CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
storebound/skills/privacy-manifest/SKILL.md
CRT ae58948abd storebound scan: offline rejection-risk scan of the project itself 
Detects the stack (native iOS / Android, React Native, Expo, Capacitor, Cordova,
Flutter, Unity, Godot) and the SDKs from a maintained table with versions,
file:line and each vendor's disclosure page, then reports App Store and Google
Play rejection risks with guideline, evidence, fix, severity and skill: 2.1(a)
demo account and placeholder text, 5.1.1(v) account deletion, 4.8 login
services, 3.1.1 restore and outside payments, 3.1.2 subscription info, 5.1.2(i)
ATT, purpose strings, privacy link, privacy manifest, 2.3.10, 2.3.7, 2.3.8, 4.2
web wrappers, 2.5.1, 2.5.5, ATS, export compliance, 1.3 kids ads, review
prompts, privacy labels vs SDKs; Play target SDK 36, delete-account URL, App
access, foreground services, exact alarms, QUERY_ALL_PACKAGES, SMS / call log,
com.example package name.

Proposes Data safety / App Privacy / ATT / privacy manifest answers (detected
file:line or ask owner) as a diff against the config; --write adds only the
detected ones. scan.ignore records owner-accepted findings. MCP tool scan
(read-only), validate includes open findings, desktop Checks tab shows them.
Fixtures for iOS, Android, Capacitor, Unity, Flutter, clean and teaser.
2026-10-11 23:20:55 +08:00

3.6 KiB
Raw Blame History

name description
privacy-manifest Add and check Apple privacy manifests (PrivacyInfo.xcprivacy) for an iOS app or game - required-reason API categories (UserDefaults, file timestamps, system boot time, disk space, active keyboards) with approved reason codes, tracking flag and domains, collected data types, and third-party SDK manifests (ad networks, analytics, Firebase, Unity, Capacitor plugins). Use when App Store Connect sends ITMS-91053 "Missing API declaration" or ITMS-91061 "Missing privacy manifest", or before submitting an iOS build.

Privacy manifest (iOS)

storebound scan runs the same checks as part of its report (no manifest, undeclared required-reason APIs, SDKs older than their first manifest version) and proposes NSPrivacyTracking and the collected data types from the detected SDKs.

Scan: storebound privacy-manifest --ios ios/App (local, no credentials). Capacitor / Cordova plugins live outside the iOS folder: add --sdk-dirs node_modules/@capacitor,node_modules/<plugin>. Exit 1 when something blocks upload.

What Apple checks at upload

  • ITMS-91053 Missing API declaration: the binary uses a required-reason API and no manifest in the app or in the SDK that calls it declares the category with a reason.
  • ITMS-91061 Missing privacy manifest: an SDK from Apple's list of commonly used SDKs (Firebase, Google utilities, Alamofire, OneSignal, Unity framework, Capacitor, Flutter ...) is linked without its own manifest (and signature for binary SDKs). Fix by updating the SDK, not by declaring it in your app's manifest.

Steps

  1. Xcode > File > New > File > App Privacy (PrivacyInfo.xcprivacy), target = the app.
  2. Run the scan. For each used category add NSPrivacyAccessedAPITypes > item with NSPrivacyAccessedAPIType and NSPrivacyAccessedAPITypeReasons. Typical for apps and games:
    • NSPrivacyAccessedAPICategoryUserDefaults + CA92.1 (settings / saves read and written by the app itself; Capacitor Preferences and most engines use UserDefaults)
    • NSPrivacyAccessedAPICategoryFileTimestamp + C617.1 (timestamps of files in the app container)
    • NSPrivacyAccessedAPICategorySystemBootTime + 35F9.1 (elapsed time between events)
    • NSPrivacyAccessedAPICategoryDiskSpace + E174.1 (check space before writing) Pick the reason that is true; read Apple's reason list ("Describing use of required reason API") if unsure.
  3. Tracking: NSPrivacyTracking true only if the app tracks (ad SDK with IDFA after ATT); then list NSPrivacyTrackingDomains the SDK docs name. Keep it consistent with App Privacy "used for tracking" and the ATT prompt (store-declarations).
  4. NSPrivacyCollectedDataTypes: what the app itself collects; SDK manifests cover their own collection. Xcode's Privacy Report (Product > Archive > Generate Privacy Report) merges all manifests; compare it with App Privacy.
  5. SDKs flagged "ships no PrivacyInfo.xcprivacy": update to a version that has one (ad networks and mediation adapters added manifests in 2024 releases; see ads-mediation-checks for adapter / SDK version pairs).
  6. Re-run the scan, archive, upload; Apple's email lists any remaining ITMS-910xx issue per framework.

Gotchas

  • The scan is a text search: it can miss calls inside binary frameworks (their manifest must cover them) and flag a harmless symbol name; confirm before adding a category you do not use.
  • A manifest must be in the app target's Copy Bundle Resources, not only in the project.
  • Static libraries cannot carry a manifest bundle by themselves; the vendor ships a resource bundle or you merge their declarations into the app's manifest as their docs say.