privacy-manifest

Privacy Manifests & Required-Reason APIs

Declare data use and justify required-reason APIs so the build passes App Review. Missing or incomplete manifests cause hard rejections (ITMS-91053, ITMS-91061) at upload/processing time — often after a "successful" upload (see asc-submission async failures). Run this before submitting.

A privacy manifest is a property list named PrivacyInfo.xcprivacy added to a target (and required in each SDK/framework, not just the app). It declares four things.

The four keys

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>NSPrivacyTracking</key>
  <false/>                                  <!-- true only if you track per App Tracking Transparency -->

  <key>NSPrivacyTrackingDomains</key>
  <array/>                                  <!-- domains used for tracking; MUST be empty if NSPrivacyTracking is false -->

  <key>NSPrivacyCollectedDataTypes</key>
  <array>
    <dict>
      <key>NSPrivacyCollectedDataType</key>
      <string>NSPrivacyCollectedDataTypeCrashData</string>
      <key>NSPrivacyCollectedDataTypeLinked</key>
      <false/>                              <!-- linked to user identity? -->
      <key>NSPrivacyCollectedDataTypeTracking</key>
      <false/>                              <!-- used to track? -->
      <key>NSPrivacyCollectedDataTypePurposes</key>
      <array>
        <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
      </array>
    </dict>
  </array>

  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>CA92.1</string>            <!-- access only to data written by this app -->
      </array>
    </dict>
  </array>
</dict>
</plist>

1. NSPrivacyTracking (Bool) — does the app/SDK track per ATT?
2. NSPrivacyTrackingDomains (array) — domains that perform tracking. Must be empty if NSPrivacyTracking is false. Find them with the App Privacy Report / Instruments Network instrument.
3. NSPrivacyCollectedDataTypes (array) — what data you collect, whether it's linked to identity, whether it's used for tracking, and the purposes. This feeds the App Store privacy nutrition label.
4. NSPrivacyAccessedAPITypes (array) — each required-reason API category you call, plus approved reason codes.