CtrlK
BlogDocsLog inGet started
Tessl Logo

dpearson2699/swift-ios-skills

Agent skills for iOS, iPadOS, Swift, SwiftUI, and modern Apple framework development.

90

Quality

90%

Does it follow best practices?

Impact

—

Average score across 248 eval scenarios

SecuritybySnyk

Advisory

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

privacy-manifest.mdskills/app-store-review/references/

Privacy Manifest Reference

Contents

  • When a Privacy Manifest Is Required
  • Privacy Manifest Structure
  • Required API Reason Codes
  • Privacy Manifest Keys Reference
  • Third-Party SDK Manifests
  • Collected Data Types Declaration
  • Sources To Re-Check

When a Privacy Manifest Is Required

A PrivacyInfo.xcprivacy file is required if your app or any dependency uses these API categories:

  • File timestamp APIs (NSPrivacyAccessedAPICategoryFileTimestamp)
  • System boot time APIs (NSPrivacyAccessedAPICategorySystemBootTime)
  • Disk space APIs (NSPrivacyAccessedAPICategoryDiskSpace)
  • User defaults (NSPrivacyAccessedAPICategoryUserDefaults)
  • Active keyboard APIs (NSPrivacyAccessedAPICategoryActiveKeyboards)

Apple updates required-reason API coverage over time. Before final submission or release, re-check the current NSPrivacyAccessedAPIType and NSPrivacyAccessedAPITypeReasons documentation and do not invent broad or convenient reasons.

Privacy Manifest Structure

<!-- PrivacyInfo.xcprivacy -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array>
        <!-- Declare every data type you collect -->
    </array>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>
            </array>
        </dict>
    </array>
</dict>
</plist>

Required API Reason Codes

Use the exact approved reason that matches the app or SDK behavior. Do not use a broad reason code because it is convenient; Apple requires the declared reason to match the presented functionality and derived-data use.

Before final submission, re-check Apple's current required-reason API documentation. Reason-code coverage can change, and invented or overly broad reasons are not acceptable.

API CategoryCodeReason
FileTimestampDDA9.1Display file timestamps to the person using the device
FileTimestampC617.1Access timestamps, size, or metadata for files in the app, app group, or CloudKit container
FileTimestamp3B52.1Access timestamps, size, or metadata for user-granted files or directories
FileTimestamp0A2A.1Third-party SDK wrapper around file timestamp APIs, only when called by the app
SystemBootTime35F9.1Measure elapsed time between events
SystemBootTime8FFB.1Calculate absolute timestamps for events that occurred within the app
SystemBootTime3D61.1Include system boot time in an optional user-submitted bug report
DiskSpace85F4.1Display disk space information to the person using the device
DiskSpaceE174.1Check available or low disk space before writes or cleanup
DiskSpace7D9E.1Include disk space information in an optional user-submitted bug report
DiskSpaceB728.1Health research app detects low disk space impacting research data collection
ActiveKeyboards3EC4.1Custom keyboard app checks active keyboards
ActiveKeyboards54BD.1Present UI that visibly changes based on active keyboards
UserDefaultsCA92.1Read/write information accessible only to the app itself
UserDefaults1C8F.1Read/write information accessible only within the same App Group
UserDefaultsC56D.1Third-party SDK wrapper around UserDefaults APIs, only when called by the app
UserDefaultsAC6B.1Managed app configuration or managed feedback keys for MDM

Privacy Manifest Keys Reference

KeyTypePurpose
NSPrivacyTrackingBooleanWhether the app tracks users (triggers ATT requirement)
NSPrivacyTrackingDomainsArray of stringsDomains used for tracking (connected only after ATT consent)
NSPrivacyCollectedDataTypesArray of dictsEach data type collected, its purpose, and whether it is linked to identity
NSPrivacyAccessedAPITypesArray of dictsEach required-reason API used and the justification codes

Third-Party SDK Manifests

  • Verify each SDK, executable, or dynamic library that uses required-reason APIs includes PrivacyInfo.xcprivacy in the bundle containing that code
  • Ensure SDK reason codes match actual SDK usage; an SDK cannot rely on the host app's manifest to report the SDK's own required-reason API use
  • Update SDK versions when required manifests or reason declarations are missing
  • Keep the app's manifest focused on app code and app-level collected data/tracking declarations

Collected Data Types Declaration

Each NSPrivacyCollectedDataTypes entry must specify:

  • NSPrivacyCollectedDataType (category)
  • NSPrivacyCollectedDataTypeLinked (linked to identity)
  • NSPrivacyCollectedDataTypeTracking (used for tracking)
  • NSPrivacyCollectedDataTypePurposes (purposes array)

Keep manifests, privacy nutrition labels, SDK behavior, and app functionality consistent. Mismatches cause rejection.

Sources To Re-Check

skills

app-store-review

references

privacy-manifest.md

review-checklists.md

SKILL.md

README.md

tile.json