# Submission Checklist

## Product readiness
- [ ] Final app name chosen and checked for trademark risk.
- [ ] Final logo and icon approved.
- [ ] All placeholder contact URLs replaced.
- [ ] Production Supabase project configured.
- [ ] Mapbox production token configured with domain restrictions.
- [ ] App tested on desktop, laptop, iPhone Safari, Android Chrome and installed PWA mode.
- [ ] Service worker cache version bumped before release.
- [ ] Offline page tested.
- [ ] Guest Mode tested.
- [ ] Signed-in mode tested.
- [ ] Admin panel tested with a restricted admin account.

## Store listing
- [ ] App Store name, subtitle, description and keywords added.
- [ ] Google Play app name, short description and full description added.
- [ ] Screenshots generated from real build.
- [ ] App icon uploaded in required sizes.
- [ ] Feature graphic / promo assets prepared.
- [ ] Release notes added.
- [ ] Reviewer demo account created.
- [ ] Review instructions written.

## Privacy and legal
- [ ] Privacy Policy reviewed by a human.
- [ ] Terms of Service reviewed by a human.
- [ ] Rewards Policy reviewed by a human.
- [ ] Account deletion path added in app and web.
- [ ] Data export/delete process documented.
- [ ] Age/region restrictions decided.
- [ ] Cookie/local storage disclosures checked.
- [ ] Ad network privacy disclosures added when a real ad SDK is connected.
- [ ] Analytics/crash-reporting disclosures added if those SDKs are connected.

## Real-money rewards gate
- [ ] Real payouts disabled by default.
- [ ] Payout provider chosen.
- [ ] KYC/identity process chosen if required.
- [ ] Tax handling reviewed.
- [ ] Fraud rules implemented.
- [ ] Minimum payout set.
- [ ] Daily reward caps set.
- [ ] Manual admin approval enabled.
- [ ] Region availability configured.
- [ ] App Store / Play Store policy review completed.

## Security
- [ ] Cash wallet changes handled server-side.
- [ ] Parcel buys handled server-side.
- [ ] Marketplace transfers handled server-side.
- [ ] Upgrades handled server-side.
- [ ] Admin actions logged.
- [ ] RLS policies tested with non-admin account.
- [ ] API keys restricted.
- [ ] No service-role key included in frontend.
- [ ] No payout credentials included in frontend.

## Launch
- [ ] Beta build tested with at least 5 accounts.
- [ ] Terms acceptance recorded.
- [ ] Support inbox ready.
- [ ] Admin alert process ready.
- [ ] Backup/export plan ready.
- [ ] Rollback plan ready.