Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageWhat the 2.5 rules say
Section 2.5 covers software requirements. 2.5.1 asks apps to use only public APIs and to use them for their intended purpose; reviewers extend this to capabilities and permissions an app declares but never exercises. 2.5.4 says background modes may only be enabled for the purpose they are meant for (audio, location, VoIP and so on). 2.5.6 requires apps that browse the web to use WebKit, which is exactly what WebViewGold's WKWebView does, so that rule is on your side.
The rejection reads like "Your app includes a usage description for Contacts but we could not find a feature that uses it". Apple's automated checks and the reviewer both look at Info.plist and the entitlements; a recipe app that asks for NFC looks suspicious to both.
Permission texts in the project and the WebViewGold feature behind each
| Permission (Info.plist purpose string) | Used by | Keep it if |
|---|---|---|
| Tracking usage description | App Tracking Transparency, AdMob | Always. The docs state this key is required and that removing it crashes the app. Keep it even without ads. |
| Camera | File uploads from camera, qrcode:// and barcodescanner:// scanners, document scanner, flashlight | Your web app has a camera upload, a scanner or a flashlight button. |
| Photo library (read / add) | Image uploads from the gallery, the file downloader saving images | Users upload or save pictures in your app. |
| Location when in use | HTML5 geolocation with native permission | Your web app calls the geolocation API. Set purpose text that names the feature ("to find gyms near you"). |
| Location always + Background Modes: Location updates | backgroundlocation option | Only with backgroundlocation set to true and a real background use case. Otherwise delete both. |
| Face ID | enableBioMetricAuth or the bioauth:// API | You use biometric login. The biometric docs show the required key. |
| Contacts, Calendars, NFC | Contacts API, iCal API, NFC plugin | You enabled that specific API. Delete otherwise. |
| Background Modes: Audio | HTML background audio | Your app plays audio while minimized (radio, podcasts). Delete otherwise. |
Clean up the project before you resubmit
Delete the purpose strings you do not need
Open Info.plist in Xcode, look at every "Privacy - ... Usage Description" entry and remove the ones for features not on your list. Keep the Tracking Usage Description. The publishing docs describe this step.
Rewrite the strings you keep
Replace the template text with the purpose in your words: "Scan the QR code on your gym card to check in", not "This app needs camera access". Specific text helps with Guideline 5.1.1 as well.
Check Signing & Capabilities
Background Modes should list only what you use: Remote notifications for push, Location updates only with
backgroundlocation, Audio only for background playback. Remove capabilities you added while experimenting.Silence prompts you do not need
If you do not use push, set
askforpushpermissionatfirstrunto false so no notification dialog appears. If you use push but want to ask later, keep it false and callregisterpush://after onboarding.Rebuild, test every permission dialog, bump the build number
Each remaining permission should pop up at the moment the related feature is used and nowhere else. Then upload the new build and reply in Resolution Center with the list of removed keys.
With a good optimized version of your web app you can have a stunning mobile app within a couple of minutes. Additionally to that the customer service is very nice and very helpful! I can just recommend WebViewGold :-)
Other 2.5 findings that reach web-wrapped apps
- Private APIs (2.5.1): only an issue if you let Cursor or Claude Code add native Swift code that calls undocumented methods. Keep native edits to Config.swift and the documented plugins.
- Biometric login (2.5.13): face-based authentication must go through the system LocalAuthentication framework, which is what
bioauth://andenableBioMetricAuthuse. - Background modes (2.5.4): Audio for a non-audio app and Location updates "just in case" are the classic hits.
Prompt: let Claude Code or Cursor audit the project
Prompt for Claude Code / Cursor opened in the WebViewGold Xcode project folder
Audit this WebViewGold iOS project for unused permissions. 1) Read Config.swift and list every native feature that is enabled (push, biometrics, geolocation, scanners, AdMob, file downloads, contacts, NFC, background audio, background location). 2) Read Info.plist and list every Privacy usage description key. 3) For each key, tell me whether an enabled feature needs it. 4) Produce the edited Info.plist with the unneeded keys removed, but keep NSUserTrackingUsageDescription in all cases. 5) Rewrite the remaining purpose strings so each names the concrete feature in my app: [describe your app]. 6) Tell me which Background Modes entries in Signing and Capabilities I should remove. Do not change anything else in the project.
Frequently asked questions
Will removing permission keys break WebViewGold features later?
Only the feature tied to that key. If you enable the QR scanner in a future update, add the camera usage description back in the same update. Removing the tracking key is the one change that breaks the app itself.
Apple cited 2.5.4 but I never touched background modes. Where do they come from?
Check Signing and Capabilities in Xcode. A background mode may have been enabled while following a tutorial for push or location. Remove it there, rebuild and resubmit.
Does the Cloud Builder have this problem?
The Cloud Builder produces the app from the features you enable in the browser, so you do not edit Info.plist yourself. Enable only the features you use and write purpose texts for them.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.