# FuelBoard App Store Approval Review

Review date: 2026-08-11 · Target: App Store submission readiness.
This is the companion to SECURITY.md — focuses on App Store *review* gate
(guideline compliance), not code security.

## Status: NOT SUBMISSION-READY

Two blockers remain before a real submission (see below). Everything else
checks out for review.

## Blockers

### 1. Data source — LAN relay (BLOCKER)
- The app fetches from `http://192.168.1.131:8788` — a private LAN host. Off
  the user's network it fails and falls back to sample data. Reviewers on
  Apple's network will see empty/sample results → 2.1 (performance) rejection,
  and hardcoded IPs look like test builds.
- **Fix**: the govuk API switch (BACKLOG P0). App must talk to a public HTTPS
  endpoint before submission. The relay (HTTPS domain) or direct gov.uk OAuth
  both work; the code path is already stubbed.

### 2. Always-location justification (BLOCKER without review notes)
- `NSLocationAlwaysAndWhenInUseUsageDescription` + `UIBackgroundModes: location`
  present, but guideline 5.1.1 requires the feature to be obvious AND the app
  must visibly use background location. The geofenced "cheapest station" alerts
  satisfy this, but the reviewer must see it:
  - Provide detailed App Review notes explaining the alert flow (enable Alerts →
    geofence trigger → notification when approaching the cheapest station).
  - Ensure the Alerts tab is discoverable and functional in review.
  - Also: "Always" prompt should only appear after the user opts into alerts
    (in-progress UX; currently the permission prompt may fire too early).

## Review-relevant configuration — PASS

- [x] **App icon**: was MISSING entirely (invalid-binary rejection). Fixed —
      1024×1024 `AppIcon.appiconset` + `ASSETCATALOG_COMPILER_APPICON_NAME`.
- [x] **Launch screen**: `UILaunchScreen` empty dict present (iOS 14+ style).
- [x] **Device family**: iPhone-only (`TARGETED_DEVICE_FAMILY = 1`) — no iPad
      multitasking requirements.
- [x] **Versioning**: `CFBundleShortVersionString 1.0`, `CFBundleVersion 1`
      (bump per release).
- [x] **Permissions**: only location (WhenInUse + Always), with clear usage
      strings. No contacts/photos/mic/camera.
- [x] **No third-party SDKs** → no SDK privacy manifests or third-party
      attribution required.
- [x] **No account creation / login** → no account-deletion requirement (5.1.1(v)).
- [x] **ATS**: no `NSAllowsArbitraryLoads` (raw-IP cleartext is ATS-exempt; once
      the relay is HTTPS this is moot).
- [x] **Export compliance**: no crypto beyond keychain/SecItem → no
      documentation needed.

## Content / IP review

- **Brand logos (Shell, BP, Tesco…)**: bundled from Simple Icons (CC0) +
  Wikimedia Commons. Nominative use (identifying stations) is standard practice
  (cf. GasBuddy). Low risk, but keep the sources documented.
- **Price data**: gov.uk Fuel Finder data is OGL-licensed — include attribution
  in the app (About/credits) once live data ships. Sample fallback data must be
  clearly demo-labelled (or removed for review) so reviewers don't think the
  prices are fake — 2.3.1 accuracy risk.
- **"Cheapest" claims**: data is 12h-old cache. The UI says "cheapest" — fine,
  but a small "prices from the UK Fuel Finder dataset, updated twice daily"
  footnote is good hygiene for 2.3.1.

## Suggested review notes (copy-paste for App Store Connect)

> FuelBoard shows the cheapest petrol, diesel, and premium fuel near the user
> using the UK government Fuel Finder dataset (OGL). Prices are fetched up to
> twice a day; the app filters 5/10/15-mile radii on-device. Location is used
> to (a) rank stations by distance and (b) power the optional Alerts feature:
> when enabled, the app geofences the cheapest station in the user's chosen
> radius and sends a notification when they approach it. Always-location is
> only requested when the user enables alerts. The app also provides a
> home-screen widget showing the current cheapest station nearby.

## Release checklist (before every submission)

1. [ ] Relay/govuk data source live on a public HTTPS endpoint
2. [ ] Always-permission flow tied to explicit user opt-in
3. [ ] Bump `CFBundleShortVersionString` / `CFBundleVersion`
4. [ ] Sample-data fallback labelled or removed in the release build
5. [ ] OGL attribution present in-app
6. [ ] `swift test` green (FuelBoardTests, 28 tests)
7. [ ] Security audit pass (see SECURITY.md recurring checks)
8. [ ] Icon + screenshots for all required sizes in App Store Connect