Skip to main content

App Marketplace Policy

This policy defines what's expected of an app before and after it's listed on the SitePack App Marketplace. It reflects how the review process and the Partner Portal actually work today: read it alongside the App Manifest Reference and Publishing & Monetization.

Visibility & Review Lifecycle​

Every app has a visibility (Private or Public) and, once made Public, a submission status:

  1. Draft: the app is Public but not submitted yet, or still misses requirements. The Review checklist on the app page shows what is missing.
  2. Submitted: you clicked Submit for Review. The listing (name, icon, visibility, Marketplace listing and OAuth settings) is locked until the review is done.
  3. Published (Live & Public): the SitePack team approved the app. It is visible and installable in the Marketplace straight away, and you can edit the listing again.
  4. Rejected: the review notes explain what to fix. Edit the app and click Resubmit for Review, as often as you need.

You're kept up to date by email at every step. When you submit an app, everyone on your partner team with the Owner or App developer role gets a confirmation that it's waiting for review. When the review is done, they get a second email: either that the app is approved and live, or that it wasn't approved, together with the reviewer's feedback. The emails are sent in each team member's own language (Dutch or English).

Private apps skip this lifecycle: you can install and iterate on them without a review.

Listing Requirements​

Before an app can be submitted for review, it must have:

  • An icon uploaded in the Partner Portal (WEBP, PNG or JPG, 2 MB max).
  • A valid app.json, published with sitepack app:publish (see the App Manifest Reference), with a name, a version and a description of at least 10 characters.
  • Every file the manifest points at: each block template and script listed in app.json must exist in the app.
  • A complete English Marketplace listing: tagline, short description, long description, at least one tag and at least one key feature (USP).

Strongly recommended, and part of what the reviewer looks at:

  • All 4 screenshots per language. Fewer shows as a warning on the checklist.
  • A Dutch listing. Most SitePack merchants work in Dutch.
  • Translations for your settings form and storefront text, see Translations.

Technical & Security Requirements​

  • No externally-hosted JavaScript. All JS/CSS must be bundled inside your app package: SitePack's Content Security Policy blocks external script origins outright.
  • Every uploaded file is scanned for malicious code before it's served; apps found to contain malware are rejected and the partner account may be suspended.
  • Scopes must match actual usage. Only request the scopes your app needs (principle of least privilege): apps requesting scopes they don't use are rejected during review.
  • Read data through the API. Webhooks are thin: they carry the id of what changed, not the data. Fetch the data through the API within your granted scopes.
  • Use SitePack settings where you can. An app that lets the merchant configure it on a SitePack settings page is preferred over one that sends the merchant to an outside dashboard for simple settings.
  • Only OAuth when you use the API. A storefront app that asks for OAuth or scopes it does not use will be rejected.
  • No outside payments. Charge through SitePack plans, not through your own payment provider inside the app.
  • Namespacing must not be bypassed. Don't attempt to register blocks/elements outside your app's namespaced UUID prefix.

Pricing & Monetization​

Apps may be listed as Free, One-time fee, or Monthly subscription (with an optional yearly price). All pricing and payouts are Euro-based. See Publishing & Monetization for details on fees and payouts.

Prohibited Behavior​

  • Deceptive pricing, hidden fees, or misleading marketplace copy (tagline/descriptions/screenshots must accurately represent what the app does).
  • Collecting or exfiltrating merchant or customer data outside of your app's granted scopes.
  • Attempting to interfere with other apps installed on the same site, or with SitePack core functionality.
  • Sharing your client secret or webhook signing secret publicly, or embedding them in client-side code or your app's files.

Removal & Delisting​

  • You can permanently remove an app from the Partner Portal, but only while it is Private (or Public and not yet Live). An app that is currently Live & Public must first be set to Private: this avoids yanking something merchants currently have installed without warning.
  • SitePack reserves the right to delist any app that violates this policy, independent of the partner's own visibility setting.