storebound/skills/privacy-manifest/SKILL.md

name

description

privacy-manifest

Add and check Apple privacy manifests (PrivacyInfo.xcprivacy) for an iOS app or game - required-reason API categories (UserDefaults, file timestamps, system boot time, disk space, active keyboards) with approved reason codes, tracking flag and domains, collected data types, and third-party SDK manifests (ad networks, analytics, Firebase, Unity, Capacitor plugins). Use when App Store Connect sends ITMS-91053 "Missing API declaration" or ITMS-91061 "Missing privacy manifest", or before submitting an iOS build.

Privacy manifest (iOS)

storebound scan runs the same checks as part of its report (no manifest, undeclared required-reason APIs, SDKs older than their first manifest version) and proposes NSPrivacyTracking and the collected data types from the detected SDKs.

Scan: storebound privacy-manifest --ios ios/App (local, no credentials). Capacitor / Cordova / React Native plugins live outside the iOS folder; they are found the way Node resolves them: the dependencies of the app's package.json (next to capacitor.config) in the node_modules there and in every folder above it up to the repo root (so a monorepo's apps/native/node_modules works), workspace packages (package.json workspaces, Bun / npm / yarn), local SwiftPM packages (Capacitor 8's CapApp-SPM Package.swift), Pods and SwiftPM checkouts. --sdk-dirs a,b adds folders it cannot find. Exit 1 when something blocks upload.

What Apple checks at upload

• ITMS-91053 Missing API declaration: the binary uses a required-reason API and no manifest in the app or in the SDK that calls it declares the category with a reason.
• ITMS-91061 Missing privacy manifest: an SDK from Apple's list of commonly used SDKs (Firebase, Google utilities, Alamofire, OneSignal, Unity framework, Capacitor, Flutter ...) is linked without its own manifest (and signature for binary SDKs). Fix by updating the SDK, not by declaring it in your app's manifest.

Steps

1. Xcode > File > New > File > App Privacy (PrivacyInfo.xcprivacy), target = the app.
2. Run the scan. For each used category add NSPrivacyAccessedAPITypes > item with NSPrivacyAccessedAPIType and NSPrivacyAccessedAPITypeReasons. Typical for apps and games:
   • NSPrivacyAccessedAPICategoryUserDefaults + CA92.1 (settings / saves read and written by the app itself; Capacitor Preferences and most engines use UserDefaults)
   • NSPrivacyAccessedAPICategoryFileTimestamp + C617.1 (timestamps of files in the app container)
   • NSPrivacyAccessedAPICategorySystemBootTime + 35F9.1 (elapsed time between events)
   • NSPrivacyAccessedAPICategoryDiskSpace + E174.1 (check space before writing) Pick the reason that is true; read Apple's reason list ("Describing use of required reason API") if unsure.
3. Tracking: NSPrivacyTracking true only if the app tracks (ad SDK with IDFA after ATT); then list NSPrivacyTrackingDomains the SDK docs name. Keep it consistent with App Privacy "used for tracking" and the ATT prompt (store-declarations).
4. NSPrivacyCollectedDataTypes: what the app itself collects; SDK manifests cover their own collection. Xcode's Privacy Report (Product > Archive > Generate Privacy Report) merges all manifests; compare it with App Privacy.
5. SDKs flagged "ships no PrivacyInfo.xcprivacy": update to a version that has one (ad networks and mediation adapters added manifests in 2024 releases; see ads-mediation-checks for adapter / SDK version pairs).
6. Re-run the scan, archive, upload; Apple's email lists any remaining ITMS-910xx issue per framework.

Gotchas

• The scan is a text search: it can miss calls inside binary frameworks (their manifest must cover them) and flag a harmless symbol name; confirm before adding a category you do not use.
• A manifest must be in the app target's Copy Bundle Resources, not only in the project.
• Static libraries cannot carry a manifest bundle by themselves; the vendor ships a resource bundle or you merge their declarations into the app's manifest as their docs say.