store-compliance-pro

Find what will get an app rejected or removed in a specific region before App Review does, and fix it when it already has. This is the deep companion to the always-on apple-regional-compliance.md and android-regional-compliance.md rules. The rules steer while writing; this skill audits the whole app plus its listing, and runs the rejection-response playbook.

Pick the mode from the request:

• Audit: before a release, before adding a storefront or country, or after adding an AI provider, payments, or another regulated feature. Run references/audit.md and check each in-scope region against references/regions.md.
• Respond: a submission was rejected or removed for a region. Follow references/rejection-response.md: classify the finding, choose a fix, sweep the app and listing, and draft the reply.
• Set up: no register exists yet. Create docs/compliance/regions.md and the RegionPolicy seam per references/rejection-response.md ("Register and policy seam").

If doing a partial task, load only the relevant reference file.

Core Instructions

• Region is decided per storefront, and the store decides. Legal scope follows the App Store storefront or the Play account country, never device locale, SIM, or IP. Gating on locale is a finding.
• The listing is part of the submission. Audit metadata (name, subtitle, keywords, descriptions, promotional text, release notes, screenshots, previews) in every locale, and remember an unlocalized storefront shows the primary language.
• Third-party AI brands are the top regional trigger. ChatGPT, OpenAI, Claude, Anthropic, Gemini, Grok, Copilot, DeepSeek, Llama, and similar names in user-facing strings or metadata are a China rejection and a trademark risk everywhere. Code identifiers and dependency names are fine; consent screens may name the provider but must be region-gated with the feature.
• One policy seam. Regulated features ask a single injected RegionPolicy. Scattered country-code comparisons, or none at all, are findings.
• Prefer the fix that removes the risk. Excluding a storefront, or a build flavor without the feature, beats runtime gating when the law forbids the feature outright; runtime gating still ships the strings and SDKs.
• Never invent a license or filing number, never advise misleading reviewers, and never suggest geo-evasion (VPN-only detection, hiding features from review accounts). Compliance claims in review notes must be true.
• Mark uncertainty. Regulations change; cite the guideline or policy section and say when a requirement should be re-checked against the current text.
• Severity by consequence: blocking (will be rejected or removed in a storefront you ship to: AI brand mentions for China, missing ICP or game license, missing EU trader status, licensed feature without a license, data collected before consent on Chinese Android stores) > exposure (gated on locale instead of storefront, unknown storefront fails open, regulated feature reachable from a shortcut or notification, no register) > hygiene (provider names in strings that are currently gated, a register missing a "last verified" date).
• Cross-reference, don't duplicate: age ratings and privacy manifests go to apple-testflight-deployment.md; Data safety to android-play-beta-deployment.md; AI consent and provider wiring to apple-foundation-models.md and android-ai-best-practices.md; generic strings to the localization rules.