Deploy a Vibe Coded App: Vercel vs Netlify and Ops

How to deploy a vibe coded app without a surprise bill

Updated October 30, 2026

Deploy a vibe coded app on a host that allows your use, and set a spending cap before the first paying client books. This is Step 8 of 12 in the guide. You leave this page with a host choice for Bookly, a spending cap, three monitors, and a playbook for the app is down and surprise bill incidents.

Vercel vs Netlify is the first decision. Vercel Hobby is for personal, non-commercial use only, so Bookly needs Vercel Pro at $20 a month or a host whose free plan allows commercial use. Netlify's Free plan allows commercial use, but it stops at 300 credits a month.

Each host stops spending in its own way. Vercel can pause production at a budget, Railway takes services offline at a hard limit, and Cloudflare sends alerts only. Learn the stop rule for each host before launch, not after the first bill.

Hosting & Deployment

Vercel vs Netlify for an AI-built app: plans, limits and spend caps

Both hosts have a free plan and a $20 paid plan. The free plans differ on commercial use, billing model and what stops your spending.

Can you run a paying business on a free plan?

Vercel Hobby is for personal, non-commercial use only. Bookly takes client deposits, so Bookly is a commercial app. It needs Vercel Pro at $20 a month, or a host whose free plan allows commercial use. Netlify's Free plan allows commercial use, but it has a hard limit of 300 credits a month and no automatic recharge.

Plans side by side

Plan	Price	What it includes
Vercel Hobby	$0 per month	100 GB Fast Data Transfer, 1M CDN requests, 1M function invocations, 4 CPU-hours of Active CPU and 360 GB-hours of memory. Personal, non-commercial use only.
Vercel Pro	$20 per month	$20 monthly credit, 1 TB Fast Data Transfer, 10M CDN requests and one billing seat. Each developer seat is $20 a month. Viewer seats are free.
Netlify Free	$0 per month	300 credits, about 15 GB of bandwidth. Hard limit with no automatic recharge. Commercial use is allowed.
Netlify Personal	$9 per month	1,000 credits per month.
Netlify Pro	$20 per month	3,000 credits per month. Automatic recharge adds 1,500 credits for $10.

Vercel Pro is pay-as-you-go and uncapped by default. Each new team gets a default $200 On-Demand Budget, which you can change. Usage above the included amounts is billed.

What a deploy costs in Netlify credits

Netlify bills in credits. A production deploy costs 15 credits, so the Free plan's 300 credits pay for about 20 production deploys if nothing else uses credits (300 divided by 15).

Bandwidth costs 20 credits per GB, so 300 credits is about 15 GB.
10,000 web requests cost 2 credits.
Compute costs 10 credits per GB-hour.
Form submissions are free.

Netlify's separate AI Credit Usage Limit applies to Agent Runners only. It is not a general spending cap.

Seats and team size

On Vercel, each developer seat is $20 a month, and viewer seats are free. Count your seats before you add a second developer. Check the seat rules on Netlify's pricing page before you do the same there.

Logs and limits you will feel during an incident

Vercel Hobby keeps runtime logs for 1 hour. Pro keeps them for 1 day.
Vercel Hobby allows 100 deployments per day. Pro allows 6,000.
The maximum function duration is 300 seconds on both plans. Pro can be set up to 800 seconds.
DDoS mitigation is on by default on both plans, with an optional Attack Mode.

Send errors to Sentry as well. A 1-hour log window is short for an incident that starts on a Friday night.

Databases on each host

Netlify advertises native Postgres. Vercel's own comparison page says databases come through the Vercel Marketplace. Choose the database first, then choose the host that connects to it most simply.

When to pick Cloudflare, Railway, Render or Fly.io instead

Use one of these hosts when its free plan or cost model fits your app better than Vercel or Netlify.

Cloudflare Workers and Pages

Static asset requests are free and unlimited. Requests that run your Worker, such as server rendering or an API, are billed.

Workers Free: 100,000 requests a day, 10 ms CPU per invocation
Workers Paid: $5 a month minimum, with 10M requests and 30M CPU-ms included, then $0.30 per extra million requests
Pages Free: 500 builds a month, 20,000 files per site, 25 MiB per file, 100 projects per account

Static and edge

Railway

Usage-based. You pay for what runs above the usage included in your plan.

Hobby: $5 a month with $5 of usage included. Pro: $20 a month with $20 of usage included
Rates: RAM $10 per GB a month, CPU $20 per vCPU a month, egress $0.05 per GB, volumes $0.15 per GB a month
Builds are not charged

Services and databases

Render

Flat workspace plans since April 23, 2026. Free web services sleep when idle.

Hobby: $0 (1 member, 25 services). Pro: $25 a month flat. Scale: $499 a month flat
Free web services sleep after 15 minutes without traffic, so the next visitor waits for a cold start
750 free instance hours per workspace per month. A Free Postgres database expires 30 days after creation

Simple web services

Fly.io

Pay as you go, with Docker containers in the regions you choose.

New organizations get no free allowance, only a trial of up to 2 hours of Machine runtime or 7 days
shared-cpu-1x 256 MB: $2.19 per 30 days in iad or ewr, billed per second
Volumes $0.15 per GB a month. Outbound bandwidth $0.02 per GB in North America and Europe

Docker and regions

Prices for ChatGPT, Magic Patterns, Rork and Namecheap are not listed on this page. Read each vendor's pricing page: ChatGPT, Magic Patterns, Rork and Namecheap.

Spending caps and billing alerts on each host

A cap stops charges. An alert only sends a message. Set the monthly amount you can pay before launch, and know what each host does at that limit.

Host	Stops at a limit?	What you get
Vercel	Partly. An optional pause of production deployments at the budget.	The On-Demand Budget defaults to $200 on new teams, with alerts at 50%, 75% and 100% (SMS at 100%). The pause takes a few minutes to start, and visitors then see a 503 DEPLOYMENT_PAUSED error.
Railway	Yes, at a hard limit of at least $10.	Email reminders at 75%, 90% and 100%. At the hard limit, all workloads go offline. Raising or removing the limit restarts services.
Supabase	Yes on Pro. The spend cap is on by default.	A Free project pauses after one week of inactivity instead, and a paused database takes the app down.
Netlify	Yes on Free. Hard limit.	Pro adds credits automatically (1,500 credits for $10), so the limit moves up with use. The AI Credit Usage Limit covers Agent Runners only.
Cloudflare	No. Alerts only.	A default $10 account-level alert applies to eligible pay-as-you-go accounts since June 2026. Alerts run daily on the prior day's usage. Spend limits from June 5, 2026 cover AI Gateway only.
Fly.io	No.	No billing alerts and no soft ceiling. Use prepaid credits, or watch the month-to-date bill.
Sentry	Yes on Team and Business.	Set a maximum spend threshold. The free Developer plan has no spend threshold.
PostHog	Yes, a billing limit.	Ingestion stops at the limit, and data over the limit is lost for good. PostHog emails you at 80% and 100%.

Set Vercel's budget from the command line with vercel budgets set --amount 200 --pause. The command needs vercel@59.23.0 or later, and an Owner or Billing role on the team.

In Railway's Workspace Usage, set a soft limit for an email alert and a hard limit for the shutdown. For example: railway usage limit set --target workspace --soft 75 --hard 125. The hard limit must be at least $10.

Alerts are not caps

Cloudflare's billing alert is informational. Its own text says it "does not cap your usage or impact your account in any way." Treat Cloudflare as a host you must limit in your own code.

Set the limits in this order

1Set the hard limit or budget at the most you can pay in a month.
2Set a warning below that level. Vercel's pause takes a few minutes to start, so set the budget below your true maximum.
3Add a rate limit to every route that calls a paid API or writes data.
4Add a kill switch: one setting that turns off the paid feature without a redeploy.

Two real cost traps

In March 2024, a Netlify customer received a bill above $100,000 after a DDoS attack repeatedly requested one large file. Cybernews reported the case.
In May 2026, a developer posted that a Cloudflare Workers queue loop had produced a bill of about $36,000. The figures are the developer's own account.

The usual trap is a loop in your own code, or an attack on one URL. Rate limits and a kill switch in the app stop the loop. Host alerts only tell you that it happened.

Bookly's cost picture (illustration)

This is an illustration built from the list prices above, not a measured bill. Vercel Pro at $20 a month, Supabase Pro at $25 a month and Resend Pro at $20 a month for confirmation emails make $65 a month, the base figure on the architecture page. Sentry Developer, UptimeRobot Free and BetterStack Free add $0. Stripe adds 2.9% and $0.30 for each domestic card payment. An all-free setup costs $0, but Supabase Free pauses after a week of inactivity, which takes a small salon's booking page down in a quiet week.

Branch Protection Rules

Require PR reviews: No direct pushes to main. All changes go through pull requests.
Require status checks: PRs can't merge until CI tests pass.
Require linear history: Force rebase or squash merges for a clean git log.

Rollback Procedures

Vercel: Use Instant Rollback to return to an earlier deployment. Vercel also offers Rolling Releases for gradual rollouts.
Netlify: Netlify keeps every deploy, so you can publish an older one.
Railway, Render, Fly.io: git revert the bad commit and push. Git-level rollback is covered on the workflow page.

Immutable Deployments

Vercel and Netlify keep every deploy. If production breaks, return to a previous deployment. Test each pull request on its preview deployment before you merge.

Environments and secrets on your host

One host, several environments. Each one gets its own data and its own keys.

Run at least two environments: production for paying clients, and a staging or preview copy for testing.
Use a separate Supabase project for staging. Test traffic must never reach the production database.
Set environment variables for each environment separately. Mark production secrets as sensitive on Vercel, as the April 2026 bulletin advises.

This page covers where secret values live on the host. The rules for handling them in code are on the vibe coding security page.

Monitoring & Analytics

Monitoring

Know when things break before your users tell you.

Sentry

Error tracking. Developer (free): 1 user, 5,000 errors a month, 30-day lookback. Team: $29 a month ($26 billed yearly) with 50,000 errors and a maximum spend threshold.

Must Have

LogRocket

Session replay. Watch exactly what users did before a bug occurred. See their clicks, scrolls, and console errors.

Debugging

BetterStack

Logs, uptime checks and status pages. Free: 10 monitors and heartbeats, 1 status page, and 3 GB of logs kept for 3 days. Responder: $34 a month, or $29 a month billed yearly.

Logs

UptimeRobot

Checks your site every 5 minutes and alerts you when it is down. Free: 50 monitors, allowed for commercial projects, 5 integrations, and no included SMS or voice credits.

Uptime

Analytics

PostHogAll-in-One

Free each month: 1M events, 5K recordings, 1M flag requests, 100K exceptions and 10 GB of logs.

Combines product analytics, session replay, feature flags, and A/B testing into a single platform
Self-hostable for complete data ownership and privacy compliance
Official React and React Native SDKs available
Billing limits stop ingestion. Data over the limit is lost, and PostHog emails you at 80% and 100%

PlausiblePrivacy-First

Starter is $9 a month for 10K pageviews and 1 site. Growth is $14 a month for up to 3 sites. Business is $19 a month for up to 10 sites.

Privacy-friendly, with no cookies
A 30-day free trial with no card. Yearly billing is two months free
Cookie consent rules for your other tools are on the legal page

Google Analytics 4Most Features

Free. Google receives all of the data.

Most feature-rich analytics platform, but all data is sent to Google servers
Usually needs a cookie consent banner for EU visitors. The legal page covers consent
Configuration can be complex for accurate event and conversion tracking

Bookly's three monitors

Set up three uptime monitors for Bookly: the home page, the booking route, and the Stripe webhook URL. Sentry catches errors inside the app. An uptime check catches an outage that the app cannot report itself, such as a paused database.

Recommended Monitoring Stack for Vibe Coders

Errors: Sentry Developer, free. Uptime: UptimeRobot Free. Logs: BetterStack Free. Analytics: the PostHog free tier, or Plausible Starter at $9 a month. Sentry Developer, UptimeRobot Free and BetterStack Free cost $0 together. Add Plausible Starter for $9 a month if you want a privacy-first analytics tool.

Payments & Billing

Webhook checks and duplicate events

Verifying the Stripe-Signature header, reading the raw request body, and skipping duplicate webhook events are covered on the vibe coding security page. Do not ship a payment webhook until it passes those checks.

Test Mode Keys

Use sk_test_... for dev. sk_live_... for prod. Never mix them. Test cards run in test mode only.

4242424242424242Succeeds

4000000000009995Declined with insufficient_funds

4000002500003155Requires authentication, unless the card is set up for future payments

On-session payments always need authentication. Off-session payments need it unless the card was set up for future use.

Stripe Test-to-Live Checklist

Switching from test mode to live mode is one of the most common launch failures. Follow this checklist exactly.

Swap sk_test_ and pk_test_ to sk_live_ and pk_live_ in environment variables

Update webhook endpoints (live mode uses separate signing secrets)

Verify Stripe account is fully activated (identity verification and a bank account connected)

Recreate products and prices in live mode (test mode products don't exist in live mode)

Update product and price IDs in your code to match live mode IDs

Test a real $1 charge and immediately refund it to confirm the full flow

Subscription State Machine

Handle all subscription states, not just "active."

active

Full access

trialing

Free trial period

past_due

Payment failed, retrying

canceled

Access until period end

unpaid

All retries exhausted

Smart Retries: Stripe's recommended default is 8 retries within 2 weeks. A custom retry schedule allows up to 3 retries. Hard declines are not retried until the customer adds a new payment method. Set the schedule in your Stripe billing settings.

After the last retry: choose what happens to the subscription: cancel, mark it unpaid, leave it past due, or pause it. In your code, act on the invoice.payment_failed event and read its attempt_count.

Subscription Cancellation Flow

AI-generated code rarely builds cancellation well. Make cancelling as easy as signing up, and keep the steps below in order.

User Clicks Cancel

Show a confirmation with what they'll lose

Grace Period

Access continues until billing period ends

Downgrade

Revert to free tier, keep data intact

Win-Back Email

Send 7 days later with a discount offer

Legal Requirement

Cancellation must be as easy as signup. The EU now requires an easy withdrawal function for online contracts, and in the US the FTC's 2024 click-to-cancel rule was vacated, but ROSCA and state auto-renewal laws still apply. The legal page covers the rules and dates.

Payment processor: decided before launch

Bookly uses Stripe, chosen on the architecture page, which compares Stripe with merchant-of-record options (Paddle, Lemon Squeezy, Polar and Stripe Managed Payments), their fees and the revenue level where the choice changes. At deploy time, the job is the switch from test mode to live mode in the checklist above.

Operations & Incident Response

Incident Playbooks for Bookly

When something breaks, work the runbook. Don't improvise.

The app is down

Illustration: the Bookly booking page shows errors on a Saturday morning, and clients cannot book.

1Check the status pages of your host, Supabase and Stripe.
2Check the deployment logs. Bookly is on Vercel Pro, which keeps runtime logs for 1 day; on Hobby it is 1 hour, so copy the errors into Sentry while they are fresh.
3Check the database in the Supabase dashboard: connections, slow queries and the project status. Bookly is on Supabase Pro, which does not pause. On the Free plan, a project that paused after a week of inactivity is down until you restore it.
4Roll back to the last good deployment. On Vercel, use Instant Rollback. On Netlify, publish an older deploy.
5Tell clients that you are aware and investigating, even before you have a cause. Silence damages trust faster than downtime.

Surprise bill

Illustration: a bot floods the Bookly availability route over a weekend, and the host bill climbs.

1Open the billing dashboard and find the line that grew: compute, bandwidth, the database or a monitoring tool.
2Turn on a cap now. Vercel's pause stops production deployments, Railway's hard limit takes workloads offline, and Supabase Pro's spend cap is on by default.
3Stop the loop. Add a rate limit to the route, and disable the job or queue that keeps re-sending work.
4Ask the host for a credit, and send the timeline of the incident with the request.
5Keep the invoice lines and the timeline with the incident notes.

Host or vendor breach

Real case, April 2026: an attacker compromised a third-party AI tool used by a Vercel employee, reached internal systems, and decrypted environment variables that were not marked sensitive for a limited set of customers. Vercel closed the incident on October 16, 2026.

1Read the vendor bulletin and check whether your project was in scope.
2Rotate every environment variable that is not marked sensitive: API keys, tokens and database credentials.
3Rotate secrets before you delete a project. Vercel says that deleting projects or the account is not sufficient.
4Mark secrets as sensitive. Turn on multi-factor authentication with an authenticator app or a passkey. Review the activity logs. Set Deployment Protection to Standard at minimum.

Leaked key or reported vulnerability

Illustration: a Stripe secret key appears in a public repository.

1Revoke the exposed key at its provider first.
2Create a new key and store it only on the server, in a variable marked sensitive where the host supports it.
3For a reported vulnerability, thank the reporter, then check the Row Level Security (RLS) policies in Supabase right away.
4Patch critical issues, taking the app offline if needed. Record the timeline and the data that the exposed key could reach. The legal page covers notice duties.

Vendor breach: the April 2026 Vercel incident

Vercel's bulletin says the attacker reached internal systems through a compromised third-party AI tool and decrypted environment variables not marked sensitive, for a limited set of customers. Vercel's guidance is to rotate every variable that is not marked sensitive, rotate secrets before deleting projects, mark secrets sensitive, turn on multi-factor authentication, review activity logs, and set Deployment Protection to Standard at minimum.

Domain Registrars

Where you buy your domain matters. Renewal prices and first-year sale prices can differ.

Porkbun

Non-premium domains, 1 year, including ICANN fees: .com $11.08 for registration, renewal and transfer, so renewal has no markup. .dev $12.87 and .io $51.80. Sale prices for the first year are lower.

Cloudflare Registrar

Sells domains at registry cost with no markup, across more than 430 TLDs. Its page does not list a .com price.

Avoid Hosting Provider Domains

Keep domain registration separate from hosting, so you can change hosts without moving the domain.

Feature Flags at the Simplest Level

Deploy code to production but keep new features hidden until you are ready to launch them.

An environment variable works as a basic flag, but it needs a redeploy to change. For real-time toggles, use a hosted flag service:

Flagsmith

Open source. Free up to 50,000 requests a month. Start-Up plan: $40 a month billed yearly ($45 billed monthly).

LaunchDarkly

Developer plan is free, with 5 service connections and 1K client-side MAU. Foundation has no platform fee and costs $10 per service connection a month billed yearly, with the first 5 included.

Covered on other pages

Dependency audits (npm audit, pip-audit and Dependabot alerts) are in the supply chain item on the security page.
Schema decisions, missing indexes and the caching model are on the architecture page.
Debugging with an agent, editor extensions and browser DevTools are on the workflow page.

Mobile Deployment

Expo Ecosystem Overview

Expo is the React Native framework that makes mobile development accessible to vibe coders.

Expo ships a new SDK about every three months. SDK 57 is current, released June 30, 2026. Starting a new project means starting on the current SDK.

Key Packages

expo-router: File-based routing (every file in /app becomes a route)
expo-notifications: Push notification handling for iOS and Android
expo-camera: Camera access with barcode scanning
expo-image: Performant image component with caching

SDK Release Dates

SDK 57: June 30, 2026 (current)
SDK 56: May 21, 2026
SDK 55: February 25, 2026

EAS Build, Submit, and Update

Expo Application Services (EAS) handles cloud builds, store uploads, and over-the-air updates.

EAS BuildCloud-based builds without Xcode or Android Studio locally

Free

No monthly fee

15 Android and 15 iOS builds. Low priority queue. 45-minute build timeout. 1,000 update MAUs.

Starter

$19 a month plus usage

$45 build credit. 3,000 update MAUs. High priority builds. 2-hour build timeout.

Production

$199 a month plus usage

$225 build credit. 50,000 update MAUs. 15 concurrent builds (10 on macOS). 2-hour build timeout.

Plan prices and credits:

EAS SubmitUpload builds directly to App Store and Google Play

# Submit to iOS App Store

npx eas submit --platform ios

Cloud builds through EAS do not need a local Mac, so you can build an iOS app from Windows or Linux.

EAS UpdateOver-the-air JS updates without app store review

Push bug fixes without waiting for review. The critical constraint: OTA updates can change only JavaScript and assets, such as styling and images. Native code, permissions, bundle identifiers and native dependencies need a full build and store submission.

Apple guideline 2.5.2 also bars apps from downloading code that changes what the app does. Apple cited that rule in March 2026 when it blocked updates to Replit and Vibecode. Updates still have to follow store rules.

Expo Go vs Development Builds

Expo's May 4, 2026 guidance: for anything beyond learning, move to a development build. To test SDK 55 or 56 on a physical iPhone, use eas go. It delivers the build through TestFlight and needs an Apple Developer membership. Expo Go for SDK 55 was still waiting for App Store approval on that date.

Development builds are required for: push notifications, custom native modules, production-accurate testing, and custom splash screens or icons.

# Build locally for iOS

npx expo run:ios

# Or build in the cloud via EAS

npx eas build --profile development

Never ship an app that only works in Expo Go. Once built, development builds only need rebuilding when native code or configuration changes.

App Store Submission Timelines

Build buffer time into every launch plan. First submissions take longer.

Apple App Store

Apple says it reviews at least 50% of submissions in under 24 hours and 90% in under 48 hours
Apple gives no fixed time for a first submission. Apps that need greater scrutiny can take longer
Apple requires uploads since April 28, 2026 to use Xcode 26 or later

Google Play

Google's help pages say review can take up to seven days, or longer in exceptional cases
New personal accounts (created after November 13, 2023) need a closed test with at least 12 testers opted in for 14 consecutive days before you can apply for production access
From August 31, 2026, new apps and updates must target Android 16 (API level 36) or higher

Plan at least two weeks for Google Play on a new personal account. The 14-day closed test runs before you can apply for production access. Leave extra time on your first Apple submission for a possible rejection and resubmission.

Developer Program Costs

Apple Developer Program

$99 a year

$99 USD per membership year. Fee waivers exist for eligible nonprofits, schools and governments.
Required for App Store distribution and TestFlight
Small Business Program: 15% commission instead of 30% for developers with no more than USD 1M in proceeds in the prior and current calendar year. You must enroll. Above USD 1M, the standard rate applies to future sales.
Organization accounts need a D-U-N-S number. Sole proprietors enroll as individuals.

Google Play Developer

$25 one-time

No annual fee
US, UK and EEA from June 30, 2026, and Australia and Japan from September 30, 2026: 10% on the first $1M of yearly earnings, plus a 5% billing fee when Play Billing is used. Subscriptions pay 10%.
Other markets: 15% up to $1M and 30% above that. Subscriptions pay 15%.
Organization accounts need a D-U-N-S number.

Hidden costs: Local iOS builds need a Mac with Xcode. Cloud builds through EAS avoid that. Apps uploaded since April 28, 2026 must use Xcode 26 or later, and since September 9, 2026, iOS and iPadOS apps must target iOS 13 or later. You need a privacy policy URL in App Store Connect and inside the app.

D-U-N-S Number for Organization Accounts

A D-U-N-S Number is a free nine-digit business identifier from Dun and Bradstreet (D&B). Apple needs one for organization accounts. DBAs, trade names and branches are not accepted.

Cost

Free

Dun and Bradstreet

Up to 5 business days. Expediting does not shorten it

Apple

Up to 2 business days to receive the number

Start this process early. It can block your entire launch. If you are a sole proprietor, enroll as an individual at $99 a year and skip the D-U-N-S Number.

Top 10 App Store Rejection Reasons

The guideline sections that catch vibe-coded apps most often. Apple last updated its App Review Guidelines on October 16, 2026.

1
App Completeness (Guideline 2.1): Apple says that on average over 40% of unresolved issues relate to guideline 2.1. Guideline 2.1(a) needs final versions, working URLs, no placeholder text, testing on a device, demo account details, and your back-end service turned on. AI-generated code often covers only the happy path, so test the failure cases on a device.
2
Minimum Functionality (Guideline 4.2): Guideline 4.2 asks for features, content and UI that go beyond a repackaged website. Guideline 4.2.2 rejects apps that are mainly marketing materials, web clippings, content aggregators or a collection of links. No guideline requires push notifications or offline support.
3
In-App Purchase (Guideline 3.1.1): Digital goods must use in-app purchase. License keys, QR codes and cryptocurrencies cannot unlock features. On the US storefront, an app may show buttons, external links or other calls to action for outside purchases. On other storefronts, an app may not point users to other purchase methods unless it holds the matching entitlement.
4
Spam and Copycat (Guideline 4.3): Guideline 4.3(a) bars several bundle IDs for the same app. Guideline 4.3(b) says not to submit apps that are indistinguishable from what is already widely available. Apple names established categories such as dating, flashlight, sound effects, wallpaper, simple timers and fortune telling.
5
Data Collection (Guideline 5.1.1(i)): Link to your privacy policy in the App Store Connect metadata and inside the app. The policy must explain retention and deletion, and how users revoke consent.
6
Sign in with Apple (Guideline 4.8): Guideline 4.8 no longer names Sign in with Apple. If your app uses third-party or social login for its main account, it must also offer an equivalent login. That login limits data to name and email, lets users keep their email private, and does not track app activity for ads without consent. Sign in with Apple meets these terms. Company-only sign-in and education or enterprise apps are exempt.
7
Permission Purpose Strings: Apple requires a purpose string for every permission that gives access to user data. Explain the use in plain words, for example: This app needs camera access to let you take profile photos.
8
App Tracking Transparency (Guideline 5.1.2(i)): Get explicit permission through the App Tracking Transparency APIs before you track. Since the November 2025 revision, you must also disclose and get explicit permission before you share personal data with third-party AI. The legal page (Step 9) covers the full rule.
9
Missing Demo Account (Guideline 2.1(a)): Give reviewers working login details, and turn on your back-end service. A built-in demo mode needs prior Apple approval.
10
Account Deletion (Guideline 5.1.1(v)): If your app lets users create an account, it must also offer account deletion inside the app. AI-generated auth flows often skip this.

TestFlight: Internal vs External Testing

Use internal testing for your team, external for beta users.

Feature	Internal Testing	External Testing
Tester limit	Up to 100 App Store Connect users	Up to 10,000 people
Apple review	Not required, instant distribution	Required for the first build only. Later builds may not need a full review
Build expiration	Builds testable up to 90 days	Builds testable up to 90 days
Best for	Your team, fast iteration	Beta programs, wider user feedback

Start with internal testing for fast feedback. The internal limit is 100 App Store Connect users. For wider testing, use external TestFlight with a public link where testers can join.

Push Notifications Setup

Requires a development build. Push notifications don't work in Expo Go.

Expo handles both FCM (Android) and APNs (iOS) configuration, abstracting away most of the platform-specific complexity. However, several common issues trip up developers.

Common Failures

Missing FCM credentials in your project configuration
APNs certificate expired or misconfigured
User didn't grant notification permission (handle gracefully)
Sending to an invalid or stale push token

Testing Rules

Test on real devices (simulators don't support push notifications reliably)
Use development builds, not Expo Go
Verify tokens are fresh before sending
Handle the case where users deny permission without crashing

Next step

Step 9 of 12 covers the legal side of Bookly: its privacy policy, cookie consent, deposit and refund terms, and the license check on its dependencies. Continue on the legal page.

Common Questions

Vercel vs Netlify: which is better for an app built with AI?

Both deploy from git with previews. The differences are billing and rules: Vercel Hobby is for non-commercial use only, so a paying app needs Pro at $20 a month, which keeps runtime logs for 1 day. Netlify bills in credits: Free has 300 credits with a hard limit, and a production deploy costs 15. Vercel can pause production at a budget limit.

Netlify vs Vercel vs Cloudflare: which host has a spending cap?

Vercel can pause production when you reach a budget limit, and Netlify's Free plan stops at its credit limit. Cloudflare's billing alerts only inform you; Cloudflare's own text says the alert does not cap your usage. Supabase Pro has a spend cap on by default, and Railway takes workloads offline at a hard limit. Set a cap before launch, not after the first bill.

Fly.io vs Vercel for a small app?

Vercel suits a Next.js app like Bookly, with git deploys, previews and a budget limit that can pause production. Fly.io runs containers close to users, which suits a custom backend, but it has no billing alerts, so you need your own usage checks. For a first launch, choose the host whose spend controls you can set up before traffic arrives.

Can I use Vercel Hobby for a commercial app?

Not on Vercel Hobby. Hobby is for personal, non-commercial use only, so an app that takes deposits needs Vercel Pro at $20 a month. Netlify Free allows commercial use, but it has a hard limit of 300 credits a month with no automatic recharge. A production deploy costs 15 credits, so plan for a paid Netlify tier before your first paying client.

Why did my Supabase project pause, and what else sleeps on free tiers?

Free tiers stop apps on their own. Supabase Free pauses a project after one week of inactivity. Render Free web services sleep after 15 minutes without traffic. A Render Free Postgres database expires 30 days after creation, and you then have 14 days to upgrade before it is deleted. Vercel Hobby and Netlify Free stop at their usage limits. Move the database and the service your clients use to paid plans before launch.

Will Apple approve an app built with AI?

Apple guideline 2.5.2 bars apps from downloading or executing code that introduces or changes features or functionality. Apple cited it in March 2026 when it blocked updates to Replit and Vibecode. EAS Update can change only JavaScript and assets, not native code or permissions, and updates still follow store rules. Ship new features in a reviewed build.