Shipping a Cursor-Built App to the App Store and Google Play

Cursor is an AI code editor, not an app builder, so a "Cursor app" can be anything from a SwiftUI project to a Next.js dashboard. That flexibility is good news for release: you are not locked into a generator's conventions. It also means there is no single "publish" button. This guide starts with the matrix that tells you which release path applies, then covers how to use the agent productively for release work without letting it touch things it should not.

The release matrix: find your stack

Across all rows, Fastlane is a common choice to automate signing, building, screenshots and uploads. For the Expo row specifically, shipping React Native apps with Expo describes the flow in detail; it applies regardless of which agent wrote the code.

Give Cursor release rules it must follow

Cursor supports project rules (in the .cursor/rules directory) that are injected into the agent's context, and recent versions also read AGENTS.md. Add a release section that states:

• Protected files: signing configuration, entitlements, provisioning settings, google-services.json or GoogleService-Info.plist, keystores. Changes only on explicit request.
• Identifiers: bundle ID and package name are fixed; never rename.
• Versioning: version numbers come from CI or a release script, not hand edits.
• Dependencies: no new SDKs without approval, because each one affects privacy declarations.
• Permissions: every new permission requires a user-facing purpose and a reason in the pull request description.

What the agent is good at in release work

1. Writing Fastlane lanes and CI workflows (for example GitHub Actions) from a clear description of your steps.
2. Auditing the project: listing permissions, network endpoints and third-party SDKs as input for privacy labels and the data safety form.
3. Fixing build errors from Xcode or Gradle logs you paste in.
4. Preparing release notes from the commit history.
5. Removing leftovers: debug menus, mock data, test endpoints, placeholder screens.

The broader picture of automated pipelines is in CI/CD for AI-generated mobile apps.

What stays with a human

• Keys and certificates. Apple distribution certificates, App Store Connect API keys and Android upload keystores belong in a secrets store, not in the editor's context. Background in iOS code signing explained.
• Console settings. App records, pricing, availability, age ratings and testing tracks.
• Policy declarations. App Privacy details, Google Play data safety, content rating and ads declarations are legal statements; a person must confirm them.
• Review communication. Answering Apple or Google reviewers needs context and judgment.
• Device testing. The agent cannot hold a phone. Test on real devices of different sizes, OS versions and network conditions.

Release-day surprises in Cursor-built projects

Because Cursor makes broad edits cheap, release problems often come from changes nobody remembers approving. Look for these before you archive:

• Raised minimum OS versions. The agent bumps the iOS deployment target or Android minSdk to use a newer API, quietly excluding older devices.
• Duplicate dependencies. Two networking or state libraries doing the same job after several refactors, which inflates app size and complicates privacy declarations.
• Debug-only code paths in release builds. Feature flags, verbose logging or test servers left enabled.
• Stale generated files. Native folders in React Native or Flutter projects that no longer match the configuration after the agent edited only one side.
• Release builds never run. Code shrinking on Android and optimization settings on iOS only apply in release configuration, so test that configuration specifically.

A quick diff of build files between your last release and the current branch catches most of these in minutes.

Store requirements that apply to every stack

• Apple Developer Program (USD 99 per year; organizations need a D-U-N-S number) and Google Play Console (USD 25 one-time).
• Newer personal Play accounts: a closed test with at least 12 testers for 14 consecutive days before production.
• Android App Bundles for new Play apps and a target API level that meets Google's current requirement.
• In-app account deletion when users can create accounts.
• Apps built from web code need native value to pass Apple's guideline 4.2.
• Privacy policy, support URL, accurate screenshots and a reviewer demo account.

A minimal release routine

1. Freeze features on a release branch.
2. Run the agent's audit prompts: permissions, SDKs, endpoints, leftovers. Review the results.
3. Let CI build, sign and upload to TestFlight and the internal Play track.
4. Test on devices; fix issues in small pull requests.
5. Complete store metadata and privacy declarations.
6. Submit, monitor review, release in stages.

Setting this up the first time takes the most effort. appsubmitter.io combines AI assistance with human experts to set up CI/CD, sign and submit iOS and Android builds in your own developer accounts, and to guide you through rejections, so later releases become routine. If your team wants to work more effectively with Cursor and other agents in general, neooutput offers hands-on trainings, and Claude Code vs. Cursor compares the two tools.