I built ShelfIQ over a few months of evenings: a merchandising-intelligence app that tells Shopify merchants which products to promote, discount, or retire, and why. The hard part wasn't the recommendation engine. It was getting past review.

The eleven resubmissions

Shopify's app review is not a gate, it's a conversation you didn't ask for. My first rejection was for a privacy-policy URL that 404'd for exactly the eight minutes the reviewer happened to check. The second was a billing-API edge case I genuinely had wrong. The rest were a tour of every assumption I'd made about how a "public app" differs from the private ones I'd shipped for clients.

Things that got me rejected, in order of how dumb they felt afterwards:

• A GDPR webhook that returned 200 but didn't actually delete anything.
• Requesting read_all_orders scope I used in exactly one place I could have designed around.
• An OAuth flow that worked perfectly — unless the merchant declined and came back, which the reviewer always does.

The 19 days of silence

Between submission six and seven, nothing. No status change, no email. I refreshed the Partner dashboard like it owed me money. The lesson: build the thing so a 19-day gap doesn't matter to your runway. I kept shipping client work; ShelfIQ waited.

What I'd tell past me

Treat the reviewer as your first real user, because they are. Write the listing copy before you write the feature. And assume every scope you request will be questioned — so request the minimum, and have a one-sentence justification ready for each. Approved spring '26. The review queue, as the advert says, builds character.