/privacy-manifests

name: privacy-manifests
description: Privacy manifest (PrivacyInfo.xcprivacy) implementation including required reason APIs, tracking domains, third-party SDK declarations, and App Tracking Transparency. Use when preparing apps for App Store privacy requirements.
allowed-tools: [Read, Glob, Grep]
last_verified: 2026-07-16
review_by: 2027-06-22

Privacy Manifests

Advisory skill for implementing Apple's privacy manifest (PrivacyInfo.xcprivacy) requirements: manifest file format, required reason APIs, tracking declarations, third-party SDK privacy, and App Tracking Transparency.

When This Skill Activates

Use this skill when the user:

• Asks about "privacy manifest" or "PrivacyInfo.xcprivacy"
• Mentions "required reason API" or App Store privacy rejection
• Needs to declare "tracking domains" or "NSPrivacyTracking"
• Asks about "App Tracking Transparency" or ATT
• Wants to audit third-party SDK privacy declarations
• Is preparing an app for App Store submission and mentions privacy
• Gets an App Store Connect warning about missing privacy manifests
• Asks about "privacy nutrition labels" or App Store privacy details

Decision Tree

| Problem | Section | |---------|---------| | Creating PrivacyInfo.xcprivacy from scratch | Privacy Manifest File Format + Required Reason APIs | | App Store rejection about required reason APIs | Required Reason APIs (match APIs in your code) | | Declaring tracking domains | Tracking Domains and NSPrivacyTracking | | Third-party SDK privacy | Third-Party SDK Declarations | | Implementing ATT | App Tracking Transparency | | Filling out App Store privacy labels | Privacy Nutrition Labels | | Generating Xcode report | Xcode Privacy Report |

Review Process

1. Scan the Project

Glob: **/PrivacyInfo.xcprivacy
Grep: "NSPrivacyAccessedAPITypes|NSPrivacyTracking|NSPrivacyTrackingDomains"
Grep: "NSFileCreationDate|NSFileModificationDate|NSURLCreationDateKey"
Grep: "systemUptime|ProcessInfo.*processInfo"
Grep: "volumeAvailableCapacity|URLResourceKey.*volume"
Grep: "UserDefaults"
Grep: "activeInputModes|UITextInputMode"
Grep: "ATTrackingManager|requestTrackingAuthorization"

2. Determine What Is Missing and Apply Fixes

Check: Does PrivacyInfo.xcprivacy exist? Are all required reason APIs declared? Is NSPrivacyTracking correct? Are tracking domains listed? Do third-party SDKs have their own manifests? Use the sections below to generate correct entries.

---

Privacy Manifest File Format

The privacy manifest is a property list named `PrivacyInfo.xcprivacy`. Add it via File > New > File > App Privacy in Xcode. Four required top-level keys:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array/>
    <key>NSPrivacyAccessedAPITypes</key>
    <array/>
</dict>
</plist>

Where to Place the File

• **App targets**: Add PrivacyInfo.xcprivacy to the root of the app bundle. In Xcode, ensure it is included in the target's "Copy Bundle Resources" build phase.
• **Frameworks/SDKs**: Place PrivacyInfo.xcprivacy in the root of the framework bundle.
• **Swift packages**: Place PrivacyInfo.xcprivacy in the package's resource bundle and declare it in Package.swift:

// Package.swift
.target(
    name: "MyLibrary",
    resources: [
        .copy("PrivacyInfo.xcprivacy")
    ]
)

---

Required Reason APIs

Apple requires you to declare why your app uses certain system APIs. You must include at least one valid reason code for each API category your app uses.

File Timestamp APIs (NSPrivacyAccessedAPICategoryFileTimestamp)

APIs that access file creation or modification dates.

| Reason Code | Description | |-------------|-------------| | DDA9.1 | Display file timestamps to the user | | C617.1 | Access timestamps inside the app container, app group container, or CloudKit container | | 3B52.1 | Access timestamps of files or directories the user specifically granted access to (document picker, drag and drop) | | 0A2A.1 | Access timestamps for files managed by the app itself (third-party SDK only) |

Common triggers: `NSFileCreationDate`, `NSFileModificationDate`, `NSURLContentModificationDateKey`, `NSURLCreationDateKey`, `getattrlist`, `stat`, `fstat`.

System Boot Time APIs (NSPrivacyAccessedAPICategorySystemBootTime)

APIs that read how long the system has been running.

| Reason Code | Description | |-------------|-------------| | 35F9.1 | Measure elapsed time between events within the app | | 8FFB.1 | Calculate absolute timestamps for events (e.g., events that occurred before app launch) | | 3D61.1 | Access system boot time for the purposes of user-facing functionality |

Common triggers: `systemUptime`, `ProcessInfo.processInfo.systemUptime`, `mach_absolute_time`, `clock_gettime(CLOCK_MONOTONIC)`.

Disk Space APIs (NSPrivacyAccessedAPICategoryDiskSpace)

APIs that query available or total disk space.

| Reason Code | Description | |-------------|-------------| | E174.1 | Display disk space to the user | | 85F4.1 | Check whether there is sufficient disk space to write files | | AB6B.1 | Query disk space for the app's own functionality, do not send off device | | 7D9E.1 | Query disk space for the app's own functionality, results sent off device (e.g., analytics) |

Common triggers: `volumeAvailableCapacityKey`, `volumeAvailableCapacityForImportantUsageKey`, `volumeAvailableCapacityForOpportunisticUsageKey`, `volumeTotalCapacityKey`, `statfs`, `statvfs`.

User Defaults APIs (NSPrivacyAccessedAPICategoryUserDefaults)

APIs that read or write to UserDefaults.

| Reason Code | Description | |-------------|-------------| | CA92.1 | Read/write data accessible only to the app itself | | 1C8F.1 | Read/write data accessible to app groups (shared