App does not engage in deceptive behavior — does what it says, no fake system notifications

Apple guideline 5.6 and Google Play's Deceptive Behavior policy treat deception as grounds for permanent developer account termination, not just rejection. Fake virus or battery alerts (apps cannot access OS-level security state on iOS or Android), claims of phone-cleaning capabilities (impossible in a sandboxed app), and dark-pattern subscription cancellation flows (deliberate friction to prevent unsubscribing) are among the most scrutinized patterns in app review. Under OWASP A05 (Security Misconfiguration) and CWE-451 (UI Misrepresentation), dark patterns that obscure subscription terms also create legal exposure under FTC regulations and EU Digital Services Act enforcement.

Remove all fake system-level alerts and impossible capability claims from notification templates and UI copy. Subscription cancellation must be one tap with a direct confirmation:

// src/screens/Settings.tsx — compliant cancel flow
async function handleCancelSubscription() {
  const confirmed = await Alert.alert(
    'Cancel subscription?',
    'You will retain access until [date].',
    [{ text: 'Keep subscription' }, { text: 'Cancel', style: 'destructive' }]
  );
  if (confirmed) await cancelSubscription();
}

For feature flags (firebase/remote-config, LaunchDarkly), ensure they only gate UI variations that were visible during review. Flags that activate entirely new features after approval constitute a policy violation — all material functionality must be present and reviewable at submission time.