> For the complete documentation index, see [llms.txt](https://docs.candy-smith.com/main/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.candy-smith.com/main/general-info/facebook/facebook-app-review-guide.md).
# Facebook App Review Guide
This guide records the agreed review flow: a Facebook test user is optional, the leaderboard uses player names and IDs, and deletion requests are handled through game Support.
### Check the required app settings
Open **App settings → Basic** before starting the review. Meta currently marks the app as ineligible because the following fields are incomplete:
* App icon — 1024×1024 image;
* Privacy policy URL;
* User data deletion URL or instructions;
* Category.
The app must also have at least one platform configured before reviewer instructions can be added.
### Verify `user_friends` in Facebook Login
Open **Use cases → Facebook Login → Permissions and features**. In the current app, `user_friends` is already added and has the **Ready for testing** status. The API call counter is still `0`, so a real test call is required before review.
### 1. Start the review
1. Open Meta for Developers and select the game app.
2. Open **Review → App Review**.
3. Start or reopen the review request.
4. Confirm that the requested permissions are `public_profile` and `user_friends`.
Meta saves many answers automatically. Check each progress indicator before continuing.
### 2. Verification and app settings
Complete business/app verification and required settings for HomeDesignGame.
Use these production values:
* Android package: \
* Privacy policy and data deletion URL example `https://docs.google.com/document/d/14IddMwUWSvTAR46fAe76izwLpbZxvzu6uIkuhhryQ3o/edit?tab=t.0#heading=h.g0z4yzho6nsj`
* Category: **Games**
* Sub-category: **Match 3**
Verify the app name, icon, platform, privacy policy, contact details, and package identifier before continuing.
### 3. Allowed usage
Paste this as the allowed-usage description:
> The game uses `user_friends` to show a friends leaderboard for people who also play the game. After a person signs in with Facebook, the game requests `user_friends` and displays a Facebook-related leaderboard in the game menu. It shows participating friends' player names, profile pictures, and leaderboard scores, helping the person compare progress with friends. The permission is necessary because the leaderboard is limited to friends who also use the game. The game does not access or display friends who do not use it, and it does not post or message on their behalf.
### 4. Data handling
Use this data-handling description:
> The game receives Facebook user IDs, player names, profile pictures, and the list of Facebook friends who also use the game. This data is used only to resolve the corresponding Unity player records and display the friends leaderboard with player names, profile pictures, and scores. The Facebook-to-Unity player mapping and leaderboard data are processed and stored with Unity Technologies / Unity Gaming Services using Unity Cloud Code and Cloud Save. The data is not sold, licensed, or used to post or message on a user's behalf.
### 5. Data protection
Use these answers for the current production build:
* Processor: **Yes** — `Unity Technologies / Unity Gaming Services`
* Processing category: **IT solutions and services, including cloud storage and processing**
* Responsible entity: **Candy Smith, Cyprus**
* National security requests: **No**
* Other policy/process attestations: **None of the above**
* Protected-class profiling, high-impact decisions, and surveillance: **No**
* Selling, licensing, or purchasing Platform Data: **No**
* Service provider sharing: **Yes**, with `Unity Technologies / Unity Gaming Services`
* Tech Provider sharing: **No**
* Other sharing: **No**
### 6. Data deletion through Support
Select **Yes** for the data-deletion questions and paste this process:
> Users can request deletion by contacting the Support or Privacy contact listed in the game or privacy policy and providing the account identifier needed to locate their player record. The developer deletes the player name, Facebook ID mapping, leaderboard record, and related Unity Cloud Save data. Support confirms completion after the deletion is finished.
Do not select **I don’t store Platform Data**: the app stores a Facebook-to-Unity player mapping in Cloud Code and Cloud Save.
### 7. Data security
Use these verified answers for the current build:
* Backend storage: **Yes**
* Stored data: **Meta user ID or hashed user ID** and **Other Platform Data not listed above**
* Hosting: **Other** — `Unity Technologies / Unity Gaming Services (Cloud Code and Cloud Save)`
* Certifications: **None / Not applicable**
* Encryption at rest: **Yes**
* Device storage: **No** — `No. Under no circumstances does anyone in my organization store Platform Data on organizational or personal devices.`
* Follow-up device-storage acknowledgement: **Yes**
* Encryption in transit/TLS: **Yes** for both displayed questions
* Vulnerability reporting channel: **Yes**, through the monitored Support/Privacy contact
### 8. Reviewer instructions and final check
For an Android submission, choose **Use an uploaded .apk**, upload a release-signed production APK, and verify that its package name matches the app settings. Do not use an APK signed with the Android Debug certificate; its Facebook Login key hash may not match the Meta app.
In **App settings → Basic → Android → Provide testing instructions**, use this store-location text when the APK is not published:
> Not published in Google Play. The APK is uploaded directly in the App Review request.
If the platform cannot be persisted because the APK has no verifiable store listing, resolve that Meta-side limitation before submitting; do not use a fake store entry. Test users are optional for this game because the normal Facebook account flow is sufficient.
Paste these reviewer instructions:
> Android package: `com.candysmith.homedesignmatch3kit`
>
> 1. Install and launch the uploaded APK.
> 2. Tap Facebook Login and sign in with a Facebook account. No special Facebook test user is required.
> 3. Grant `public_profile` and `user_friends`.
> 4. Open the friends leaderboard from the game menu.
> 5. Verify that participating friends are shown with their player names, profile pictures, and leaderboard scores.
> 6. Facebook Login is integrated on Android and uses Meta APIs for public profile data and `user_friends`. Facebook IDs are used only to resolve corresponding Unity player records.
> 7. To request deletion, contact the Support/Privacy contact listed in the app or privacy policy and provide the account identifier. The developer deletes the player name, Facebook ID mapping, leaderboard record, and related Unity Cloud Save data. Support confirms completion.
> 8. Use the same Support/Privacy channel to report security vulnerabilities.
Select **Yes** for Facebook Login on Android. Leave access-code fields empty because no paid or restricted test account is required.
Before clicking **Submit for review**, verify every URL, account, permission, video, reviewer step, and deletion procedure in the production build.
### 9. Keep the APK below 200 MB
For this review request, a 170 MB APK was accepted. Treat **200 MB as a safety target**, not as a universal published Meta limit, and leave extra headroom for build changes.
Prioritize these Unity optimizations:
1. Build **ARM64 only** for a direct Meta APK, or split APKs by CPU architecture when the distribution channel supports it. Do not ship ARMv7 and ARM64 in one review APK unless both are required.
2. Compress Android textures with ETC2 or ASTC and reduce the maximum size of large backgrounds. The five stage backgrounds in this project are about 1710×2280 pixels.
3. Convert large WAV files to compressed OGG/MP3 audio.
4. Remove unused scenes and assets from the build. Move optional content to AssetBundles/Addressables or Play Asset Delivery when it does not need to be in the initial install.
5. Use the stronger release compression method and test release minification/stripping. Keep a backup build and verify Facebook Login after each change.
In this project the largest build component is `assets/bin/Data/data.unity3d`; the APK is valid, but its content is too large rather than incorrectly formatted. The separate `17.apk` is a different game and must not be used for this review.
### 10. APK upload troubleshooting
1. Use the direct release-signed `.apk`, not a `.zip`, debug build, or download link.
2. Use Chrome with upload-blocking extensions disabled.
3. After selecting the APK, wait until the upload and server processing finish before clicking **Next** or refreshing the page.
4. If the APK appears in the form but disappears after refresh and the console shows `POST https://developers.facebook.com/api/graphql/` with HTTP 500, the file is not being saved by Meta’s backend. Recheck the draft in a clean browser session; if the same error persists, use the reset procedure in the next section.
### 11. Create a genuinely new review request
In the current Facebook App Review interface, there is no separate **Create new** button. Adding a permission through **Use cases → Facebook Login → Actions → Add to App Review** creates a new request only when no active draft exists. If Meta keeps showing the same `submission_id`, the old draft is still active.
Do not rely on old instructions that mention **Start Over**; that control may be absent in the current interface. If the draft cannot be cancelled and the APK upload returns a GraphQL HTTP 500 error, open **Support → Bugs → Report a Bug**, select the app, choose **App Review** as the affected product, and request that Meta reset/cancel the unsent draft. Include the app ID, submission ID, package name, exact error, and a screenshot. Do not submit a second App Review request until Meta confirms the reset.
Support routing can change: the current App Review and Developer Tools paths may state that individual cases are not handled and redirect to the Developer Community Forum. Do not submit a misleading bug category or publish private app details in a public post; record the exact blocker and use an available Meta support channel or official case route.
#### Other routes and their limits
* The legacy `app-review/permissions` URL redirects to **Use cases** in the current dashboard; it does not bypass the active draft.
* **Actions → Add to App Review** is the normal way to create a request, but it attaches items to the existing draft when one is active.
* **Create test app** creates a separate testing clone with another app ID. It is useful for testing configuration, but it is not a replacement for the production app’s review request.
* **Create New App** from the app selector creates a genuinely fresh app and review state. Use it only if Meta cannot reset the production app, because Facebook Login, Android package/key hashes, URLs, Business settings, and the App Review answers must be configured again.
* Do not use undocumented GraphQL or Graph API mutations to force a submission; they are unsupported and may corrupt the app state further.
