App Store guideline 2.4.5

What it means

• (i) They are properly sandboxed, follow the macOS file system documentation, and only use the appropriate macOS APIs to change user data stored by other apps, for instance bookmarks, contacts or calendar entries.
• (ii) They are packaged and submitted with technologies provided in Xcode, with no third-party installers. They are self-contained, single app installation bundles that cannot install code or resources in shared locations.
• (iii) They do not launch automatically or run code at startup or login without consent, do not start processes that keep running without consent after the user quits, and do not put their icons in the Dock or leave desktop shortcuts on their own.
• (iv) They do not fetch or install standalone apps, kernel extensions, extra code or resources that add functionality or change the app substantially compared with what review saw.
• (v) They do not ask for root privileges or use setuid attributes.
• (vi) They show no license screen at launch, demand no license keys and build no copy protection of their own.
• (vii) They use the Mac App Store to deliver updates, and no other update mechanism is allowed.
• (viii) They run on the currently shipping OS and avoid deprecated or optionally installed technologies, with Java as the example.
• (ix) All language and localization support has to live in one app bundle.

Apple's text

This page is an unofficial explanation in our own words. Unofficial explanation, not affiliated with Apple. Apple's text prevails. Apple's wording is on its page, linked below.

• Apple's App Review Guidelines, guideline 2.4.5

Want the guidelines grouped by app type?

If we publish the guidelines grouped by what you are building (subscriptions, kids apps, sign-in), we write to you once. We use the email for nothing else.