather have that conversation before you pay us. If an app has no plausible native purpose, we will say so, and the honest recommendation may be to stay on the web and spend the money on the product instead.

Your privacy answers are a claim, and they are checked against the binary

Both stores ask you to declare what data the app collects. Founders tend to fill these in from memory or from what they intended, and the answers then disagree with what the build actually sends. That mismatch is itself a policy violation, separate from whatever the collection was.

The declarations have to be written from an audit of the network calls the app really makes — including the ones your analytics SDK, crash reporter and advertising library make without being asked. On iOS this extends to privacy manifests for third-party SDKs and to required-reason declarations for a specific set of APIs that are commonly used for fingerprinting.

Both stores now also expect an app that lets people create an account to let them delete it from inside the app. It is a small piece of work that blocks submission entirely when missing.

The review loop, not the code, sets the timeline

A submission is not a deploy. It is a request, answered in days, that can come back with a guideline number and a screenshot. Planning a launch as though approval is instantaneous is how a date slips by a fortnight.

We plan for cycles rather than hoping for none: submit early, respond to each rejection in writing with the specific change made, and keep a staged rollout ready so the first release reaches a fraction of users while the crash reporting is watched. Three resubmission cycles inside thirty days are included in the price, which is a realistic number rather than an optimistic one.

The store review loop Build leads to submit, submit leads to review. Review either approves, reaching live, or rejects, returning to a fix step and back to submit. Each cycle takes days. Build Submit Review days, not hours Live Rejected — fix and resubmit Approved Up to three cycles inside thirty days are in the price
A submission is a request, not a deploy. Plan the launch date as the end of the review window rather than the start of it.

03Choices

Decisions you will have to make

Expo, Capacitor, or native?

Expo / React Native
You want one codebase, real native capability, and a JavaScript team. The default for most products.
Capacitor
You have a substantial existing web app you want to keep as the product, and you need a handful of native capabilities around it rather than a native feel throughout.
Native (Swift / Kotlin)
The product is the platform experience — heavy animation, background processing, deep OS integration — or you already have native teams.

Where we start Expo, unless something specific argues against it. It gives genuine native modules, over-the-air updates for JavaScript changes, and a build pipeline that does not require a Mac on every desk.

Both stores at once, or one first?

Both
You are cross-platform anyway and the extra work is compliance rather than code. Usually the right answer.
iOS first
Your audience skews heavily to iOS and you want the harder review out of the way before committing to a launch date.
Android first
You need to iterate quickly with testers; Play’s track system makes staged distribution easier to run.

Where we start Both, submitted together. The compliance work overlaps almost entirely, and splitting it means doing the thinking twice.

In-app purchase, or your existing web checkout?

In-app purchase
You are selling digital goods or subscriptions consumed inside the app. The stores require it, and they take a commission.
External payment
You are selling physical goods or real-world services, where store billing does not apply.

Where we start Follow the rule for what you actually sell. Digital subscriptions routed around store billing are one of the more reliable ways to get removed, and the rules on linking out are narrow and specific.

How much offline support?

Graceful degradation
The app needs the network to be useful. It should explain itself when offline rather than hang or crash. Cheap, and enough for most products.
Read-only cache
Users need to see recent data on a train. Moderate cost, no conflict resolution.
Full offline sync
Users create and edit while disconnected. Expensive, because conflict resolution is a product decision as much as a technical one.

Where we start Graceful degradation first. Reviewers test on a bad connection, so this is not optional — but full sync is a product feature with a product-sized price, and most apps do not need it.

04Price

What moves the price within the range

A store-ready mobile sprint is $2,500 to $4,000, and includes submission plus three resubmission cycles within thirty days. These are the factors that decide where it lands.

$2,500 from — range $2,500–$4,000 See what is included

Whether the app already exists natively

Packaging an existing web app is the cheap end. Adding real native capability to satisfy guideline 4.2 is the expensive end.

How many native capabilities are needed

Push alone is quick. Push plus biometrics plus in-app purchase plus offline is four separate integrations, each with its own permission flow and failure states.

In-app purchases

The single largest addition. Products, receipts, restore, refunds and sandbox testing on both stores.

Target SDK distance

An app already near the current floor is a bump. One several versions behind surfaces layout and permission changes that have to be fixed too.

Third-party SDKs

Each one needs its own privacy manifest and signature on iOS, and some older ones simply do not have them yet.

Backend readiness

Push needs a server that can send it; account deletion needs an endpoint that can perform it. Missing pieces are work.

Design assets

Icons, splash screens and store screenshots at every required size. Supplied is fast; produced from nothing is not.

Review outcomes

Three cycles are included. A product-level objection — rather than a technical one — can need a decision only you can make.

05Process

How a project runs

  1. Readiness review

    Two business days

    We assess the app against both stores’ current requirements and, candidly, against guideline 4.2. You get a written list of what is missing and what it will take.

    What we need
    Repository access and, if one exists, access to your store accounts.
    What you get
    A readiness report and a fixed price. This is the web + mobile audit.
  2. Build and integrate

    One to two weeks

    Packaging, native capabilities, SDK floors, and the layout changes the newer target level forces. Tested on physical devices rather than only a simulator.

    What we need
    Write access, and your Apple and Google developer accounts.
    What you get
    Installable builds on both platforms, on real hardware.
  3. Compliance and submission

    Three to five days

    Privacy manifests, data safety answers written from actual network calls, age rating, account deletion, listing metadata, signing and release tracks. Then we submit.

    What we need
    Store listing copy and artwork, or a decision to use ours as placeholders.
    What you get
    Both apps in review, with a written record of every declaration made.
  4. Review and release

    Days to weeks, store-dependent

    We respond to each rejection in writing with the specific change made, up to three cycles within thirty days. Then a staged rollout with crash reporting watched.

    What we need
    Quick decisions on anything that turns out to be a product question.
    What you get
    A live app on both stores and a release runbook you can use yourself.

06Deliverables

What you actually end up with

A readiness report

What is missing against both stores’ current requirements, what it will take, and a frank assessment against the minimum functionality guideline.

Builds on real devices

Installable on both platforms from early in the work, not only at the end — push, biometrics and purchases behave differently outside a simulator.

Completed declarations

Privacy manifests, required-reason API declarations, Play Data Safety and App Store privacy answers, all written from an audit of what the binary actually sends.

Store accounts configured

Signing, provisioning, release tracks and listing metadata, set up inside your own developer accounts.

A submission, and the replies

We submit and respond in writing to each rejection with the specific change made, up to three cycles within thirty days.

Crash and release health monitoring

Wired up before the first release, because you cannot hotfix a native binary and you need to know quickly.

A release runbook

The steps to cut a release yourself next time, written down, including the staged rollout.

07Stack

What we build it with

Mostly Expo and the two store consoles, plus whatever backend has to send the notifications and perform the account deletions the stores now require. Where an app is already native we work in Swift and Kotlin rather than proposing a rewrite.

App Primary here

Mobile

Expo unless the product is the platform experience. One codebase is worth a great deal when the maintenance bill outlasts the project.

We default to

  • React Native
  • Expo
  • EAS Build
  • Swift
  • Kotlin

We also work in

  • Capacitor
  • Flutter
  • SwiftUI
  • Jetpack Compose
  • Expo Router
  • React Navigation
  • Reanimated
  • MMKV
  • WatermelonDB
  • StoreKit
  • Google Play Billing
  • RevenueCat
  • APNs
  • Firebase Cloud Messaging
  • Expo Notifications
  • Fastlane
  • App Store Connect
  • Google Play Console
  • Detox
  • Maestro
  • Privacy manifests
Ops Primary here

Infrastructure and observability

Managed platforms until scale or cost argues otherwise. The parts we insist on are a deploy you can roll back and an error that reaches a human.

We default to

  • Vercel
  • Cloudflare
  • Docker
  • GitHub Actions
  • Sentry

We also work in

  • AWS
  • Cloudflare Workers
  • Cloudflare R2
  • Cloudflare D1
  • Fly.io
  • Railway
  • Render
  • Terraform
  • Nginx
  • Caddy
  • GitLab CI
  • Grafana
  • Prometheus
  • Axiom
  • Better Stack
  • Checkly
  • Uptime checks
  • Structured logging
  • Staged rollouts
  • Tested rollback
API Primary here

Backend and services

Boring, typed and synchronous until something measurably needs to be a queue. Most systems need fewer moving parts than they are given.

We default to

  • Node.js
  • Python
  • REST
  • tRPC
  • Background jobs
  • Queues

We also work in

  • Hono
  • Fastify
  • Express
  • NestJS
  • FastAPI
  • Django
  • GraphQL
  • OpenAPI
  • WebSockets
  • Server-sent events
  • BullMQ
  • Celery
  • Inngest
  • Trigger.dev
  • Cron and scheduled work
  • Stripe
  • Paddle
  • Razorpay
  • Resend
  • Postmark
  • Twilio
  • Webhooks in both directions
Web

Frontend and full-stack

TypeScript everywhere, and a framework that renders on the server unless the product is purely an application behind a login.

We default to

  • TypeScript
  • React
  • Next.js
  • Astro
  • Tailwind CSS
  • Vite

We also work in

  • JavaScript
  • Remix
  • SvelteKit
  • Vue 3
  • Nuxt
  • shadcn/ui
  • Radix UI
  • TanStack Query
  • TanStack Table
  • React Hook Form
  • Zod
  • Zustand
  • Redux Toolkit
  • Framer Motion
  • MDX
  • Storybook
  • Vitest
  • Playwright
  • Testing Library
  • ESLint
  • Prettier
  • Recharts
  • D3
Data

Databases and storage

Postgres unless there is a specific reason otherwise, migrations in the repository, and a restore that has been executed rather than merely configured.

We default to

  • Postgres
  • Supabase
  • Redis
  • Migrations
  • Backups and restore

We also work in

  • Neon
  • PlanetScale
  • MySQL
  • SQLite
  • Turso
  • Firebase Firestore
  • Upstash
  • Drizzle ORM
  • Prisma
  • Kysely
  • pgvector
  • Row-level security
  • Point-in-time recovery
  • Meilisearch
  • Typesense
  • Elasticsearch
  • S3
  • Cloudflare R2
  • Read replicas
  • Connection pooling
AI

AI systems

Hosted models behind an interface you can swap, with the eval set deciding which one you use this quarter rather than a contract.

We default to

  • Claude
  • OpenAI
  • MCP
  • Evals
  • Tracing
  • Cost control

We also work in

  • Gemini
  • OpenRouter
  • LiteLLM
  • Vercel AI SDK
  • Anthropic SDK
  • Tool and function calling
  • Structured output
  • Prompt caching
  • Batch APIs
  • Model routing
  • pgvector
  • Qdrant
  • Pinecone
  • Chroma
  • Hybrid retrieval and re-ranking
  • Langfuse
  • LangSmith
  • Braintrust
  • Helicone
  • Ollama
  • vLLM
  • OAuth 2.1 for MCP

Split into what we default to and what we also work in. If your system is outside this, tell us on the call — we would rather say no than learn a stack on your budget.

08Pitfalls

Mistakes we see most

Wrapping a web app with nothing native in it

This is Apple guideline 4.2, and it is the most common rejection for apps that came from a web builder. No amount of resubmission fixes it; the app has to do something a browser tab cannot.

Answering the data safety form from memory

The answers are checked against what the binary sends. Declaring no collection while an analytics SDK ships is a violation in its own right, independent of the collection.

Discovering the target SDK floor at upload

Play refuses the build before review. The upgrade then surfaces edge-to-edge layout and orientation changes that need real work, so it is not a one-line version bump.

Shipping without in-app account deletion

If people can create an account in your app, both stores expect them to be able to delete it from inside the app. It is small, and it blocks submission entirely.

Testing only in the simulator

Push notifications, biometrics, in-app purchase and deep links behave differently — or not at all — outside a real device on a release build.

Routing digital subscriptions around store billing

The rules on what you may link to are narrow and specific. Getting this wrong risks removal rather than rejection, which is considerably worse.

Planning the launch as though review is instant

It is a request answered in days that can come back asking for changes. Submit early and treat the date as the end of the review window, not the start of it.

09Honestly

When you should hire somebody else

  • Your product has no plausible reason to be an app. We will say so, and staying on the web is often the better spend.
  • You need a game. Real-time rendering and game engines are a different discipline.
  • You want a guarantee of approval. Nobody can give you one — Apple and Google decide, and any studio promising otherwise is selling you something they do not control.
  • You have not decided what the app is for. Compliance work on a moving product is the most expensive way to do it.

10Questions

Questions

Something we haven’t covered?

Ask on a call
01 Why was my app rejected from the App Store?

For apps built from a web codebase, by far the most common reason is guideline 4.2, minimum functionality — the app does not offer anything a website cannot. After that: privacy declarations that do not match what the binary sends, missing privacy manifests or required-reason API declarations, no in-app account deletion when the app allows sign-up, crashes or placeholder content under guideline 2.1, and using external payment for digital goods. The rejection notice gives you a guideline number, and that number tells you which of these it is.

02 What target API level does Google Play require now?

Since 31 August 2026, new apps and updates must target Android 16, API level 36. Existing apps must target at least API 35 to remain available to new users on devices running a newer Android version than the app targets — below that the app stays in the store but stops being offered to most new users, which is easy to miss because nothing looks broken. Developers who requested an extension had until 1 November 2026.

03 Do I need to rebuild with the iOS 26 SDK?

Yes, if you are submitting anything. Since 28 April 2026 App Store Connect will not accept an app or update that was not built with the iOS 26 SDK, which means Xcode 26 or later. The rebuild itself is usually straightforward; what takes the time is the interface changes the newer SDK applies to native components by default.

04 Can you guarantee my app will be approved?

No, and nobody can — approval is Apple’s decision and Google’s decision. What we cover is everything on our side of that line: packaging, SDK floors, privacy manifests, data safety answers, metadata, and a written response to each rejection until the app is through or the remaining objection is one only you can answer, such as the nature of the product itself. Three resubmission cycles within thirty days are included in the price.

05 How long does it take to get an app into the stores?

Two to three weeks of work, plus store review. Review is days rather than hours and can repeat. In practice we plan for a submission in week three and a live app somewhere between a few days and two weeks after that, depending on whether anything comes back.

06 Expo or native — which should I use?

Expo, unless something specific argues against it. It gives real native modules, over-the-air updates for JavaScript changes, and a build pipeline that does not need a Mac on every desk. Go native when the product is the platform experience — heavy animation, sustained background processing, deep OS integration — or when you already have native teams. Capacitor is worth considering when you have a large existing web app you intend to keep as the product.

07 Do I need in-app purchases?

If you sell digital goods or subscriptions consumed inside the app, yes, and the stores take a commission. If you sell physical goods or real-world services, store billing does not apply and you can use your own checkout. The rules on linking users out to an external payment page are narrow and specific, and getting them wrong risks removal rather than rejection.

08 What do you need from me to start?

Repository access, your Apple Developer and Google Play accounts (or a decision to create them), and store listing copy and artwork if you have it. If you do not have artwork we can ship placeholders to get through review and swap them later, but icons and screenshots at the required sizes are the most common thing that holds up a submission.

09 What happens when Apple or Google raise the floor again?

It happens every year, on a published schedule. A care retainer includes tracking those dates and doing the SDK bumps they require before they become urgent. Without one, you will get a notice in your console and a deadline, and the work is the same — it is only the timing that is worse.

11Also

The other services

Rescue & Hardening

Your AI-built app made safe to launch: access control, payments, deploys and monitoring.

Web development

New applications and new features, built production-ready from the first commit.

App development

Mobile apps built to ship — iOS and Android, through review and into the stores.

Every engagement starts with the audit.

It is the only way we will quote a sprint, because it is the only way either of us knows what the work actually is. Fixed price, two business days, and credited in full if you go ahead.

Prefer to write? Send your requirements

What do you need?

What it should do, who will use it, the must-haves, and any links. A few sentences is plenty.

Budget, if you have one in mind
When would you like to start?