The App Store night.
You asked for a full night on what gets an app accepted, and for the changes to be applied. Here is what happened, shortest thing first.
Submit on 1 September, not the 31st.
The academy's 2026–27 prices start on 2026-09-01, and an instrument only becomes bookable once a live price exists. So today the booking screen greys out 9 of 12 instruments as “Not open yet”. That is honest, but to a reviewer it is what an unfinished app looks like — and on 1 September all nine open by themselves, with no deploy.
Waiting one day costs you nothing and deletes an argument before it starts.
Your question: is a multi-role login allowed?
Yes. One app with a parent side and a staff side is normal and Apple accepts it. There is one hard condition and failing it is an instant rejection:
So the notes are written and the accounts are ready. What I did not do is hide the staff side — a reviewer who finds it later reads that as concealment, which is far worse.
Something was open on the live API
Anyone could mark any payment as paid
POST /api/payments/stub/confirm was reachable with no login at all. Give it a payment id and it granted the lesson. Its only guard checked for “production”, and the live API is configured as “staging”, so the guard never fired.
Fixed and deployed. It now needs a signed-in caller who owns that payment. Proved live: no token → refused, someone else's payment → refused, your own → works, so the website's booking still functions.
The account Apple will sign into
I signed in as the reviewer and looked. It was a QA sandbox.
- Parent called “Irena”
- Four children: Test Child, Camel Test, Alsn, and “Age Test (delete me)”
- Teacher feedback: “[QA verify 2026-08-08] lesson went well.”
- Lessons all 25 days old, one at 04:27 in the morning
- Home said “Nothing upcoming”
- A 14% tax line the academy does not charge
- Nour Selim and her daughter Yara
- Guitar with Omar Fathy at Mivida, Wednesdays 17:00
- August finished, September running, four lessons ahead
- Four real pieces of teacher feedback
- Home opens on “Wed 2 · in 4 days”
- Correct prices, no tax line
⭐ The teacher demo account is Omar Fathy — the same lessons from the other side. A reviewer can sign in as the parent, then as the teacher, and watch one booking from both ends. Neither account touches a real teacher or a real family.
What else was hiding on real screens
Concerts
16 of the 17 events were test data, five of them published and two taps from the home screen: BM 4.4 rehearsal test, Dual Test Concert, Dual Test 2, Spring Concert QA, Spring Concert QA3. Past concerts held one too — dated in the future. It is a proper season now.
Our teachers
“Demo Teacher B” sat between Ali Hossam and George Ramzy. And the same sentence — “Legacy teachers are available to advanced students.” — printed on twenty rows in a row. Once per tier now.
Payments
It said saving a card was coming, and described a card checkout the app does not have — contradicting what we tell Apple about payments. Now: “Paid at the academy.”
Two icons that looked broken
Privacy policy and Delete account shared a glyph — a square with a line through it, which at that size is the universal “image failed to load”. The one document Apple checks for looked like a missing asset. Both redrawn.
Legal links threw you out to Safari
Two of them sit under the Create account button, so tapping them ejected you from a half-filled form. They open inside the app now.
And one nobody could see
A setting still read “RAISED FOR STAGING TESTING — set back to 8 before real users.” It allowed 500 sign-ups per hour from one address. Back to 8.
Your screenshots are made
Six images at 1320 × 2868 — exactly the size App Store Connect requires. Real screens, status bar set to 9:41, on the brand ground.
The listing text is written too — name, subtitle, keywords, description, age rating and the privacy labels. All of it is in _DOCS/APP_STORE_METADATA.md.
Two things only you can decide
1 · Does Apple get an owner login?
It opens the whole academy — 50 real teachers by name, real children's dates of birth, the financial reports. My recommendation is to give them the parent and teacher accounts only, and say plainly in the notes that an administrator tier exists and is available on request. Nothing is hidden, which is what the rule actually cares about.
2 · The welcome screen
The signed-out screen has the name at the top, then about a third of the screen empty, then the headline and buttons. It may be exactly the poster you intended — but it is also the shape of an image that failed to load, and it is the first thing a reviewer sees. I left it alone rather than redesign it at 1am. Thirty seconds of your eye.
Still blocked on you
- Apple Developer Program, $99/yr — nothing can be signed or submitted without it
- An Expo account (
eas login→eas init) — this also unblocks push notifications, which are otherwise finished - A lawyer's eye on the privacy policy and terms. They are accurate — I wrote them from the database, not a template — but I am not a lawyer
Start here:
_APPS/bandmakers_mobile/SESSION_STATE_2026-08-30.md, then
_DOCS/APP_STORE_SUBMISSION.md and _DOCS/APP_STORE_METADATA.md.