Guideline 4.7.1 - Design: Mini App or Game Not Following IAP or Privacy Rules

Apple is rejecting your app because it hosts mini apps, mini games, or other embedded software experiences that do not comply with Apple's in-app purchase and privacy requirements. If your app is a platform that hosts third-party games, interactive experiences, or app-like content (think HTML5 game portals, chatbot app stores, or plugin marketplaces), each hosted experience must follow the same rules as a standalone App Store app. This means: any digital purchases within mini apps must use Apple's In-App Purchase system (not the mini app developer's own payment system), each mini app must have a privacy policy and adhere to App Store data collection guidelines, and mini apps cannot request permissions beyond what the host app declares. This rejection became more prominent with the rise of 'super apps' and platforms that try to create their own app ecosystems within a single App Store listing. Apple's position is that hosted software cannot be used to circumvent App Store rules — even if the host app itself is compliant, every experience within it must also comply. The fastest compliant path depends on scope. For a small number of embedded games, implementing IAP and privacy compliance for each is feasible. For a large platform, you may need to fundamentally rethink your architecture to route all purchases through your app's IAP implementation.