Guide · Firebase
Firebase Remote Config and App Review
Remote Config is built to change an app without an update. That’s useful, and it’s also exactly what App Review needs to hear about. Here is what to disclose and where to get the list.
By Claudiu Micu · Updated
Why Remote Config needs a note
Firebase describes the product like this:
“Firebase Remote Config lets you dynamically control the behavior and appearance of your applications without requiring users to download an app update or requiring backend redeployments.”
Any parameter that turns a feature on, unlocks content or changes a purchase flow is behaviour the reviewer can’t see in the binary alone. Guideline 2.5.19 asks you not to leave it hidden:
“Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review.”
Parameters and conditions to disclose
Look at each parameter’s default value and its conditional values. Firebase lists the rules that client templates can use:
“App version, OS/platform, device language, country/region, Analytics audiences and user properties, user in random percentile, first app open, client custom signals”
- A country/region condition makes a feature region-gated: say which regions get it.
- A user-in-random-percentile condition is a staged rollout: the reviewer may or may not be in it.
- An app-version condition can switch something on for this version only: say what the reviewer will see.
- A boolean parameter whose default is false but which has code behind it in this build is a dormant feature: describe it or remove it.
Get the list: template JSON or in-app defaults
You don’t need to retype parameters. Firebase lets you download the active template:
“You can download your active template as a JSON file and publish it to the same project or another project.”
For client apps you can also download the defaults file you bundle with the app (Firebase lists XML for Android, PLIST for iOS and JSON for Web). ReviewNotes reads the template JSON, including conditions and parameter groups, and the plist and Android XML defaults, in your browser.
What the export leaves out
“Parameters and parameter values created specifically as variants in an A/B Testing experiment are not included in exported templates.”
If you run Firebase A/B Testing experiments, add those by hand: name the experiment, its variants, and confirm every in-app purchase is visible in each one.
Don’t put secrets in Remote Config
“Don't store confidential data in Remote Config parameter keys or values. Remote Config data is encrypted in transit, but end users can access any default or fetched Remote Config parameter that is available to their client app instance.”
ReviewNotes never copies values that look like keys or tokens into the note, but the safer fix is not to have them in Remote Config at all.
Sources
- App Review Guidelines · Apple Developer · “Last Updated: October 16, 2026”
- Remote Config parameters and conditions · Firebase documentation (Google)
- Remote Config templates and versioning · Firebase documentation (Google)
- App Store Connect Help: App Review information · Apple Developer
Quotes checked on 27 October 2026. Apple and vendors change these pages, so read the current version before you submit. ReviewNotes is not affiliated with Apple.