- [x]**Verified build** uploaded from Codemagic to App Store Connect (splash build; multi-device tiles, transcripts, calls ring; moderation + meeting-push are live web-side).
- [x]**Reviewer demo account** — connect@bizgaze.com / Qwerty@789 (works; non-admin so it sees Report/Block but not the admin Reports view).
- **User Content → Photos or Videos, Other User Content (messages, files)** — App Functionality. (Chat/meeting content stored on your server.)
- **Identifiers → User ID** — App Functionality.
**Diagnostics / Usage:** declare only if you actually collect analytics/crash data. If not, mark **"Data Not Collected"** for those.
**Important clarifications to make in the notes:**
- **Microphone & Camera** audio/video for calls is transmitted between participants (via your LiveKit server) but is only *recorded/stored* when a user explicitly starts a recording or transcript. Say so.
- **Speech recognition** for transcripts runs **on-device** (Apple's `SFSpeechRecognizer`, on-device mode) — the audio is not sent to Apple, and only the finished text is added to the meeting transcript. This is a good thing to state explicitly; it reassures review.
- **Third-party:** if BizGaze/LiveKit are your own infrastructure, no third-party SDK data-sharing to declare. Confirm you have no analytics/ad SDKs.
**Privacy usage strings** (already in the build via `ios-patch.sh` — for reference):
- Camera: "Biz Connect uses the camera for video calls and to share photos and your screen."
- Microphone: "Biz Connect uses the microphone for voice and video calls."
- Speech Recognition: "Biz Connect uses speech recognition to create live meeting transcripts from your microphone."
- Photo Library / Add: send/save images.
---
## 5. Screenshots
Required (App Store Connect accepts one size and scales, but do at least these two):
- [ ]**6.9" iPhone** (1320 × 2868) — iPhone 16 Pro Max class
> Biz Connect requires a BizGaze account to sign in.
>
> Demo account for review:
> Email: << demo@yourdomain >>
> Password: << demo password >>
>
> How to test:
> 1. Open the app and sign in with the demo account above.
> 2. Chat tab: open a conversation to see messaging.
> 3. Start a call from a conversation, or the Meetings tab to start/join a meeting.
> 4. In a meeting, tap "Live transcript" to see on-device speech-to-text.
>
> Notes on permissions:
> • Microphone/Camera — used for voice and video calls.
> • Speech Recognition — used only to generate live meeting transcripts; recognition runs on-device.
> • Screen recording (broadcast) — used only when the user chooses to share their screen in a meeting.
> • VoIP push (PushKit) + CallKit — used to ring incoming calls like a normal phone call.
**Create the demo account now** and confirm it can actually log in and start a call. A dead demo login is the #1 rejection cause for account-gated apps.
---
## 7. Export compliance
The app uses only standard encryption (HTTPS/TLS, WebRTC/DTLS-SRTP) — no proprietary/custom crypto.
- In App Store Connect: **"Does your app use encryption?" → Yes**, then **"only … standard encryption algorithms" → Yes** → qualifies for the exemption (no CCATS/year-end self-classification report needed for standard encryption).
- Optional: set `ITSAppUsesNonExemptEncryption = NO` in Info.plist to skip the question each submission (add to `ios-patch.sh` if you want it permanent — say the word and I'll add it).
- **Account-gated app** → mitigated by the demo account (§6). Also fine per guideline 3.1.1 since it's a business tool, not gating features behind sign-in for a consumer app.
- **User-generated content (chat)** → guideline 1.2 satisfied (shipped 2026-08-19): every message has **Report** (long-press / ⋮ → Report, canned reasons) and **Block user**; blocked users can't message or call you (server-enforced). A **Blocked users** manager lives in the profile menu (unblock anytime), and workspace **admins** get a **Reported messages** review screen (delete content / block / resolve). Reports are org-internal (routed to the workspace's own admins). Reviewer note suggestion: "Report and Block are available on any message via long-press; Blocked users are managed from the profile menu."
- **CallKit + VoIP push** → legitimate; the demo/reviewer flow should show a real incoming call if possible.
- **Background modes** (audio, voip) → justified by calls; the review notes cover it.
---
## 9. Nice-to-haves (not blockers)
- App Store promotional/preview **video** (optional).
- Localized metadata if you target non-English regions.
- A short **"in-app account deletion"** path — Apple requires apps with account creation to offer account deletion (guideline 5.1.1(v)). If BizGaze accounts are created/managed externally (admin-provisioned, not self-signup in the app), note that in review; if users *can* self-register in the app, an in-app "delete my account" (or a clear link to do so) is required.
