Claude Code prompt library: make your web app App Store and Google Play ready

Audit this web app for use inside a native iOS and Android WebView app and fix what you find. Check: viewport meta tag; no horizontal overflow from 320 px to 1024 px; tap targets at least 44 x 44 px; fixed headers, footers and bottom navigation padded with env(safe-area-inset-top) and env(safe-area-inset-bottom) so nothing hides behind the notch or the home indicator; no hover-only menus; font sizes of at least 16 px in inputs so iOS does not zoom; no desktop-only sidebars; no element that relies on a mouse. Also make the first paint fast: lazy-load heavy components and show a skeleton instead of a blank screen. Report every file you changed and anything you could not fix automatically.

Create /privacy and /terms pages for this app. First inspect the codebase and list every category of personal data we actually collect or process: auth provider and what it stores, database tables with user data, analytics or error tracking SDKs, payment providers, push notification services, third-party APIs that receive user content. Write the privacy policy from that list in plain English with sections for data collected, purpose, third parties, retention, user rights, account deletion (link to /delete-account), contact email, and a note that the iOS and Android apps load this same service. Do not invent practices we do not have. Link both pages from the footer and the settings screen, make them readable on a 320 px screen, and mark any statement you are unsure about with TODO so I can confirm it.

Apple guideline 5.1.1 and Google Play require that users who can create an account can also delete it inside the app. Implement this: a Delete account button in settings with a confirmation dialog that explains the consequences; a server-side function (edge function, API route or cloud function using the admin or service-role credentials only on the server) that deletes all rows belonging to the authenticated user and then the auth user itself; after success, sign the user out and show a confirmation screen; a public /delete-account page that explains the steps for users who no longer have the app installed and offers an email contact. If subscriptions exist, explain in the dialog that the store subscription must be cancelled separately in the App Store or Google Play settings. Add tests for the server function if the project has a test setup.

Reviewers reject apps that show blank screens or raw errors (Apple 2.1, Google Play broken functionality). Go through every data fetch and every route in this app and make sure each has: a loading state (skeleton or spinner), an empty state with a helpful sentence and a primary action, and an error state with a readable message and a Retry button. Add a global error boundary with a friendly fallback. Handle network failures explicitly: when fetch fails because the device is offline, show a message that says so instead of a generic error. Remove console errors and unhandled promise rejections. List the routes you touched.

Our native iOS and Android apps load this web app with a custom user agent that contains the token WebViewGoldApp. Add a small utility isNativeApp() that checks navigator.userAgent for that token, and a data attribute or class on the html element (for example data-native-app) that CSS can target. Then, only when running inside the native app: hide the cookie banner if it is not legally required for app users, hide any Download our app or Open in app promotion, hide the top website header and footer links to marketing pages, hide external social media links or open them with target=_blank so the wrapper can route them to the system browser, and show the bottom tab navigation instead of the desktop menu. Keep the normal website behavior unchanged for browsers.

This app offers Google login (and possibly other third-party logins). Apple guideline 4.8 requires an equivalent privacy-focused option, and Sign in with Apple is the standard answer. Add it using the Apple provider of our auth library (Supabase Auth, Firebase Auth, Auth.js or Clerk: detect which one we use and follow its documented Apple provider setup). Place the Apple button with the same size and prominence as the Google button, following Apple's button guidelines. Handle the case where Apple returns the name only on the first login by storing it on first sign-in. Write down the dashboard steps I must complete in the Apple Developer portal (Services ID, key, return URL) as a checklist in SETUP-APPLE-LOGIN.md. Note: inside the native app, the WebViewGold wrapper detects appleid.apple.com automatically and handles the popup, so no app-specific code is needed for the flow itself.

Inside the iOS and Android apps, digital products and subscriptions must be sold through in-app purchase (Apple 3.1.1, Google Play billing), not through our Stripe checkout. The WebViewGold wrapper integrates RevenueCat and starts a purchase when the page navigates to revenuecat://purchase?external_id=USER_ID&product=PRODUCT_ID (the product ID as shown in the RevenueCat console; external_id is our user ID so RevenueCat can attribute the purchase). Implement: when isNativeApp() is true, the Upgrade and Buy buttons set window.location.href to that scheme with the current user ID and the matching product; in browsers keep Stripe. Add a server endpoint that receives RevenueCat webhooks, verifies the authorization header, and updates the user's entitlement in our database so the web app can unlock features on the next load. Add a Restore purchases link and a Manage subscription link that explains subscriptions are managed in the App Store or Google Play settings. Do not show Stripe prices or external payment links inside the native app.

The native apps support push notifications through WebViewGold. The system permission prompt is triggered when the page navigates to registerpush://, and the current status can be read by navigating to checkNativePushPermissions:// which injects a JavaScript variable nativePushEnabled (true or false) a moment later. Build an opt-in screen that appears once after onboarding or first login, only when isNativeApp() is true: it explains in one sentence what we will send (for example order updates and replies), with an Enable notifications button that navigates to registerpush:// and a Not now link that remembers the choice in localStorage for 30 days. In settings, add a Notifications row that checks nativePushEnabled and, if notifications are off, shows a link that navigates to settingsapp:// to open the system settings. Never trigger registerpush:// on the very first screen of the app.