Skip to content
Guides
Guides·9 min read·May 4, 2026

Mobile App Launch Checklist 2026 (React Native + Expo)

The pre-launch checklist that catches the things you forget. Account deletion, App Store metadata, push permissions, paywall localization, analytics, and the boring legal items that block submission.

Written by
Kaspar Noor
Mobile App Launch Checklist 2026 (React Native + Expo)
Use this before you submit, not after rejection

This is the checklist I run before every store submission. It is opinionated toward Expo / React Native apps, and it catches the items that get apps rejected on the first review or buried after launch.

Most launch checklists you find online are either generic marketing fluff or pre-2024 advice that misses the things both stores added recently. This one is grounded in what Apple and Google actually enforce in 2026, plus what teams keep forgetting.

If you are still in build mode, the React Native boilerplate chooser can help you skip a lot of the setup that this checklist depends on.

The pre-build foundation (do these first)

If you finish your app and then start this checklist, you will lose a week. These items are cheaper to get right while you are still building.

Bundle ID and package name registered (cannot be changed later)
Apple Developer account active ($99/year)
Google Play Console account active ($25 one-time)
App Store Connect entry created with the final app name
Google Play Console entry created with the final app name
Privacy policy URL live and reachable
Terms of service URL live and reachable
Support email and support URL working

The privacy policy URL is the one that catches people. Both stores require a public URL, not a PDF, not a Notion page that requires login.

Account and auth

This section trips up half of all submissions in 2026 because Apple now strictly enforces account deletion and Sign in with Apple parity.

Email/password sign-up works end to end
Magic link or email verification flow tested on a real device
Google sign-in works on iOS and Android
Sign in with Apple is offered if you offer any other social login (Apple requires this)
In-app account deletion is implemented and works (Apple requires this since 2022, still enforced)
Account deletion actually removes user data on the backend, not just signs the user out
Password reset flow works on a real device, not just the simulator
Deep links from email return the user into the app, not the browser
Logged-out state never shows protected content

Account deletion is the most common rejection reason for apps with auth. The button has to be reachable inside the app. Sending the user to a website to delete their account is rejected.

If you are using Supabase or Convex, our authentication tutorial covers the production shape of these flows.

Subscriptions and payments

Paywall shows at least one subscription option clearly
Restore purchases button is visible and works
Free trial terms are displayed clearly (length, then what)
Subscription length and price are visible before purchase
Subscription terms link to your terms of service
Privacy policy is linked from the paywall
RevenueCat or store entitlements verified server-side, not just client-side
Subscription cancellation instructions are findable in-app or in support
Family Sharing setting decided (enable or disable explicitly)
Promotional offers configured if you plan to use them

The "verify server-side" item is the one that ships broken in many apps. Client-side state can be tampered with on jailbroken devices. Your server functions for paid features should check entitlement against RevenueCat or a webhook-synced server table.

We covered the cross-platform setup in our RevenueCat integration tutorial and web billing for Expo apps.

Permissions and privacy

Apple and Google both want you to ask for the minimum you need, with a clear explanation, at the right time.

Push notification permission only requested after the user has done something meaningful
Camera permission has a usage description (NSCameraUsageDescription) explaining why
Photo library, microphone, location each have clear usage descriptions
Tracking permission (ATT) implemented if you use any tracking SDK
Privacy nutrition labels filled out in App Store Connect
Google Play Data Safety form completed
User-deletable data clearly marked in your privacy policy
All third-party SDKs declared in the privacy declarations

Asking for push permission on the first screen is the fastest way to lose half your opt-ins. Trigger it after a real action.

Crashes, performance, and observability

If you cannot see a crash, you cannot fix it. Both stores rank apps with high crash rates lower in search.

Sentry or equivalent crash reporting wired in for both iOS and Android
Source maps uploaded so stack traces are readable
PostHog or equivalent analytics tracking key flows (sign-up, paywall, purchase, retention)
Feature flag system in place for any risky launch behavior
Cold start time under 3 seconds on a mid-range Android device
List performance smooth at 60 fps on the cheapest device you target
App handles offline mode without crashing
Error boundaries around any screen that calls third-party APIs

If your error boundary is React-only, remember it does not catch async or pre-mount errors. Use the SDK-level error tracker for those.

App Store and Play Store metadata

Submission readiness, not product readiness:

App icon at 1024x1024 with no alpha channel and no transparency
iOS screenshots for 6.7-inch and 6.5-inch devices, optionally iPad
Android screenshots at the right aspect ratios for phone and 7-inch / 10-inch tablet
App preview videos prepared if you plan to use them
Title, subtitle, and keywords optimized for ASO
Promotional text written and current
What's New text written for v1
Age rating completed honestly (Apple) and IARC questionnaire completed (Google)
Content rights confirmed for any third-party content shown in screenshots
Marketing URL and support URL both live

ASO is a separate topic, but the basics are: put your most-searched keyword in the title, the secondary keywords in the subtitle, and the rest in the keyword field. Do not waste keyword space on your brand name.

Localization

If you ship in multiple languages, both stores want you to do it properly.

App content localized into each supported language
App Store Connect localizations filled in for each language (title, subtitle, keywords, description)
Google Play Console listings localized for each language
Date, time, and currency formatting respects the user locale
Right-to-left languages tested if you support Arabic or Hebrew
App reviewer can switch languages easily for review (no language picker bug)

A translated description with an untranslated app body is a common rejection.

Beta testing and review readiness

Get someone other than yourself to break the app before the reviewer does.

TestFlight beta with at least 5 external testers run for 1+ week
Google Play closed testing with real testers run for 1+ week
Test account credentials prepared for the App Store reviewer (required if your app has auth)
Demo video or notes prepared for any feature that is not obvious
Reviewer notes explain any unusual permissions or background behavior
Encryption export compliance answered honestly (most JS apps qualify for the standard exemption)
Build version and build number incremented from any prior submission
App tested on a real iPhone (not just the simulator)
App tested on a real low-end Android (not just an emulator)

Reviewers test on real devices in their region, with their network conditions. Your iPhone 16 Pro on fiber is not the same environment.

Compliance items that block submission

These are the ones that will get the app pulled, sometimes after a successful first launch:

GDPR consent flow if you target EU users and collect any personal data
CCPA notice if you have California users
COPPA compliance if your audience includes children under 13
DSA terms compliance for EU (Apple and Google both enforce this in 2026)
Data deletion request mechanism that an end user can actually use
Third-party SDK list current with what is shipped in the binary
All TODO and console.log statements stripped from the production bundle
Debug menus hidden behind a feature flag, not just commented out

The "console.log stripped" item matters because reviewers and security researchers do read your bundle. Leaving an internal admin URL or staging API key in production is a common mistake.

Marketing readiness (separate from app readiness)

You do not need this to submit, but you need it to launch.

Landing page live with App Store and Play Store badges
Marketing copy aligned with what the app actually does
Founder or team email address that real humans answer
App Store and Play Store review links easy to share
Press kit prepared if you plan a coordinated launch
Product Hunt entry drafted if you plan to launch there
Social channels current and pointing to the app
Email list ready to notify on launch day

If you have not done this part, your app launches into silence. The store traffic for a brand-new app is approximately zero on day one.

What I check the day of submission

Last pass before hitting submit:

Build number incremented
Version string updated
Production env vars set, not staging
No debug toggles enabled in the binary
Crash reporter pointing at the production project
Analytics pointing at the production project
Push tokens pointing at the production environment
App tested signed-out and signed-in on a fresh device install
Reviewer login still works
Privacy and terms URLs still live

A failed first submission costs you a week. A clean first submission usually clears review in 24 to 48 hours in 2026.

What happens after launch

Plan to spend the first two weeks doing this:

  • Monitoring crash reports and shipping a 1.0.1 within a few days.
  • Watching paywall conversion and tweaking copy.
  • Replying to early App Store and Play Store reviews promptly (Apple shows your response publicly).
  • Watching for Apple or Google emails about compliance issues — they sometimes flag things post-launch.

After the first 30 days, the rhythm becomes: ship a small update every two to three weeks, plan an Expo SDK upgrade twice a year, and keep an eye on ASO.

Want this checklist baked into your codebase?

Shipnative ships with account deletion, paywall flows, push permissions, and store-ready scaffolding already in place.

Get Started Now

Further reading

Ready to ship faster?

Get lifetime access to Shipnative for a one-time payment of $99.