# store-ready: Gate 3, policy review areas

Read by `/multi-agent:store-ready` for Step 6. Load the platform's review skill
and gather the evidence below from repo source, not the binary.

## iOS  -  `ai-ios-toolkit:app-store-review`

| Area | Evidence to gather |
|---|---|
| Purpose strings | every `NS*UsageDescription` in Info.plist  -  present, specific, user-facing, and matching what the code actually does with the data |
| Privacy manifest | `PrivacyInfo.xcprivacy` exists, declares required-reason APIs, and matches the SDKs actually linked |
| Tracking | if any tracking API or SDK is present, an ATT prompt exists and runs before collection |
| Account deletion | if the app creates accounts, an in-app deletion path exists (guideline 5.1.1(v)) |
| Privacy policy | reachable in-app and in the metadata |
| IAP | anything unlocking features goes through StoreKit, with no external purchase path |
| Sign in with Apple | present when a third-party social login is offered |
| Crash symbolication | a dSYM upload step exists: an Xcode run-script calling `upload-symbols`, or a Crashlytics / Sentry / Datadog upload in CI |

## Android  -  `ai-android-toolkit:play-store-review`

| Area | Evidence to gather |
|---|---|
| Permissions | every `uses-permission` justified by a feature, no sensitive permission without its declaration form |
| Data safety | the declared data-safety answers match what the code collects and transmits |
| Target API level | meets the current Play requirement for new releases |
| Privacy policy | reachable in-app and in the listing |
| Billing | anything unlocking features goes through Play Billing, with no external purchase path |
| Account deletion | if the app creates accounts, an in-app deletion path exists, plus the web deletion URL Play requires |
| Content rating | the questionnaire answers match the app's actual content |
| Signing | Play App Signing configured, upload key distinct from the app signing key |
| Crash symbolication | a `mapping.txt` upload exists: the Firebase Crashlytics Gradle plugin, or the Play App Bundle deobfuscation file |