App stores are gates with rulebooks. Apple and Google publish the rules, and a review team checks each submission against them before anyone can install the app. A submission that breaks a rule is rejected at the door, and an app that slips through can be pulled later. The gate is not symbolic: Apple rejected more than 2 million app submissions in 2025.
The scale is on record. Apple's App Store Transparency Report for 2025 lists 9,100,620 submissions reviewed and 2,093,244 rejected, alongside 166,899 apps removed from the store outright, per Apple's 2025 transparency report. Google runs its own book of rules for Google Play, with an enforcement process and an appeals path behind it. What follows is app store policies explained for the people on the far side of the install button.
The rulebook both stores publish
Apple arranges its App Review Guidelines into five sections: Safety, Performance, Business, Design, and Legal. The introduction states the principle plainly. Every app is reviewed, and each one is scanned for malware that could touch user safety, security, or privacy. Google Play's Developer Policy Center groups its rules by topic instead: restricted content, privacy and device abuse, monetization and ads, and store listings, with the enforcement steps written next to them.
The two books read differently but aim at the same target. Apple wants a curated store, so its rules reach design and business model choices. Play's rules lean on content categories and data handling, and Google handles distribution outside Play through separate Android mechanisms. For related coverage, see How the SEC's four-business-day cyber incident rule actually works.
What review actually measures
Most rejections are technical, not moral. Of the 2,093,244 rejected submissions in Apple's 2025 report, the largest share sat under Performance at 1,354,418, with Legal at 495,673 and Design at 415,532. Safety, the section readers fear most, accounted for 151,159 rejections. Business, the section that governs purchases and payment rules, added 283,820 more. The counts cover resubmissions as well as first attempts, which is why they dwarf the store total of 2,172,472 apps. The process leaves room to fix and return: Apple lists 387,087 submissions approved after a rejection, which makes review work like editing rather than a final verdict. This connects to our earlier piece, Cyber insurance explained: what policies cover, what they demand, and what they exclude.
Where enforcement bites hardest
Fraud leads Apple's removal table. The 2025 report counts 90,608 apps removed under the fraud provision of the Developer Program License Agreement, ahead of design violations at 72,271. Google's book covers the same ground in different words: apps that are deceptive, malicious, or built to abuse a network, a device, or personal data are prohibited outright. Review filters before installation; removal protects the install base after it.
Distribution itself is starting to loosen at the edges. Apple notes that in some markets developers can ship notarized apps through alternative marketplaces and directly from a website, a shift that arrived after regulators pushed back on the single-store model. Notarized apps still pass a check, but it is not the same gate as full App Review.
What to do now
Readers can work the gates instead of trusting them. Install from the official store listing, check the developer name, and read each permission prompt as it appears. Treat a new permission in an update as a fresh decision. Both stores accept reports, so flag apps that misbehave, since removals start with those reports. Developers should map an app against the five Apple sections and the Play policy topics before the first submission, because resubmission is the slow path.
Conclusion: the bottom line
App stores decide what ships through published rules, human review, malware scans, and removals after the fact. The 2025 numbers show a system under load: millions of submissions read, millions of rejections issued, and hundreds of thousands of apps pulled. The store is a filter, not a guarantee. The last check still happens on the device, at the listing, the permission prompt, and the update screen.
