Skip to main content

App Marketplace Policy

This policy defines what's expected of an app before and after it's listed on the SitePack App Marketplace. It reflects how the review process and the Partner Dashboard actually work today — read it alongside the App Manifest Reference and Publishing & Monetization.

Visibility & Review Lifecycle​

Every app has a visibility (Private or Public) and, once made Public, a submission status that moves through a fixed set of states:

  1. Draft — the app is Public but hasn't been submitted yet, or is still missing requirements.
  2. Submitted / In Review — you clicked "Submit for Review" in the Partner Dashboard. The listing (name, icon, visibility, and marketplace listing content) is locked while a review is pending — you cannot edit it until the review completes.
  3. Approved — the SitePack team has approved the submission; the app is queued for publication.
  4. Published (Live) — the app is visible and installable in the Marketplace. Editing re-opens at this point: you can update your listing without needing a brand-new review for routine changes.
  5. Rejected — the review found issues. Review notes explain what to fix. You may edit the app and resubmit as many times as needed; there's no limit on resubmissions.

Private apps skip this entire lifecycle — you can install and iterate on them freely without any review.

Listing Requirements​

Before an app can be submitted for review, it must have:

  • An icon uploaded (WEBP/PNG/JPG, 2MB max).
  • A valid app.json manifest uploaded via sitepack app:publish (see the App Manifest Reference), including a description of at least 10 characters.
  • A complete English marketplace listing: tagline, short description, long description, at least one tag, at least one USP, and all 4 marketplace screenshots.

Additional languages are optional but recommended for reach.

Technical & Security Requirements​

  • No externally-hosted JavaScript. All JS/CSS must be bundled inside your app package — SitePack's Content Security Policy blocks external script origins outright.
  • Every uploaded file is scanned for malicious code before it's served; apps found to contain malware are rejected and the partner account may be suspended.
  • Scopes must match actual usage. Only request the scopes your app needs (principle of least privilege) — apps requesting scopes they don't use are rejected during review.
  • Webhooks carry no PII. Per the thin-payload model, webhook deliveries must only contain metadata and a resource_link; apps are expected to call the API (within their granted scopes) to fetch actual data rather than relying on SitePack to push it.
  • Namespacing must not be bypassed. Don't attempt to register blocks/elements outside your app's namespaced UUID prefix.

Pricing & Monetization​

Apps may be listed Free, One-Time Payment, or Subscription (Monthly/Yearly). All pricing and payouts are Euro-based. See Publishing & Monetization for details on fees and payouts.

Prohibited Behavior​

  • Deceptive pricing, hidden fees, or misleading marketplace copy (tagline/descriptions/screenshots must accurately represent what the app does).
  • Collecting or exfiltrating merchant or customer data outside of your app's granted scopes.
  • Attempting to interfere with other apps installed on the same site, or with SitePack core functionality.
  • Sharing your app_key/app_secret publicly, or embedding them in client-side code.

Removal & Delisting​

  • You can permanently remove an app from the Partner Dashboard, but only while it is Private (or Public and not yet Live). An app that is currently Live & Public must first be set to Private — this avoids yanking something merchants currently have installed without warning.
  • SitePack reserves the right to delist any app that violates this policy, independent of the partner's own visibility setting.