Google Play rejection
If users can create an account in your app, Google requires two things: a way to delete that account from inside the app, and a web page where they can request deletion without reinstalling it. Both are entered in the Data safety section. This guide shows the implementation for the backends vibe coders use most.
From $109 one-time per platform, or let our team do it all from $698.
The rule is part of the User Data policy. Any app that lets people create an account, including sign-up through Google, Apple or another social login, must offer a readily discoverable option to start account deletion inside the app, and a web resource where the same request can be made outside the app. Deleting the account means deleting the data associated with it, unless a law requires you to keep some of it, in which case you say so. Deactivating, anonymizing or "pausing" an account does not count, and neither does asking users to email you from inside the app without a page they can reach from a browser.
The web URL is not a formality: Play Console asks for it in the Data safety form, shows it on your store listing, and reviewers open it. A link that leads to your homepage or to a page that requires the app is a typical cause of this rejection.
A visible button in the account or settings area of your web app, with a confirmation step that explains what will be deleted. After deletion the user is signed out. Because the WebViewGold app shows your web app, this is purely a web change; no native code is involved.
A page such as yourdomain.com/delete-account that works in any browser, explains the steps, and lets a user who no longer has the app request deletion (a login plus the same button, or a verified request form). Linking this page from the privacy policy helps reviewers find it.
Profile, uploaded files, posts, subscriptions, push subscription IDs. If you keep invoices for tax reasons, write that on the page and in the privacy policy, with the retention period.
App content, then Data safety, then Data deletion: confirm that users can request account deletion and paste the public URL. Also mark the deletion options for each data type you declared.
Pick the step for your backend; the web page and Play Console steps apply to everyone.
Create an Edge Function that verifies the caller's JWT, deletes the user's rows in every table (or relies on ON DELETE CASCADE foreign keys pointing at auth.users), removes files from Storage, then calls the admin API to delete the auth user. The service role key lives only in the function. Call it from a "Delete account" button and sign the user out afterwards. The Supabase deletion guide has the full pattern and a builder prompt.
Use a callable Cloud Function with the Admin SDK that deletes Firestore documents, Storage files and finally the Auth user, or call the client-side delete method after a recent sign-in and let the official "Delete User Data" extension clean up the rest. Handle the "requires recent login" error by asking the user to sign in again.
Add a Delete account action to the profile page that calls a backend function. The function removes the user's records from your entities and then the user record itself. If your plan does not include backend functions yet, ship a request form that notifies you and complete deletions manually within a stated time; say so on the page.
Ask your builder for a /delete-account route that is reachable without the app: a short explanation, the in-app steps, and either a login with the delete button or a verified request form (email confirmation link). Add the link to your privacy policy and your footer.
App content → Data safety → Data deletion: answer that users can request deletion and paste the URL. Review the per-data-type deletion answers, save, and resubmit the app. The URL becomes visible on your store listing under the data safety details.
Create a throwaway account in the installed app, delete it, confirm that logging in again fails and that the data is gone. Open the web URL in an incognito browser window and make sure it does not redirect to the homepage.
WebViewGold has allowed us the shortest and most efficient time-to-market ever possible from among all the other app platforms we have ever tried during the past 5 years. I don’t know why I hadn’t discovered you sooner, but I am really, really glad I did. Currently nearing 6000 app downloads on both iOS App Store & Google Play Store without any problem!
A minimal server-side deletion. Keep the service role key in the function's secrets; never ship it in the web app.
import { createClient } from "npm:@supabase/supabase-js@2";
Deno.serve(async (req) => {
const jwt = req.headers.get("Authorization")?.replace("Bearer ", "");
if (!jwt) return new Response("Unauthorized", { status: 401 });
const admin = createClient(Deno.env.get("SUPABASE_URL")!, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!);
const { data: { user }, error } = await admin.auth.getUser(jwt);
if (error || !user) return new Response("Unauthorized", { status: 401 });
// 1. delete the user's rows (or rely on ON DELETE CASCADE)
await admin.from("posts").delete().eq("user_id", user.id);
await admin.from("profiles").delete().eq("id", user.id);
// 2. delete uploaded files, then the auth user
await admin.auth.admin.deleteUser(user.id);
return new Response(JSON.stringify({ ok: true }), { headers: { "Content-Type": "application/json" } });
});Yes. Any way of creating an account in your app, including social logins, triggers the requirement. Deleting the account in your backend is still needed; revoking the Google connection alone is not deletion.
Yes, a request-based process is acceptable as long as the request can be started in the app and on the web page, the timeline is stated, and the deletion actually happens.
Apple requires in-app account deletion under guideline 5.1.1 but does not require a separate web page. Building the web page anyway satisfies both stores with one implementation.
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main page$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demo$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.
App Store & Google Play approval guarantee – or your money back within 14 days
Rather hand it over? Full Service: we configure, build and deliver within 72 hours, from $698 per platform. Questions? Chat with us 24/7.
Refunds are granted under the conditions listed in our FAQ: a non-content rejection by Apple and/or Google, claimed within 14 days after purchase.