Apple account deletion requirement for Expo apps
If your app lets people create an account, Apple requires it to let them initiate deletion of that account from inside the app. Temporary deactivation is not enough. Apple allows limited exceptions for apps that must use a website to finish deletion and for highly regulated industries, but a generic support email is not the default path.
The rule, from Apple
Apple states the requirement directly in Offering account deletion in your app, and it is part of App Store Review Guideline 5.1.1(v). The short version: an app that supports account creation must let the user initiate deletion from within the app, the deletion must remove the account rather than merely deactivate it, and the option must be easy to find. Read Apple's linked guidance for the limited website and highly regulated-industry exceptions.
What a repository scan can hint at
A static check cannot see your running app, but it can raise the flag. If your project pulls in an auth stack — Sign in with Apple, Firebase Auth, Supabase, Auth0, expo-auth-session, or your own sign-up screen — it is a strong signal the app creates accounts, which means the deletion requirement applies. A preflight can surface that and ask you to confirm, rather than pretend it knows your UI.
Firebase Auth account deletion: what counts
If Firebase Authentication lets users create accounts in your iOS app, Apple's account deletion requirement still applies. Signing out or deleting a local token is not account deletion. Your in-app flow must initiate deletion of the account and its associated data. Firebase documents the authenticated-user deletion operation in Manage Users in Firebase Authentication. Your own backend must also remove any associated user data that Firebase Auth does not own. Test the complete production-like flow rather than treating an SDK call as proof that the requirement is satisfied.
What you must test by hand
Whether deletion actually exists and works is not knowable from source. Confirm it yourself before you submit:
- There is a visible "Delete account" path inside the app, reachable without leaving it.
- Completing it deletes the account and associated data on your backend — not just a local sign-out.
- If a purchase or subscription is tied to the account, the flow explains what happens to it (Apple asks you to tell users that managing a subscription is separate).
- Your App Review notes point the reviewer at the deletion path so they can find it quickly.
Why the preflight treats this as needs-confirmation
Because it is a human-tested behaviour, a preflight should never mark account deletion as automatically verified. In the App Store Preflight Kit it is a guided checklist item: if your app creates accounts, the report asks you to confirm deletion was tested, keeps your answer separate from what the tool proved itself, and blocks only when you explicitly say it is not ready. There is no guaranteed fix here — only a clear, honest prompt so the requirement is not forgotten.
Apple account deletion requirement FAQ
Does Apple require account deletion?
Yes. Apple says apps that support account creation must let users initiate deletion of their account from within the app.
Is deactivating an account enough for App Review?
No. Apple says temporary deactivation or disabling is not sufficient; the option must delete the entire account record, subject to applicable legal retention requirements.
Can an iOS app send users to a website to delete their account?
Apple generally expects deletion to begin in the app. It permits a direct link to the deletion page for apps that require a website to complete deletion, and says highly regulated industries may use additional customer-service flows.
Does Apple's account deletion requirement apply to Firebase Auth apps?
Yes, if the app uses Firebase Authentication to let people create accounts. The identity provider does not change Apple's rule: users must be able to initiate deletion in the app, and deleting only the local session is not enough.
What should an Expo team test before App Review?
Test the production-like iOS build end to end: find the deletion control, complete any reauthentication, verify backend account and associated-data deletion, and give App Review the path in review notes.
Continue your App Store preflight
Account deletion is one review check, not the whole submission. Continue with the App Store submission checklist, check your Expo permission descriptions, or inspect the evidence labels and reviewer checklist in the sample preflight report.
The App Store Preflight Kit flags account-creating apps and walks you through confirming in-app deletion was tested, alongside the rest of the reviewer checklist code cannot prove. Checkout is closed during cross-agent validation; see what the skill pack checks and the planned offer.