Pre-submission audit: Dayward (habit tracker)

1. Tapping "Add progress photo" crashes the app

Evidence. On the physical iPhone, TestFlight build 1.0 (3) closes immediately when you tap Add progress photo on a habit. @capacitor/camera is installed, but ios/App/App/Info.plist has no camera or photo library keys:

Info.plist, keys present:  CFBundleDisplayName, UILaunchStoryboardName, ...
Missing:  NSCameraUsageDescription
          NSPhotoLibraryUsageDescription
          NSPhotoLibraryAddUsageDescription

iOS terminates an app that requests camera access without a purpose string. A reviewer who tries the photo feature sees a crash, which is a 2.1 rejection, and the missing text is a 5.1.1(ii) issue on its own.

Fix.

1. Add the three keys to Info.plist with specific text, for example camera: "Take a progress photo to attach to today's check-in." Photo library: "Choose an existing photo to attach to a check-in."
2. Request access only when the user taps Add progress photo (the plugin does this by default once the keys exist).
3. Test "Don't Allow": the app should show a message pointing to Settings and keep working.

Guide: 5.1.1 data collection and purpose strings

2. No privacy manifest; outdated plugins

Evidence. There is no PrivacyInfo.xcprivacy in the App target. package.json pins Capacitor 5.0 and @capacitor/preferences 5.0, which predate bundled privacy manifests. The upload email for build 3, which the owner forwarded, lists ITMS-91053 for the user defaults and file timestamp API categories.

An analytics snippet copied from the web app sends a device identifier to a third-party analytics service, while the draft App Privacy answers say "Data Not Collected".

Fix.

1. Update Capacitor and all plugins to current versions, then npx cap sync ios.
2. Add a privacy manifest to the App target, declaring the remaining API categories with reason codes that match what the code does.
3. Remove the web analytics snippet from the iOS build, or declare what it collects in the manifest and in App Privacy. It does not appear to track across other companies' apps, so App Tracking Transparency should not be needed; confirm with the vendor's documentation.
4. Upload a new build and confirm the ITMS-91053 email does not come back.

Guide: 5.1.2 / ITMS-91053 privacy manifest

3. App loads the live website instead of bundled files

Evidence.

// capacitor.config.ts
server: { url: 'https://dayward-app.example', cleartext: false }

Every screen comes from the live site. With the phone in Airplane Mode the app shows a blank white screen. The web header with a hamburger menu and a "Get the app" banner are still visible on iOS, and the Blog link opens the marketing site inside the app.

Fix.

1. Remove server.url, run the production build and npx cap sync so the app loads its own files.
2. Replace the web header with a bottom tab bar (Today, Habits, Progress, Settings) on iOS.
3. Add an offline state that shows today's habits from local storage and queues check-ins.
4. Hide the app banner, cookie banner and Blog link on iOS.
5. Keep one or two native features the reviewer can see: the existing local reminder notifications already count, and the progress photo from finding 1 is another.

Guides: 2.5.2 software requirements, 4.2 minimum functionality

4. Subscription screen missing terms links and Restore

Evidence. The Pro paywall (shown after the third habit) uses RevenueCat with a yearly product. On screen, from largest to smallest text: "Just $0.77 a week", "Start 7-day free trial", and in small grey text "$39.99/year after trial". There is no Terms of Use link, no Privacy Policy link, and no Restore Purchases button on the paywall or in Settings. The draft description does not mention Terms of Use.

Fix.

1. Make "$39.99 per year" the most prominent price. Keep the weekly figure smaller, if at all.
2. Under the button: "Free for 7 days, then $39.99 per year. Cancel any time in Settings." Read the price from RevenueCat so it matches each storefront.
3. Add Terms of Use and Privacy Policy links on the paywall, opening pages on your own domain.
4. Add Restore Purchases to the paywall and to Settings > Plan, calling RevenueCat's restore and showing the result.
5. Add a Terms of Use link to the description, or use Apple's standard EULA.

Guide: 3.1.2 subscriptions

5. Google sign-in without an equivalent option

Evidence. The sign-in screen offers "Continue with Google" and an email magic link. Google sign-in sets up the user's main account, so 4.8 applies. Apple has rejected apps with this exact combination, because the email option does not let users hide their email address.

Fix.

1. Add Sign in with Apple through your auth provider (Supabase in this project supports it) and show it with equal prominence.
2. Enable the Sign in with Apple capability for the App ID and in Xcode.
3. Test with "Hide My Email" so the account works with the relay address.

Guide: 4.8 login services

6. No way to delete an account in the app

Evidence. Settings has Log out and a "Contact us to close your account" line. There is no delete option in the app. The backend has no function that deletes a user's habits, check-ins and photos.

Fix.

1. Add Settings > Account > Delete account, with one confirmation step.
2. Add a server-side function that deletes the user, their rows and their stored photos. Do not call admin keys from the app itself.
3. Tell users with an active subscription that deleting the account does not cancel billing, and link to Apple's subscription settings.
4. If Sign in with Apple is added (finding 5), revoke the Apple token on deletion.

Guide: 5.1.1(v) account deletion

7. Screenshots from the website; Android mentioned

Evidence. All five iPhone screenshots are desktop captures of the web app placed in phone frames; the first shows the sign-in screen. The build supports iPad, and the iPad screenshots are the iPhone set stretched. The draft description ends with "Also on Android and the web." The name field reads "Dayward - Habit Tracker, Goals & Planner Free".

Fix.

1. Capture new screenshots from the build (after findings 1 to 4), starting with the Today screen and a streak.
2. Either make the iPad layout work and capture it at the 13-inch size, or turn off iPad support in this build.
3. Remove the Android and web line from the description.
4. Rename to "Dayward" with the subtitle "Daily habits and streaks", and drop "Free" from the name.

Guide: 2.3.3 / 2.3.7 screenshots, name and keywords

8. Support URL needs a login; template privacy policy

Evidence. The draft Support URL is the app's in-app Contact page, which redirects to sign-in when opened in a private browser window. The privacy policy page still says "Your Company Inc." and lists location data, which the app does not collect, while leaving out photos, which it does.

Fix.

1. Publish a public support page with a support email address and a short FAQ (reset, cancel subscription, delete account).
2. Rewrite the privacy policy to match what the app collects: email, habits and check-ins, progress photos, purchase status. Include how to delete an account.
3. Open both links on a phone on mobile data before saving them in App Store Connect.

Guide: 1.5 developer information