In-app account deletion for Expo apps

If your app lets people create an account, Apple requires it to also let them delete that account — and its data — from inside the app. A support email or a "contact us to delete" link is not enough. Missing or hard-to-find account deletion is a routine rejection, and it is entirely avoidable.

The rule, from Apple

Apple states the requirement directly in Offering account deletion in your app, and it is part of App Store Review Guideline 5.1.1(v). The short version: an app that supports account creation must let the user initiate deletion from within the app, the deletion must remove the account rather than merely deactivate it, and it must be reachable — not buried behind a web page or a support queue.

What a repository scan can hint at

A static check cannot see your running app, but it can raise the flag. If your project pulls in an auth stack — Sign in with Apple, Firebase Auth, Supabase, Auth0, expo-auth-session, or your own sign-up screen — it is a strong signal the app creates accounts, which means the deletion requirement applies. A preflight can surface that and ask you to confirm, rather than pretend it knows your UI.

What you must test by hand

Whether deletion actually exists and works is not knowable from source. Confirm it yourself before you submit:

• There is a visible "Delete account" path inside the app, reachable without leaving it.
• Completing it deletes the account and associated data on your backend — not just a local sign-out.
• If a purchase or subscription is tied to the account, the flow explains what happens to it (Apple asks you to tell users that managing a subscription is separate).
• Your App Review notes point the reviewer at the deletion path so they can find it quickly.

Why the preflight treats this as needs-confirmation

Because it is a human-tested behaviour, a preflight should never mark account deletion as automatically verified. In the App Store Preflight Kit it is a guided checklist item: if your app creates accounts, the report asks you to confirm deletion was tested, keeps your answer separate from what the tool proved itself, and blocks only when you explicitly say it is not ready. There is no guaranteed fix here — only a clear, honest prompt so the requirement is not forgotten.