Do I need to do anything if my app has not changed in a year?

Yes. Both stores impose rolling minimums whether you ship code or not. On Google Play the annual target API level deadline will eventually block new updates and can reduce visibility and then remove the listing from sale; on Apple an app built with an outdated Xcode or SDK will be rejected the next time you submit. Certificates, provisioning profiles and push keys also expire on fixed dates. Plan on at least the half-day calendar check in this guide even for an untouched app.

What if my app was already removed from sale or I got the we are removing your app email?

Removal for most compliance reasons is reversible if you fix the cited issue and submit a compliant update within the window stated in the email and console warning. Check Play Console → Policy status and App Store Connect → App Review or Business for the exact reason, apply the fix from the relevant entry in this guide, then resubmit. If the deadline has passed, the listing stays hidden until the new build passes review. Paid apps and subscriptions may need additional steps to restore availability by territory.

Can I ignore the EU trader verification if I only sell in the United States?

No, if your app is discoverable in the EU. Since February 2024 Google Play and Apple require verified trader status for any developer who makes the app available to EU users, including free apps with in-app purchases. If verification lapses the stores hide the app from EU storefronts and warn before wider removal. You keep it current in Play Console and App Store Connect under the business and trader sections, not in the app binary itself.

Do I need a lawyer or accountant to stay compliant?

Not for the routine treadmill in this guide. The entries cover technical and console tasks you do yourself: bumping target APIs, updating SDKs, renewing certificates, re-attesting privacy forms, and keeping trader and accessibility declarations current. Get professional advice only for the European Accessibility Act conformance statement, complex data-protection questions, or if trader verification requires corporate documents you do not already have.

I use cross-platform tools and third-party SDKs — do their privacy declarations count as mine?

Yes. You are responsible for every required-reason API and data type in your final binary, including what third-party SDKs bundle. As of 2024 Apple requires a privacy manifest with required-reason API declarations and privacy nutrition label accuracy, and Google requires Data Safety re-attestation; both require that you include SDK signatures you did not author. This guide shows how to inventory SDKs, collect their manifests and signatures, and record what you attested and when.

Keep your app in the stores: the compliance treadmill

A lookup reference you open the moment a store warning, deadline email or expired certificate threatens a live app, plus a year-round maintenance calendar that prevents removal from sale, blocked updates or failed submissions on Google Play and the Apple App Store.

Fby Finito HQEchipa Finito

Created 3 weeks agoUpdated 2 weeks ago

Free preview: 3 of 18 steps

Work through them in the real run view, exactly as a buyer does. No account, no payment, nothing saved.

Try it free

Free

3 free unlocks per month — yours to keep forever

Updated Aug 2026

Start for free

Try 3 of 18 steps free

No account needed — nothing is saved.

Included with every copy

Your own copy — keep it forever
Gets better over time — free updates included
Run it on web and mobile
Invite a partner to go through it with you — you share the same progress
Make it your own — a private copy you can edit to fit your situation
The playbook's community — ask questions, get additions, and see how other buyers improve it, right on the step

Save

Part of a collection

Ship and sell an app

Guide 4 of 6

See the collection

Who it's for

Indie developers and teams of one to five with at least one app already live on Google Play or the App Store, especially when the app is a side project touched only a few times a year and shipped is assumed to mean done

About this playbook

This guide does not teach you how to build an app. It keeps the one you already shipped from disappearing while you work on something else. You get independent lookup entries for every recurring obligation that can hide an app from sale or block an update if ignored: Android target API levels, Play architecture and page-size rules, Apple minimum Xcode and SDK versions, privacy manifests and required-reason APIs, Data Safety and privacy-label re-attestation, in-app account deletion, expiring distribution certificates, provisioning profiles, signing and push keys, developer-account renewals, EU trader verification, and European Accessibility Act duties. Each entry follows the same structure — what the rule is, who imposes it, how you discover you are behind, what happens if you miss the date, how long the fix takes, and how often it recurs — with the year the date or version was true and the canonical source. It does not cover feature development, marketing, app review appeals on merits, or country-specific tax filings, and it does not replace the stores’ own policy pages.

What you'll do, step by stepFree preview

5 phases · 18 steps

Only a sample is open: 3 of 18 steps can be read in full. The rest unlock when you buy.

Phase 1: Use this reference and never miss a warning
3 steps
Phase 2: Keep Google Play apps submittable and visible
4 steps
Phase 3: Keep Apple App Store apps submittable and signed
4 steps
Phase 4: Keep privacy and account obligations current
3 steps
Phase 5: Meet EU duties and run the maintenance calendar
4 steps

Try 3 of 18 steps free

Unlock all 18 stepsFree

Details

Estimated duration6 hours 20 min

Steps18

Estimated budget$0–$150 per year per platform if you do the work yourself: Apple Developer

What you need first

At least one app published under your own Google Play Console and/or Apple Developer Program account, with admin access to those consoles and to the Apple Developer app or App Store Connect, and access to the source repository and signing credentials that last shipped the app