Mobile app developer screening questions: store requirements, privacy labels, account ownership and app security
On this page
- Which mobile app developer job is it?
- Which store rules and credentials should you check?
- Knockout questions
- Store, privacy and account questions
- Security and backend questions
- How does mobile app experience get overstated?
- A 15-minute phone-screen flow
- Scoring
- What to put in the submittal
- Lawful phrasing
- Questions people ask
Mobile app developer screening questions should check that the candidate can take an app all the way to users and keep it there: building on the current toolchains, meeting App Store and Google Play requirements, declaring what the app and its SDKs collect, handling accounts, tracking and permissions the way the stores require, and protecting user data on the device. As of November 2026, Apple requires App Store Connect uploads to be built with Xcode 26 and an iOS 26 SDK, and Google Play requires new apps and updates to target Android 16 (API level 36), so a developer who shipped this year has dealt with both. No license applies, and store-policy experience rarely shows on a resume, which is why the screen has to ask for it.
The mobile developer screening questions cover the platform split (native iOS, native Android or cross-platform), the five-minute store-listing check, crashes and staged rollouts. This page adds the parts that sink app projects late: store requirements, privacy disclosures, account ownership, security and children's data. It suits product companies and agencies hiring someone to own an app end to end; for freelance terms, add IT contractor screening questions.
Which mobile app developer job is it?
| Seat | What the work usually is | Ask the candidate |
|---|---|---|
| Product company developer | One app for the long term: features, releases, store updates | "How many releases did you ship in the last twelve months?" |
| Agency or freelance developer | Several client apps from design to store, then handover | "Whose developer accounts did those apps ship under?" |
| Full-cycle or founding developer | The app, its backend (a managed service or own API), push, analytics and the store listings | "What ran on the server side, and who maintained it?" |
| Enterprise or internal apps | Apps distributed privately to staff, often with device management | "How were the apps distributed, and who managed the devices?" |
| Regulated apps | Health, finance or children's apps with extra privacy and security work | "Which rules shaped the app's design, and who signed off?" |
Ask the client which stores and devices, which framework, whether the hire owns the backend, who owns the developer accounts, and whether the audience includes children. Those answers decide half of the screen.
Which store rules and credentials should you check?
As of November 2026. We checked these on Apple's and Google's developer sites, OWASP's site, the Federal Register and Certiport. Store requirements change several times a year; check the live pages before an offer.
- Apple toolchain. Apple's upcoming requirements page says that since April 28, 2026, apps uploaded to App Store Connect must be built with Xcode 26 or later using an iOS 26 (or matching platform) SDK; since September 9, 2026, iOS and iPadOS apps must target iOS 13 or later; and since May 1, 2024, uploads must include approved reasons for listed APIs used by the app's code, including third-party SDKs.
- Google Play target level. Android Developers' target API page says that from August 31, 2026 new apps and updates must target Android 16 (API level 36), with lower levels for Wear OS, Automotive, TV and XR, and existing apps must target Android 15 (API level 35) to stay available to new users on newer devices. Extensions ran to November 1, 2026.
- Privacy disclosures. Apple's App Privacy details must include the practices of third-party partners whose code is in the app, such as analytics tools, ad networks and SDKs, and are required to submit new apps and updates. Google Play's Data safety form is required of every developer with a published app, even one that collects no data, and must cover data handled through third-party libraries and SDKs.
- Account deletion and tracking. Apple's App Review Guidelines say an app that supports account creation must also offer account deletion within the app (5.1.1(v)) and that tracking needs explicit permission through App Tracking Transparency (5.1.2(i)). Google Play's account deletion requirement asks for an in-app path and a web link where users can request deletion.
- Developer accounts. Apple's enrollment page says organizations need a D-U-N-S Number, must be a legal entity, and enroll through someone with authority to bind them; membership is $99 a year in the US. Google's Android developer verification program starts protections on September 30, 2026 in Brazil, Indonesia, Singapore and Thailand, with a global rollout in 2027.
- Children's data. The FTC's amended COPPA Rule took effect June 23, 2025, with most provisions requiring compliance by April 22, 2026.
- Security standard. The OWASP MASVS groups mobile controls into storage, cryptography, authentication, network, platform interaction, code quality, resilience and privacy.
- Certifications. Apple's App Development with Swift Associate and Certified User exams, delivered by Certiport, are entry-level. Nothing else is required.
Knockout questions
| Question | Strong answer | Red flag |
|---|---|---|
| 1. Which apps have you taken from build to live in a store in the last twelve months, and which stores? | App names, stores and months, with their own part in each release. | Nothing shipped this year, for a role that owns releases. |
| 2. The client builds in [Swift, Kotlin, React Native or Flutter]. What share of your last year was in that? | A percentage and a feature they built in it. | Mostly a different framework, without saying so. |
| 3. For agency or freelance work: will the apps ship under the client's own developer accounts? | "Yes. I work as a team member on the client's account; they own the listing, certificates and keys." | Insists on publishing under their own account with no handover plan. |
| 4. The role is [remote, hybrid or on site], with [release schedule]. Does that work? | A clear yes or a stated limit. | Surprised by follow-up checks after a release. |
| 5. Are you legally authorized to work in the US, and will you now or in the future need visa sponsorship? | A direct answer to both, asked the same way of everyone. | None from the answer itself. See work authorization questions in interviews. |
Store, privacy and account questions
-
"When did you last update an app for a new store requirement, and what did that involve?"
- Strong answer: raised the Android target level and fixed the behavior changes that came with it, rebuilt with a new Xcode and SDK, or added required-reason declarations, and names the date.
- Red flags: "The store handles that," or has never heard of target API requirements.
-
"Who filled in the App Privacy details or the Data safety form, and how did you account for SDKs?"
- Strong answer: listed every SDK, checked each vendor's own disclosures, matched the answers to what the app really sends, and updated them when an SDK was added.
- Red flags: "We said we collect nothing," in an app with analytics and advertising SDKs.
-
"Your app lets people create accounts. How do they delete them?"
- Strong answer: an in-app path, the web link Google Play asks for, deletion of associated data on the backend, and a note on anything kept for legal reasons.
- Red flags: "They can email support."
-
"When did your app need the App Tracking Transparency prompt, and how did you decide?"
- Strong answer: asked only when the app tracked people across other companies' apps or sites, did not block features behind the prompt, and kept the privacy label consistent with it.
- Red flags: showed the prompt to everyone at first launch "to be safe," or worked around it.
-
"What would change if the app's audience included children under 13?"
- Strong answer: COPPA's parental consent before collecting personal information, fewer SDKs, no behavioral advertising, the store's rules for kids' apps, and legal review before launch.
- Red flags: "We'd add an age question," with nothing behind it.
Security and backend questions
| Question | Strong answer | Red flag |
|---|---|---|
| Where did the app keep tokens and secrets? | The iOS Keychain or Android Keystore; no API secrets shipped in the app binary. | Tokens in plain preferences, or a server key hard-coded in the app. |
| How did the app talk to the backend securely? | TLS with proper certificate validation, short-lived tokens, refresh and logout that actually end the session. | Turned off certificate checks for testing and shipped it. |
| What ran on the server side, and who owned it? | A managed backend or their own API, with access rules they wrote and tested. | A backend left on default, open access rules. |
| Was the app ever security tested, for example against MASVS? | Who tested it, one finding and the fix. | Never, for a finance or health app. |
| How did analytics and crash reporting stay within what the app disclosed? | Kept personal data out of events and logs, reviewed what each SDK sent. | Logged emails or health data into analytics events. |
How does mobile app experience get overstated?
- "Full-cycle development." Built screens while a lead handled App Store Connect, the Play Console and signing. Ask who submitted the last release.
- Client apps under a personal account. Listed as a portfolio, but the client never owned the listing. Ask how handover worked.
- "Secure app" meaning HTTPS. Ask where tokens lived and whether anyone tested it.
- Backend by console defaults. A managed backend with rules nobody wrote. Ask how access was restricted.
- Privacy labels by someone else. Ask whether they checked the SDKs themselves.
- Old toolchains. Apps that have not been updated since before the current store requirements. Ask what they would need to change today.
A 15-minute phone-screen flow
- Minutes 0 to 2: the app, stores, framework, backend ownership, audience and account ownership.
- Minutes 2 to 5: knockouts 1 to 5.
- Minutes 5 to 10: the store-requirement update and the privacy label question. Write down dates, SDKs and decisions in their words.
- Minutes 10 to 13: account deletion and one security question.
- Minutes 13 to 15: pay or rate expectations (see salary expectation questions), notice and next steps.
Scoring
Pass or fail
- Has shipped to the client's store or stores within the last year.
- Works in the client's framework, or the client accepts ramp-up.
- For agency work, accepts shipping under the client's accounts.
- Answers the work authorization questions in a way that fits the role.
Scored 0 to 2 each (10 possible)
- Store requirements: has met current toolchain and target-level rules.
- Privacy disclosures: accurate labels that cover SDKs.
- Accounts and permissions: deletion, tracking and permission prompts done properly.
- Security: secure storage, network and backend rules, tested.
- Ownership: submitted releases and handled the stores themselves.
What to put in the submittal
Mobile app developer: [name]
Apps live in the last 12 months: [app, store, month, their part]
Framework and languages: [Swift / Kotlin / React Native / Flutter], share of last year
Store requirements met: [Xcode and SDK, Android target level, required-reason APIs]
Privacy labels: [who filled them in, how SDKs were checked]
Accounts: [in-app deletion, web link], tracking prompt [used or not, why]
Security: [token storage, network, backend rules, any testing]
Developer accounts: [client-owned / own account], handover experience
Children's or regulated data: [yes or no, what changed]
Candidate's own gap: [e.g. "has not shipped on Android since 2025"]Lawful phrasing
Ask about apps, stores and decisions, not about the candidate's age or graduation year; the age discrimination guide explains the risk. Ask the sponsorship question the same way of every candidate and never ask about citizenship or national origin. Do not ask anyone to show a former client's source code, signing keys or internal builds; ask them to walk through the public app as any user could. If you give a practical exercise, use the same one for everyone, explain the scoring and offer accommodations on request. The full list of risky questions is in illegal interview questions. This page is not legal advice.
Questions people ask
What should a mobile app developer know about App Store and Google Play rules in 2026?
As of November 2026, Apple requires apps uploaded to App Store Connect to be built with Xcode 26 and an iOS 26 SDK, and Google Play requires new apps and updates to target Android 16 (API level 36). Both stores require privacy disclosures that cover third-party SDKs, and apps that let people create accounts must let them delete those accounts from inside the app.
Who should own the App Store and Google Play accounts when a freelancer builds an app?
Usually the client. Apple's organization enrollment requires a D-U-N-S Number, a legal entity and a person with authority to bind the organization, and the developer is then added to the client's team. Publishing client apps under a freelancer's personal account makes later transfers, signing keys and store listings harder to control.
Does a mobile app developer need a certification?
No license or certification is required. Apple's App Development with Swift Associate and Certified User exams, delivered by Certiport, are entry-level credentials. For experienced developers, apps shipped recently, store requirements met and security decisions they can explain tell a client far more.
Which security standard applies to mobile apps?
There is no single legal standard, but the OWASP Mobile Application Security Verification Standard (MASVS) is widely used. It groups controls into storage, cryptography, authentication, network communication, platform interaction, code quality, resilience and privacy. Clients in finance or health often ask whether a developer's apps were tested against it.