On this page · 17 sections
- The 9 steps at a glance
- Platform rules that shape 2026 and 2027 timelines
- Step 1: Validate the idea before you write code
- Step 2: Scope the MVP (how to make an app that actually ships)
- Step 3: Choose native or cross-platform
- Step 4: Design the experience
- Step 5: Build the backend and APIs
- Step 6: Build in security and privacy (DPDP, GDPR)
- Step 7: Test on real devices and with real users
- Step 8: Submit to the App Store and Google Play
- Step 9: Launch, measure and maintain
- How long does it take to develop an app?
- What drives the cost of developing an app
- For IT teams and businesses
- Common problems and fixes
- How eCorpIT can help
- References
Summary. To develop an app, validate the problem with real users, scope a minimum viable product (MVP), choose native (Swift and SwiftUI for iOS, Kotlin and Jetpack Compose for Android) or cross-platform (Flutter or React Native), design it, build the backend, secure it for laws such as India's DPDP Act and the EU GDPR, test it on real devices, submit it to both stores, then launch and maintain it. The build tools are free; publishing costs US$99 a year for the Apple Developer Program and a one-time US$25 for a Google Play developer account. Four platform rules set the calendar. New personal Play accounts must run a closed test with at least 12 testers opted in for 14 consecutive days, and Google says the production review that follows usually takes seven days or less. New Play apps and updates have had to target Android 16 (API level 36) since 31 August 2026, and Google has said API level 37 follows in August 2027. Apple uploads need Xcode 26 or later now and the iOS 27 SDK from April 2027. Most duties under India's DPDP Rules start on 13 May 2027, with penalties of up to ₹250 crore.
About this article. This is for founders, product managers, engineering leads and IT teams planning a first mobile app. On 11 November 2026 we checked every fee, limit, date and version against Apple Developer, Play Console Help, Android Developers, Flutter, React Native, Firebase, Supabase, Expo and OWASP pages, the PIB summary of the DPDP Rules and the Gazette notification itself. Versions checked: Xcode 27.2 with iOS 27, Android Studio Rabbit 2 (2026.2.2 Patch 1) with Android 17, Flutter 3.47.9 stable and React Native 0.88. This is general information, not legal advice; platforms change rules and prices often, so re-check before you commit, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
The 9 steps at a glance
| Step | What you produce | Number or rule to know |
|---|---|---|
| 1. Validate | Evidence that a defined user group has the problem | Apple may reject apps with too little lasting value (guideline 4.2) |
| 2. Scope the MVP | One core journey, a cut list, acceptance criteria | Over 40% of unresolved App Review issues fall under guideline 2.1, completeness |
| 3. Choose the stack | Native or cross-platform decision | Flutter 3.47 (BSD-3-Clause), React Native 0.88 (MIT) |
| 4. Design | Prototype, design system, store assets | A purpose string for every protected resource the app requests |
| 5. Backend and APIs | Data model, auth, API contract | Firebase Spark: 50,000 reads and 20,000 writes a day; Supabase Free: 500 MB database |
| 6. Security and privacy | Threat model, privacy policy, consent flows | DPDP: grievances answered within 90 days, from 13 May 2027 |
| 7. Testing | Automated tests, device matrix, beta group | TestFlight: up to 10,000 external testers; Play: 12 testers for 14 days |
| 8. Store submission | Developer accounts, listings, signed builds | Apple $99 a year, Play $25 once, target API 36 |
| 9. Launch and maintain | Rollout plan, monitoring, update calendar | Play raises the target API each August; Apple raises its SDK floor each spring |
Each figure is sourced in the step that covers it, chiefly from Apple's App Review page, Google's testing rules and the Firebase and Supabase pricing pages.
Platform rules that shape 2026 and 2027 timelines
Six rules, each checked at source, set the calendar for apps launching now:
- Google Play testing rule. Personal accounts created after 13 November 2023 need a closed test with at least 12 testers opted in for 14 consecutive days before production.
- Target API level. Since 31 August 2026, new apps and updates must target Android 16 (API level 36); the extension window closed on 1 November 2026. Android 17 shipped on 16 June 2026, and Google's February 2026 blog says Play will require API level 37 in August 2027.
- Apple build floors. Uploads need Xcode 26 or later (since 28 April 2026), and iOS apps must target iOS 13 or later (since 9 September 2026). From April 2027, iOS and iPadOS apps must be built with the iOS 27 SDK and target iOS 15 or later; Apple has not yet named the day.
- Android developer verification. Since 30 September 2026, protections cover users who install apps from participating stores on certified devices in Brazil, Indonesia, Singapore and Thailand, with global expansion planned for 2027. Google says Play registers 99% of apps automatically.
- Play fee restructure. New fee tiers apply in the EEA, UK and US from 30 June 2026 and in Australia and Japan from 30 September 2026. India stays on the older 15% and 30% structure until Google rolls the new fees out globally.
- DPDP Rules. Published in the Gazette on 13 November 2025, with most duties starting eighteen months later, on 13 May 2027. Our DPDP Rules checklist maps each rule to its start date.
Step 1: Validate the idea before you write code
Write one sentence that names the user, the problem and what they do today instead. Then test it.
- Search the App Store and Google Play for apps that already solve it, and read their one- and two-star reviews for unmet needs.
- Ask people in your target group how they handle the problem now, not whether they would like your app.
- Put up a landing page or clickable prototype and measure sign-ups, deposits or demo bookings.
- Pick one success metric for the first release, such as weekly users completing the core task.
Validation also protects you at review. Apple's list of common rejections includes apps with too little functionality or lasting value and apps that copy others, and its guidelines turn away apps that are mainly marketing material, web clippings, content aggregators or link collections. If your idea is a website in an app shell, a mobile web app may serve you better.
Step 2: Scope the MVP (how to make an app that actually ships)
An MVP is the smallest version real users can install and use for the core job. Scope it as a list:
- Must have: the single journey that proves value, plus sign-in, error states and a way to contact support.
- Should have: features that improve retention but can wait a release.
- Won't have (yet): everything else, written down so it stops resurfacing.
- Non-functional needs: offline use, languages, accessibility, expected users, and which data you collect.
- Integrations: payments, maps, SMS, analytics. Each one adds a vendor, a contract and a failure mode.
Minimum does not mean unfinished. Apple says that, on average, over 40% of unresolved review issues relate to guideline 2.1, App Completeness, which covers crashes, placeholder content and incomplete information. Write acceptance criteria for every screen.
Step 3: Choose native or cross-platform
This is the decision people mean when they ask how to create a mobile app the right way. There are four realistic options.
| Option | Language and UI | Free tooling | Version checked (11 Nov 2026) | Licence | Pick it when |
|---|---|---|---|---|---|
| Native iOS | Swift, SwiftUI | Xcode 27.2 (macOS only) | iOS 27 SDK; Xcode 26 is the upload minimum until the iOS 27 SDK floor in April 2027 | Free download from Apple | Audience is mostly on iPhone, or you need deep Apple APIs |
| Native Android | Kotlin, Jetpack Compose | Android Studio Rabbit 2 (2026.2.2 Patch 1) on Windows, macOS, Linux, ChromeOS | Android 17 (API 37) is current; Play requires target API 36 | Android SDK under Google's royalty-free licence | Audience is mostly on Android |
| Flutter | Dart, Flutter widgets | Android Studio or VS Code, plus Xcode for iOS builds | 3.47.9 stable; 3.50 in beta, targeted for November 2026 | BSD-3-Clause | One codebase with a custom, consistent UI |
| React Native | TypeScript or JavaScript, native components | Any editor; Expo optional | 0.88 | MIT | Your team already writes React, or you want web code reuse |
Versions, platforms and licences come from each project's own download, release and licence pages.
Three practical points the comparison tables usually skip:
- iOS builds need macOS. Xcode 27.2 requires macOS Tahoe 26.6 or later. Cloud build services can compile iOS apps (Expo's free plan includes up to 15 iOS builds a month), but signing and distribution still need an Apple Developer Program membership.
- You can share logic without sharing UI. Google officially supports Kotlin Multiplatform for sharing business logic between Android and iOS while keeping native screens.
- Versions move fast. Flutter's 2026 schedule lists four stable releases, in February, May, August and November. Budget for upgrades, not just the first build.
For the full decision matrix, read our native vs cross-platform guide. Pick one, write down why, and move on.
Step 4: Design the experience
Design starts with flows, not colours. Sketch the core journey screen by screen, turn it into a clickable prototype, and test it with a handful of target users before engineers start. Then build a small design system: type scale, colours, spacing, and components with empty, loading and error states. Follow Apple's Human Interface Guidelines and Google's Material Design, and plan accessibility from the start: scalable text, sufficient contrast and screen-reader labels.
Two design tasks are review requirements in disguise. Every permission request needs a purpose string explaining why the app wants access; Xcode stores it in the app's Info.plist, and without it access to the protected resource fails and the app may crash. And screenshots must show the app in use, not just title art, a login page or a splash screen (guideline 2.3.3). Xcode 27's Previews and Device Hub, and Live Edit for Compose in Android Studio, help check layouts across screen sizes.
Step 5: Build the backend and APIs
Most apps need a server for accounts, data, files and notifications. You have three routes.
- Backend-as-a-service (BaaS). Firebase and Supabase give you auth, a database, storage and functions without running servers. Firebase's no-cost Spark plan covers 1 GiB of Firestore data, 50,000 document reads and 20,000 writes a day, and Authentication with Identity Platform up to 50,000 monthly active users; Cloud Functions and Cloud Storage need the pay-as-you-go Blaze plan. Supabase's Free plan gives a 500 MB Postgres database and 50,000 monthly active users but pauses projects after a week of inactivity; Pro starts at $25 a month.
- Custom backend. Your own API on AWS, Azure or Google Cloud suits complex logic, enterprise integrations or strict data residency.
- Hybrid. Firebase for push and crash reporting, with business data in Postgres.
Whichever you pick, version your endpoints, use short-lived tokens, check authorisation on the server, rate-limit, and keep secrets out of the app binary. Our Firebase vs Supabase comparison covers scaling, SLAs and migration.
Step 6: Build in security and privacy (DPDP, GDPR)
The OWASP Mobile Application Security Verification Standard (MASVS) groups controls into eight areas: storage, cryptography, authentication and authorisation, network communication, platform interaction, code quality, resilience against reverse engineering and tampering, and privacy. Use it as your checklist.
The stores enforce part of this. Apple requires every app to link its privacy policy both in App Store Connect and inside the app, and since 1 May 2024 it has required approved reasons for listed APIs used by your code and third-party SDKs. Google requires every app on its closed, open or production tracks to complete the Data safety form and link a privacy policy, even if it collects no data; apps active only on internal testing are exempt.
For apps processing personal data of people in India, the DPDP Rules, most of which apply from 13 May 2027, require:
- a separate, plain-language consent notice that explains each purpose;
- telling affected people about a personal data breach without delay;
- a published grievance process that responds within 90 days at most, which the government's summary applies to requests to access, correct, update or erase data;
- verifiable consent from a parent or guardian before processing a child's data, except for listed purposes such as healthcare, education and real-time safety;
- a published contact for data queries.
Penalties reach ₹250 crore for failing to keep reasonable security safeguards, and up to ₹200 crore each for breach-notification failures and children's-data violations. If you serve EU users, the GDPR has applied since 25 May 2018 across the EEA. Treat this as a design input, and take legal advice for your specific app.
Step 7: Test on real devices and with real users
Plan testing in layers:
- Unit and UI tests. Swift Testing and XCTest on iOS, Android's testing libraries, or Flutter's unit, widget and integration tests. Run them on every pull request.
- Device coverage. Test on cheap older phones, slow networks and large text. Firebase Test Lab still allows 10 virtual-device and 5 physical-device tests a day at no cost, but Google has deprecated it and will shut it down on 30 September 2027, with migration to Developer Device Platform on Google Cloud, so do not build a new pipeline on it.
- Beta testing. TestFlight supports up to 100 internal and 10,000 external testers, and your first build for external testers needs App Review approval. On Play, internal testing builds normally reach testers within seconds, and closed testing is where new personal accounts meet the 12-tester, 14-day rule.
- Monitoring. Firebase Crashlytics for mobile apps and Performance Monitoring are no-cost. Watch them during beta, and fix what Play's pre-launch report flags before applying for production.
Step 8: Submit to the App Store and Google Play
Apple App Store. You need an Apple Account with two-factor authentication, and you must be of legal age in your region. Individuals and sole proprietors sell under their personal legal name; an organisation must be a legal entity with a D-U-N-S Number (free in most jurisdictions), a work email on its own domain and a public, working website. In India, enrolment is only available through the Apple Developer app. Membership is US$99 a year (US$299 for the Enterprise Program) in local currency where available, and Apple lists the local price during enrolment. Nonprofits, accredited educational institutions and government entities can request a fee waiver. In App Store Connect, add the listing, privacy details, age rating answers, screenshots and a demo account, then submit.
Google Play. You must be 18 or older and pay a one-time US$25 by credit or debit card; Google Play does not accept prepaid cards. Choose a personal or organisation account, then complete identity verification: Google may ask for a government ID and a card in your legal name, and does not refund the fee if those are found invalid. Personal accounts must also verify access to an Android device through the Play Console mobile app. After the 14-day closed test, apply for production from the Dashboard and answer questions about your test; Google says review usually takes seven days or less. Our guide to uploading an app on the Play Store walks through each Play Console screen.
Step 9: Launch, measure and maintain
Watch crash-free sessions and the core metric from Step 1, and ship small updates often. On Play, staged roll-outs work only for updates, not for an app's first release, so release version two to a percentage of users and widen it as metrics hold. Firebase Remote Config is no-cost up to 100,000 fetch requests a day per project under pricing in effect since 1 September 2026, so feature flags cost little. Then plan the calendar you do not control:
- Every August, Play raises the target API level: API 35 from 31 August 2025, API 36 from 31 August 2026, and API 37 in August 2027 according to Google's blog.
- Every spring, Apple raises its minimum Xcode and SDK version. The latest floor took effect on 28 April 2026, and the iOS 27 SDK floor arrives in April 2027.
- Every year, you renew the Apple membership and review your privacy disclosures.
If you charge money, store fees apply. In India, developers enrolled in Google's 15% tier pay 15% on the first $1M of annual earnings and 30% above it, auto-renewing subscriptions pay 15%, and Google reduces the fee by 4% for transactions through an alternative billing system. Apple's Small Business Program charges a 15% commission to developers with up to $1M in proceeds in the prior calendar year.
How long does it take to develop an app?
The honest answer has two parts: platform waits you cannot compress, and build work that scales with scope. The fixed figures below come from Apple's enrolment and App Review pages and Google's testing requirements page.
| Stage | Fixed or variable | Verified figure |
|---|---|---|
| Apple membership confirmation after purchase | Mostly fixed | Apple asks you to contact it if not confirmed within 24 hours |
| Apple organisation enrolment | Variable | Depends on D-U-N-S and verification; Apple publishes no time |
| Play closed test (new personal accounts) | Fixed | At least 14 consecutive days with 12 or more testers |
| Play production-access review | Mostly fixed | Usually seven days or less, by Google's account |
| App Review | Mostly fixed | At least 50% in under 24 hours, 90% in under 48 hours |
| Discovery, design, build and QA | Variable | Set by platforms, integrations, compliance and team size |
A worked example: a first Android app from a new personal account waits at least 14 days for the closed test, plus a production review that usually takes up to 7 days, so 14 + 7 = about 21 days sit outside engineering. Start the closed test as soon as a stable build exists.
What drives the cost of developing an app
This guide does not quote labour rates; our app development cost in India guide explains what each budget band buys and which numbers are checkable. These are the drivers, with the anchors we could verify.
| Cost driver | Why it moves the budget | Verified anchor |
|---|---|---|
| Number of platforms | Two native codebases mean two builds, two test passes, two release trains | Flutter and React Native ship both from one codebase |
| Store accounts | Fixed and unavoidable to publish | Apple $99 a year; Play $25 once |
| Backend model | BaaS is cheap to start but bills by usage; custom backends need hosting and operations | Supabase Pro from $25 a month; Firebase Cloud Functions $0.40 per million invocations after 2 million a month |
| Build and CI tooling | Cloud builds save Mac hardware but add subscriptions at scale | Expo Free: up to 15 Android and 15 iOS builds a month; Starter $19 a month |
| Integrations | Payments, maps and SMS carry their own fees | Firebase phone sign-in is billed per SMS |
| Compliance | Consent, retention, audit logs and breach runbooks are engineering work | DPDP penalties up to ₹250 crore |
| Revenue share | Store commission on paid apps and in-app purchases | 15% on the first $1M (Play's 15% tier in India; Apple Small Business Program) |
| Maintenance | Annual OS and store deadlines force updates | Play target API rises each August; Apple SDK floor each spring |
Sources: the store and pricing pages cited in the steps above.
For IT teams and businesses
- Enrol as the organisation. Use the company's legal entity and D-U-N-S Number so the business, not an employee, owns the developer accounts and appears as the seller. Apple's guidance for contract developers is that the client organisation enrols, adds the contractor to its team and submits the app itself.
- Internal apps. The Apple Developer Enterprise Program (US$299 a year) is for legal entities with 100 or more employees that distribute proprietary apps privately to staff through secure internal systems or a Mobile Device Management solution, in cases that App Store, custom app, Ad Hoc or TestFlight distribution do not cover. On Android, permanently private apps restricted to one organisation are exempt from Play's target API rule.
- Access and keys. Assign store-console roles on least privilege and keep signing keys and service-account credentials in a vault.
- Data and ownership. Keep a data inventory, sign processing terms with every SDK and cloud vendor, and hold repositories, store accounts and cloud projects in the company's name from day one.
Common problems and fixes
- Production is disabled in Play Console. Your closed test has not met the rule. Keep at least 12 testers opted in for 14 consecutive days, then apply from the Dashboard.
- Rejected under guideline 2.1. Remove placeholder content, fix crashes, and give App Review a working demo login.
- A test build on your iPhone stops opening after a week. Provisioning profiles for a free Personal Team expire seven days after issue. Rebuild and reinstall, or join the Developer Program.
- Play rejects an update. Raise
targetSdkVersionto 36; the extension window closed on 1 November 2026.
- Apple organisation enrolment stalls. Check that the legal name matches your D-U-N-S record, the website is live on your organisation's domain, and you used a work email on that domain.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our mobile app MVP development team takes a validated idea through a fixed-scope first release, store submission and launch. Talk to us at /contact-us/.
Last updated: 11 November 2026.
