Rejection decoder › Guideline 5.1.1(v)
Guideline 5.1.1(v) rejection: Account deletion
Since 2022, Apple has required that apps which let people create an account also let them start deleting that account from inside the app. A 5.1.1(v) rejection means the reviewer could not find that option, even if it exists somewhere.
Apple decides. This page is our own reading of the App Review Guidelines as of September 2026, not Apple's wording, and following it does not guarantee approval. The current text at developer.apple.com is the authority.
What Apple's message says
Paraphrased, the message says the app supports account creation but does not include an option to initiate account deletion. Apple sometimes asks for a screen recording of the deletion flow on a physical device.
What Apple expects, in our reading of the guideline:
- The option is in the app and clearly visible, usually under settings or the account screen.
- It deletes the account and its associated data, not just deactivates or logs out.
- A link to a website is acceptable only if it goes straight to the deletion page; emailing support is generally not enough. Highly regulated services may use additional steps.
Why AI-built apps hit it
AI builders generate sign-up and log-out by default. Deletion is rarely in the template, and when it is added, it often ends up in the wrong place:
- Only "Log out" exists, or deletion is a support email.
- The delete option sits on a settings screen only visible to administrators. In one case we worked on, the feature existed but the demo account given to Apple was not an admin, so from the reviewer's seat it did not exist.
- Users who signed in with Apple or Google never see the settings page where deletion lives.
- The button deletes the auth user but leaves the profile and data rows in the database.
How to fix it, step by step
- Add Settings > Account > Delete account, visible to every role and every sign-in method. It only deletes the user's own account, so there is rarely a reason to hide it.
- Confirm once, then delete the account and its data, or clearly start deletion and say how long it takes.
- Do it on the server. With Supabase or Firebase, deleting another auth user needs admin rights, so run it in a server function rather than exposing an admin key in the app.
- If you use Sign in with Apple, revoke the user's Apple token as part of deletion.
- Handle subscriptions honestly. Tell users that Apple subscriptions are cancelled in their Apple account settings.
- Test it with the demo account you give Apple, and with a social sign-in account.
- Tell the reviewer the path in App Review notes. If Apple asked for a recording on a device, send one from a device.
What to reply in the Resolution Center
Fill in the brackets and delete anything you did not do. Give the exact path. If deletion existed before and was hidden by role, say what changed so the reviewer can find it.
Hello, Thank you. Regarding Guideline 5.1.1(v): users can now delete their account in the app at [Settings > Account > Delete account]. This deletes [the account and associated data] [immediately / within N days]. It is available to all users, including those who signed in with [Apple / Google]. [If requested: "A screen recording of the flow on (device) is attached."] Best regards, [Your name]
Related guidelines
- Guideline 4.8: Login services / Sign in with Apple if the app uses Sign in with Apple, whose token must be revoked on deletion.
- Guideline 5.1.2 / ITMS-91053: Privacy manifest for the privacy manifest and data disclosures.
- Guideline 2.1: App completeness and Information Needed if the demo account could not reach the feature.
Questions
Is a delete-account link to my website enough for Guideline 5.1.1(v)?
In our reading, a link that goes directly to the deletion page can be acceptable, but the option must start in the app and be clearly visible. A support email address alone is generally not enough.
Does deactivating an account count as deletion?
No. Apple expects the account and its associated data to be deleted, or deletion to be started with a clear timeline. Temporary deactivation does not meet the requirement.
Do I need to revoke Sign in with Apple tokens when deleting an account?
Apple asks apps that use Sign in with Apple to revoke the user's tokens when the account is deleted, using Apple's token revocation endpoint. Most auth providers document how to do this.
Stuck on this rejection?
Paste the full message into the free rejection decoder to see every cited guideline explained, with a reply draft. It runs in your browser and nothing is uploaded.
Or order a rejection fix, $99: we read the full message, find the cause, fix it in your project, upload a new build and draft the reply for your approval. Target turnaround 72 hours from access. Apple still makes the final decision, and its review time is separate.