App review disclosures & evidence

Source: AppleLedger/AppStoreAssets/submission/GUIDELINE_5_6_RESPONSE_EN.md · 1–17

Numbered source excerpt; selected lines preserved.

    1 | # Guideline 5.6 Resolution Center Response
    2 | 
    3 | Thank you for identifying this issue. We reviewed the rejected build and found that the production app target incorrectly retained an internal screenshot workflow. That workflow included launch arguments and environment variables that could inject sample records, force a local data store, bypass the privacy lock, and simulate iCloud or App Group availability. We understand that retaining this behavior in a production build was inappropriate and could appear intentionally hidden.
    4 | 
    5 | The new build removes that workflow completely:
    6 | 
    7 | - All screenshot-only data creation, deletion, and injection code has been removed.
    8 | - All forced-local-store launch arguments and environment variables have been removed.
    9 | - All privacy-lock and automatic-lock bypasses have been removed.
   10 | - All simulated iCloud and App Group status results have been removed.
   11 | - All language- or region-based app-icon switching, the English alternate icon, and the related system-switch prompt have been removed. Every user now receives the same primary "好记" icon.
   12 | - Ledger, account, transaction, collaborator, and cold-wallet screens now display only data actually created and stored by the user.
   13 | - The submitted Release binary contains no screenshot route, language override, demo-data, forced-local-store parameter, or alternate app icon.
   14 | 
   15 | The app does not hide or reveal features based on reviewer identity, date, region, device, build source, or server configuration. App Review and all users now execute the same Release code path. All features are accessible through the normal user interface, and the App Store description and screenshots explicitly disclose shared ledgers and the on-device cold wallet vault.
   16 | 
   17 | No backend account is required. iCloud and shared-ledger features can be tested on a device signed in to an Apple ID.

Original whole-file SHA-256

04dfa389f217c2659f02d6cf1af820d647e7fb1c4a7a0ef228bb83cfd1126120

Numbered excerpt SHA-256

b16507111ff0949a1c6012b2071b718c574ecc1bab03f7d6c62fab5dada50c57

Source: AppleLedger/README.md · 143–164

Numbered source excerpt; selected lines preserved.

  143 | Hello App Review Team,
  144 | Thank you for reviewing our app.
  145 | As explained in our response dated August 11, we investigated the previous rejection and identified an internal screenshot-production workflow that had been mistakenly retained in the production target. We understand why the presence of that workflow could have appeared to be hidden behavior.
  146 | We have now submitted a corrected iOS binary:
  147 | Version 1.0.2 (Build 1.0.1)
  148 | This build supersedes the previously rejected binary and includes the following remediation:
  149 | - All screenshot-only sample-data creation, deletion, and injection code has been removed.
  150 | - The Release binary contains no screenshot route, demo-data parameter, forced-local-store parameter, language override, privacy-lock bypass, or automatic-lock bypass.
  151 | - All simulated iCloud and App Group results have been removed. The app now displays only the actual status reported by Apple system services.
  152 | - No alternate app-icon switching is available in the Release build. Every user receives the same primary “好记” icon.
  153 | - Ledger, account, transaction, collaborator, and cold-wallet screens display only information created and stored by the user.
  154 | - The app does not change, hide, or reveal functionality based on reviewer identity, date, region, device, build source, network response, or server configuration.
  155 | - App Review and all users execute the same Release code path.
  156 | EasyTallys (“好记”) is a local-first personal and family bookkeeping app. It has no developer-hosted account or backend, no advertising, no third-party analytics, no remote feature configuration, no in-app purchases or paywall, and does not download executable code or configuration that changes its functionality.
  157 | Ledger data is stored on the user’s device. If the user enables iCloud, ledger data is synchronized only through Apple CloudKit under the user’s own Apple ID. No developer-provided login credentials are required.
  158 | All features are accessible through the normal user interface:
  159 | - Bookkeeping features are available from Overview, Transactions, Accounts, Budgets, Reports, and Library.
  160 | - CloudKit shared-ledger features are available under Library > Sharing. Testing requires a device signed in to an Apple ID.
  161 | - The on-device Keychain vault is available under Library > Cold Wallets. It only stores information manually entered by the user in the current device’s ThisDeviceOnly Keychain. It does not create cryptocurrency wallets, connect to blockchain services, perform transfers or trading, or upload vault information to any server.
  162 | These features are also disclosed in the App Store description, screenshots, and Notes for Review.
  163 | We respectfully request that App Review evaluate Version 1.0.2 (Build 1.0.1).
  164 | If App Review still observes behavior associated with Guideline 5.6 in this corrected build, could you please identify the specific feature, navigation path, review steps, device conditions, or provide a screenshot of the observed behavior? This information would allow us to reproduce and address the concern immediately.

Original whole-file SHA-256

b6e872e127759a760d75f34c142123d3215189c9f8418d289fffb924189c9318

Numbered excerpt SHA-256

d5e772387b59a78bad0f0fe71ccc3123f1e631c7495cd5666b731b6e6cfb4f6b

Source: AppleLedger/AppleLedgerShared/Services/AppLanguage.swift · 127–141

Numbered source excerpt; selected lines preserved.

  127 |     static var selected: AppLanguage {
  128 |         #if DEBUG
  129 |         let processInfo = ProcessInfo.processInfo
  130 |         if let value = processInfo.environment[environmentKey], let language = AppLanguage(value) {
  131 |             return language
  132 |         }
  133 |         if let index = processInfo.arguments.firstIndex(of: launchArgument),
  134 |            processInfo.arguments.indices.contains(index + 1),
  135 |            let language = AppLanguage(processInfo.arguments[index + 1]) {
  136 |             return language
  137 |         }
  138 |         #endif
  139 |         let rawValue = AppSettingsStore.defaults.string(forKey: storageKey) ?? AppLanguage.system.rawValue
  140 |         return AppLanguage(rawValue: rawValue) ?? .system
  141 |     }

Original whole-file SHA-256

e55240c882da8632bce65b040fab307aa4e07fba12294ed488447ad1b0caa370

Numbered excerpt SHA-256

0c4537f83e79b2f38e9f5e966bdbe2746f9a5df5a876b79306cc19d123f70ad3

Source: AppleLedger/AppleLedgerShared/Views/RootView.swift · 115–129

Numbered source excerpt; selected lines preserved.

  115 | private struct AppInitialRoute {
  116 |     var section: AppSection
  117 |     var libraryTab: LibraryTab
  118 |     var quickEntryKind: TransactionKind?
  119 | 
  120 |     static var current: AppInitialRoute {
  121 |         #if DEBUG
  122 |         let arguments = ProcessInfo.processInfo.arguments
  123 |         if let routeArgumentIndex = arguments.firstIndex(of: "-AppleLedgerInitialRoute"),
  124 |            arguments.indices.contains(routeArgumentIndex + 1) {
  125 |             return AppInitialRoute(rawValue: arguments[routeArgumentIndex + 1])
  126 |         }
  127 |         #endif
  128 |         return AppInitialRoute(section: .dashboard, libraryTab: .ledgers, quickEntryKind: nil)
  129 |     }

Original whole-file SHA-256

f0bb697266d3b82c98dfb214e0a91e071bbbdfe8bd83e1f908864c21dca2a9b6

Numbered excerpt SHA-256

b95510fab3811e7afca1a0c19bbfc8fbb7166d64eb07108fddb8721ee810c934

Source: AppleLedger/AppleLedgerShared/Services/AppModelContainer.swift · 341–345

Numbered source excerpt; selected lines preserved.

  341 |     private static var appGroupStoreDirectory: URL? {
  342 |         FileManager.default
  343 |             .containerURL(forSecurityApplicationGroupIdentifier: appGroupIdentifier)?
  344 |             .appending(path: "AppleLedger", directoryHint: .isDirectory)
  345 |     }

Original whole-file SHA-256

5446c56d0591b286adb91933164f3d57ba18ebaf3eca6c6e0d127c4cdec81f26

Numbered excerpt SHA-256

c15b66dab90d09d02b80d9bd3205fe99abfd6dc139804dad96cfe5d1df194225

Source: AppleLedger/AppleLedgerShared/Services/ImportExportService.swift · 436–441

Numbered source excerpt; selected lines preserved.

  436 |     static func saveLatestBackup(_ archiveData: Data, createdAt: Date = .now) async throws -> ManualICloudBackupMetadata {
  437 |         #if canImport(CloudKit)
  438 |         let container = CKContainer(identifier: AppModelContainer.cloudKitContainerIdentifier)
  439 |         guard try await container.accountStatus() == .available else {
  440 |             throw ManualICloudBackupError.accountUnavailable
  441 |         }

Original whole-file SHA-256

dcadccf109343eb36c509f40027ba929a99b8c54cb2329ce6c65b013d8c65eb5

Numbered excerpt SHA-256

6ab26ec700b69059464470a8d49d50be5a8d94545d4d8075bf74cfac87d88fa2

Source: VPNAccountManager/VPNAccountManager/OnlineRouteCatalog.swift · 13–30

Subscription URL values redacted; numbered lines otherwise preserved.

   13 | enum OnlineRouteCatalog {
   14 |     static let sources = [
   15 |         OnlineRouteSource(
   16 |             id: "public-source-1",
   17 |             displayNameKey: "网络来源 1",
   18 |             urlString: "[REDACTED PUBLIC SUBSCRIPTION URL]"
   19 |         ),
   20 |         OnlineRouteSource(
   21 |             id: "public-source-2",
   22 |             displayNameKey: "网络来源 2",
   23 |             urlString: "[REDACTED PUBLIC SUBSCRIPTION URL]"
   24 |         ),
   25 |         OnlineRouteSource(
   26 |             id: "public-source-3",
   27 |             displayNameKey: "网络来源 3",
   28 |             urlString: "[REDACTED PUBLIC SUBSCRIPTION URL]"
   29 |         )
   30 |     ]

Original whole-file SHA-256

93b2c58cd20f34c7fabbe7fda670d7d28b7c98b3a5c3dedb0aa0d586fec7d743

Numbered excerpt SHA-256

74ed4036239b5728ff27d337c57d6f4a8259a773abe0f2c2e14794e2f199a15a

Source: VPNAccountManager/MacAppStore/en-US.md · 15–31

Numbered source excerpt; selected lines preserved.

   15 | ## Description
   16 | 
   17 | VPN XX PRO is a node and subscription manager for people who already have their own subscription links and configuration data.
   18 | 
   19 | Key features:
   20 | 
   21 | • Subscription management: Add, refresh, group, and organize multiple subscription links.
   22 | • Multi-protocol parsing: VLESS, VMess, Trojan, Shadowsocks, ShadowsocksR, SOCKS5, HTTP, WireGuard, Hysteria, Hysteria2, TUIC, Clash/Mihomo YAML, and sing-box JSON.
   23 | • Organized node list: View nodes by subscription group, with search, filtering, and expand/collapse controls.
   24 | • Latency testing: Measure reachability and connection latency through real TCP connections. Results are not simulated.
   25 | • QR import: Import subscription links or node configurations from QR codes.
   26 | • Flexible sharing: Copy links, use the system share sheet, or create QR codes in VLESS, Clash, URI, and other supported formats.
   27 | • iCloud sync: Keep your subscriptions and nodes synchronized across your own Apple devices.
   28 | • Data management: Clear local data, clear iCloud data, or restore data from iCloud.
   29 | • Personalization: Choose from multiple skins and switch the app language.
   30 | 
   31 | VPN XX PRO only manages and parses configuration data supplied by the user. It does not provide VPN servers, create VPN tunnels, or sell network access. Node availability, speed, and content depend on the subscription service provided by the user.

Original whole-file SHA-256

40468f539a782934115155446ef686a2bf8355e3d11bb5b817ca9cb18f3eecdf

Numbered excerpt SHA-256

9da264c90414ba7b4ad309c144e4341f90465a38d90e216943c73f27698b2a92

Source: SuperVPN-iOS/SuperVPNApp/SuperVPNApp.swift · 782–783

Numbered source excerpt; selected lines preserved.

  782 |     static var current: AppProductConfiguration {
  783 |         #if SPELLVPN_ULTRA

Original whole-file SHA-256

137df2925bcb6597bda2605b19f9109727ec3015eaf1aa80f93928c5f7a3ec0e

Numbered excerpt SHA-256

703c631f39a49caf1efe0cace10e30c7a81314068ad0c666fe9607f221777121

Source: SuperVPN-iOS/SuperVPNApp/SuperVPNApp.swift · 808–833

Numbered source excerpt; selected lines preserved.

  808 |         #else
  809 |         return AppProductConfiguration(
  810 |             edition: .pro,
  811 |             distributionModel: "paid",
  812 |             adMode: "none",
  813 |             subscriptionProductID: "",
  814 |             weeklySubscriptionProductID: "",
  815 |             monthlySubscriptionProductID: "",
  816 |             quarterlySubscriptionProductID: "",
  817 |             yearlySubscriptionProductID: "",
  818 |             superWeeklySubscriptionProductID: "",
  819 |             superMonthlySubscriptionProductID: "",
  820 |             superQuarterlySubscriptionProductID: "",
  821 |             superYearlySubscriptionProductID: "",
  822 |             providerLinesEndpoint: "",
  823 |             providerSourceListEndpoint: "",
  824 |             appGroupIdentifier: plistString("SpellVPNAppGroupIdentifier", defaultValue: SuperVPNShared.appGroupIdentifier),
  825 |             admobApplicationID: "",
  826 |             yandexBannerAdUnitID: "",
  827 |             yandexInterstitialAdUnitID: "",
  828 |             yandexAppOpenAdUnitID: "",
  829 |             yandexNativeAdUnitID: "",
  830 |             adsShowPlaceholders: false
  831 |         )
  832 |         #endif
  833 |     }

Original whole-file SHA-256

137df2925bcb6597bda2605b19f9109727ec3015eaf1aa80f93928c5f7a3ec0e

Numbered excerpt SHA-256

03236ad8fcfb5312901ea972ed0f440b0eb0c21dfc5739f8ec1df3aac8435abe

Source: SuperVPN-iOS/Configurations/SpellVPN-Ultra.xcconfig · 35–36

Numbered source excerpt; selected lines preserved.

   35 | SPELLVPN_PROVIDER_LINES_ENDPOINT = https:/$()/apixx.spellv.com/api/spellv
   36 | SPELLVPN_PROVIDER_SOURCE_LIST_ENDPOINT = https:/$()/apixx.spellv.com/api/spellvNodeFlist

Original whole-file SHA-256

4b55f5e8c1879ed1e70dfba420f8d6a8e2300c35e265d0387f0b13071f6bf0f3

Numbered excerpt SHA-256

4aedc8407913ba78a6ec959ac5f2ddaad58da66fd71d3f7a507ef095bf1a4c08

Source: SuperVPN-iOS/SuperVPNApp/SuperVPNApp.swift · 3300–3311

Numbered source excerpt; selected lines preserved.

 3300 |         repairInvalidUltraProviderEndpointOverridesIfNeeded(context: "Curated Sources import")
 3301 |         let product = ultraProviderImportConfiguration
 3302 |         guard let sourceListURL = product.providerSourceListEndpointURL else {
 3303 |             finishUltraProviderImport(success: false)
 3304 |             storeKitStatusMessage = localizedUIString("No provider source-list backend is configured.")
 3305 |             logs.insert(LogEntry(level: .error, category: .connection, message: "Ultra import endpoints unavailable: \(ultraProviderImportDiagnosticSummary(using: product))"), at: 0)
 3306 |             return
 3307 |         }
 3308 |         guard hasMemberAccess else {
 3309 |             finishUltraProviderImport(success: false)
 3310 |             storeKitStatusMessage = localizedUIString("Ultra subscription is required for this action.")
 3311 |             return

Original whole-file SHA-256

137df2925bcb6597bda2605b19f9109727ec3015eaf1aa80f93928c5f7a3ec0e

Numbered excerpt SHA-256

06b433859ce49ed613dbfa90d11b39879639f4d1673c819d8eb0ebd6a476ab92

Source: SuperVPN-iOS/AppStoreReadyPackage/02_AppStore_Metadata/ULTRA_APP_STORE_INTRO.zh-Hans_en-US.md · 59–85

Numbered source excerpt; selected lines preserved.

   59 | 
   60 | Import your subscription URL, proxy link, QR code, or config file, then start an iOS Packet Tunnel in one tap. Ultra is free with ads, and subscriptions remove ads.
   61 | 
   62 | ### Short Description
   63 | 
   64 | SpellVPN Ultra is a VPN configuration client for iPhone and iPad. It helps you import and manage configurations you are allowed to use, including sing-box, Clash/Mihomo, Shadowsocks, VLESS, Trojan, and other common proxy formats. You can import by URL, QR code, clipboard, file, or iCloud Drive, organize nodes, and start a real iOS Packet Tunnel through Apple Network Extension.
   65 | 
   66 | SpellVPN Ultra is free to download and may show ads while no subscription is active. Weekly, monthly, quarterly, and yearly auto-renewable subscriptions remove ads and keep Ultra benefits active. Purchases and restores are handled by Apple ID and the App Store.
   67 | 
   68 | ### Long Description
   69 | 
   70 | SpellVPN Ultra helps you manage your own VPN configurations, subscriptions, and proxy nodes in one place. It is designed for users who already have lawful access to VPN or proxy configurations and need a clean way to import, organize, test, and connect them on iOS.
   71 | 
   72 | Key features:
   73 | 
   74 | - Import subscription URLs, proxy links, QR codes, clipboard text, and local config files
   75 | - Support sing-box JSON, Clash/Mihomo YAML, Base64 subscriptions, and common proxy links
   76 | - Organize node groups, search nodes, switch nodes, and run basic reachability checks
   77 | - Start or stop an iOS Packet Tunnel with one tap
   78 | - View connection status, logs, traffic stats, and basic network information
   79 | - Use DNS lookup, HTTP test, TLS test, IP lookup, and other network tools
   80 | - Back up and restore app data through iCloud Drive
   81 | - Remove ads and keep Ultra benefits active with an Ultra subscription
   82 | 
   83 | Important note:
   84 | 
   85 | SpellVPN Ultra does not provide public built-in VPN server accounts. Users need to import configurations, subscriptions, or nodes they are allowed to use. VPN connectivity and performance depend on the imported configuration, remote server, and current network conditions.

Original whole-file SHA-256

910b646f2dbd80819e5aa862935c9a4fb1962c1b09d55dd57fc1ac73d99a90e2

Numbered excerpt SHA-256

e1dc212dfac353e70f562934186ddc31bbf39d26d9cda494a8a9a63155da5b2a

SHA-256: ec625236af6eafbf2251951167d809ae84e1ba14c60fafa57c534367ddab4357

SHA-256: e971506bb5b6093464446abe722e1cec02643ae6df6a2bd020435e4c8315e4b2

Source: VideoEditorPro/VideoEditorPro/App/AppVariant.swift · 1–22

Numbered source excerpt; selected lines preserved.

    1 | import Foundation
    2 | 
    3 | enum AppDistribution {
    4 |     case paid
    5 |     case freeWithAds
    6 | }
    7 | 
    8 | enum AppVariant {
    9 |     /// The App Store listing for the paid build. Keep this as a universal
   10 |     /// App Store URL so the storefront can localize the product name.
   11 |     static let proAppStoreURL = URL(string: "https://apps.apple.com/app/id6790354436")!
   12 | 
   13 | #if ARTCUT_FREE
   14 |     static let distribution: AppDistribution = .freeWithAds
   15 |     static let displaysAds = true
   16 |     static let displayName = "ArtCut"
   17 | #else
   18 |     static let distribution: AppDistribution = .paid
   19 |     static let displaysAds = false
   20 |     static let displayName = "ArtCutPro"
   21 | #endif
   22 | }

Original whole-file SHA-256

72e091896724be8dca7c2981a23f593c8b3e9a98dd3d4b1f361835180455cf76

Numbered excerpt SHA-256

5e59357e3959e55b04ba12ef0a8e229041ee6b9841f6a51ece760ba0c365eb38

Source: VideoEditorPro/VideoEditorPro/Services/TrackingAuthorizationManager.swift · 34–52

Numbered source excerpt; selected lines preserved.

   34 |     func requestIfNeededBeforeAdRequests() async -> TrackingAuthorizationState {
   35 |         guard AppVariant.displaysAds else { return .notRequired }
   36 | 
   37 | #if ARTCUT_FREE && canImport(AppTrackingTransparency)
   38 |         let current = map(status: ATTrackingManager.trackingAuthorizationStatus)
   39 |         guard current == .notDetermined else { return current }
   40 | 
   41 |         if let requestTask {
   42 |             return await requestTask.value
   43 |         }
   44 | 
   45 |         let task = Task { @MainActor in
   46 |             try? await Task.sleep(nanoseconds: 650_000_000)
   47 |             return await withCheckedContinuation { continuation in
   48 |                 ATTrackingManager.requestTrackingAuthorization { status in
   49 |                     continuation.resume(returning: Self.map(status: status))
   50 |                 }
   51 |             }
   52 |         }

Original whole-file SHA-256

06092d42bedd141bd32f96880f2e5acfd368d4e48a79d5b9d6f5039a3a52d982

Numbered excerpt SHA-256

9fa52ec7f8eb9066e92101a158c010f6c7b0d9d587246f96b2d30d8728141f8b