Some App Store and Play rules are really backend requirements: in-app account deletion that deletes associated data, revoking Sign in with Apple tokens, and keeping push tokens current. How push works through APNs and FCM, what account deletion must do server-side, and the backend pieces a mobile launch needs.
The app registers with Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) and receives a device token, which it sends to your backend.
Your backend sends notifications to APNs or FCM with that token. Use token-based authentication for APNs and FCM's HTTP v1 API; Firebase retired its legacy FCM APIs in 2024.
Tokens change and expire. Update them on each app launch and delete them when APNs or FCM reports them invalid, or sends quietly fail.
Send from a queue, so a large campaign does not block requests and failures are retried.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Since June 30, 2022, Apple has required apps that support account creation to let people start account deletion inside the app. Deletion must remove the account and associated data you are not legally required to keep, including content the user shared, and temporary deactivation does not count. Apps using Sign in with Apple must revoke the user's tokens through Apple's REST API. Google Play has its own account deletion requirement, including a way to request deletion outside the app.
Build one deletion job that knows every place user data lives: database rows, files, search and AI indexes, analytics, email lists, third-party processors.
Tell the user how long it takes and what is retained by law, such as invoices.
Cancel or explain subscriptions billed through the app stores, which you cannot cancel for the user.
Log the deletion itself, without the deleted data, so you can prove it happened.
A minimum supported app version your API can enforce, because old versions stay installed for years.
API versioning that never breaks old clients without a forced-update path.
Receipt validation and server notifications for in-app purchases, if you sell subscriptions.
Deep links (universal links, app links) served from your domain with the right association files.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Timeouts, Retries and Idempotency: The HTTP Habits That Stop Double Charges
Every network call ends in success, failure or "we don't know". The third causes duplicate orders, double charges and stuck jobs. How status codes, timeouts, retries with backoff and idempotency keys fit together, with the limits on API Gateway and Lambda.
Read
Receiving Webhooks Without Losing Money: Signatures, Retries, Duplicates and Order
Payment, auth and email providers tell your app what happened through webhooks. They arrive late, twice, out of order or not at all, and anyone can send a fake one. Using Stripe's documented behaviour as the example, the handler pattern that survives all of it.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.