A prompt library for Codex: from web app to App Store-ready in eight tasks

Audit this web app for use inside a native iOS and Android WebView and fix what you find. Checklist: meta viewport with width=device-width and viewport-fit=cover; no horizontal overflow between 320px and 1024px; tap targets of at least 44x44px; fixed headers, footers and bottom sheets padded with env(safe-area-inset-top) and env(safe-area-inset-bottom); inputs with a font-size of 16px or more; no hover-only controls; images with explicit dimensions to avoid layout shift; readable contrast. Do not redesign; make the smallest changes that pass. Finish with a table of the pages you checked and what you changed on each.

Add two real routes, /privacy and /terms, rendered as readable pages (not modals), linked from the footer and the settings screen. Generate the privacy policy from what this codebase actually does: scan package.json, the API routes and environment variable names, and list every third-party service that receives user data (database, auth, email, analytics, AI providers, payments, push notifications). Use [COMPANY], [ADDRESS] and [EMAIL] placeholders for legal details. Include sections on data collected, purpose, retention, account deletion, children, contact and last-updated date. Keep the language plain. Do not invent processing that the code does not do.

Implement account deletion as required by the App Store (Guideline 5.1.1) and Google Play. 1) Settings screen: a Delete account button with a confirmation dialog that explains the deletion is permanent. 2) A server-side function that, given the authenticated user, deletes all rows owned by the user and then the auth user, using admin credentials on the server only. 3) After success: sign out and show a confirmation screen. 4) A public /delete-account page explaining the in-app steps and offering an email contact for users who no longer have the app. 5) One sentence about deletion in /privacy. Write a test for the server function if the project has a test setup.

Make every data-loading screen resilient. For each fetch or query: a loading state, an empty state with a helpful message, an error state with a Retry button, and a timeout so the UI never hangs. Add a global error boundary with a Reload action instead of a white screen. Watch navigator.onLine and show an offline banner that disappears when the connection returns. Do not swallow errors silently; log them through the existing logger. List every screen you touched.

Create src/lib/platform.ts exporting isNativeApp(), which returns true when navigator.userAgent contains the marker MYAPPNATIVE (the native app sets this user agent). Then, when isNativeApp() is true: hide the cookie banner if it is not legally required, hide Download our app and Open in app banners, hide the desktop header and footer navigation in favor of the in-app bottom navigation, and replace external links to the marketing site with in-app routes. Keep everything unchanged in normal browsers. Do not use CSS-only hiding for anything that affects data loading.

Our app offers Google login. Apple Guideline 4.8 requires an equivalent privacy-focused option, so add Sign in with Apple through our auth provider (check which one the code uses: Supabase, Firebase, Auth.js or Clerk). Add the button following Apple's naming and placement rules, with the same size and prominence as the Google button. Handle the first-login case where Apple returns the name only once, link the Apple identity to an existing account with the same email where the provider supports it, and write the provider-side configuration I must do (Service ID, key, redirect URL) into SETUP.md. Keep email/password login working.

Inside the native app, digital products must be sold through in-app purchases. Find every place where a subscription, credits or a premium feature is sold. When isNativeApp() is true, replace the Stripe checkout with a navigation to revenuecat://purchase?external_id=USER_ID&product=PRODUCT_ID, where USER_ID is our user id and PRODUCT_ID comes from a config map of RevenueCat product identifiers. Add Restore purchases (restoreinapppurchases://) and Manage subscription (cancelinapppurchase://) links to the settings screen, native app only. Entitlements must be granted by our server from the RevenueCat webhook, never by the client. Keep Stripe for browser users. Never show prices with external payment links inside the native app.

Add a push notification opt-in that asks at the right moment. The native app does not ask on first launch; instead, after the user completes [first meaningful action, e.g. creating a first project], show a short in-app explanation of which notifications they will get, with an Enable button that navigates to registerpush:// when isNativeApp() is true, and a Not now option that we remember. On the settings screen, navigate to checkNativePushPermissions:// and read the injected variable nativePushEnabled (poll briefly, it is set asynchronously) to show the current status. In browsers, hide the feature entirely. Do not add a web push service worker.