Privacy manifest for iOS apps

Apple's requirements for App Store submissions have changed in the spring of 2024. App Store Connect no longer accepts apps that don't specify a reason for using a required reason API in their privacy manifests.

This is an automatic check, not a manual moderation: your app's code is analyzed, and you receive a list of issues in an email. The email will reference the "ITMS-91053: Missing API declaration" issue, listing all API categories used in the app that fall under the required reasons category.

Ideally, all SDKs that your app uses provide their own privacy manifest, and you don't need to worry about that. But if some of your dependencies don't do this, your App Store submission may be flagged.

After you have tried to submit your app and received a detailed issue list from the App Store, you can build your manifest following the Apple documentation:

• Privacy manifest files overview

• Describing data use in privacy manifests

• Describing use of required reason API

The resulting file is a collection of dictionaries. For each accessed API type, select one or more reasons for using it from the provided list. Xcode helps edit .xcprivacy files by providing a visual layout and dropdown lists with valid values for each field.

You can use a special tool to find usages of required reason APIs in the dependencies of your Kotlin framework and a separate plugin to bundle .xcprivacy file with your Kotlin artifacts.

If a new privacy manifest doesn't help satisfy App Store requirements or you cannot figure out how to go through the steps, contact us and share your case in this YouTrack issue.

Kotlin code in your app or one of the dependencies may access required reason APIs from libraries such as platform.posix, for example, fstat:

import platform.posix.fstat

fun useRequiredReasonAPI() {
    fstat(...)
}

In some cases, it may be difficult to determine which dependencies use the required reason API. To help you find them, we've built a simple tool.

To use it, run the following command in the directory where the Kotlin framework is declared in your project:

/usr/bin/python3 -c "$(curl -fsSL https://github.com/JetBrains/kotlin/raw/rrf_v0.0.1/libraries/tools/required-reason-finder/required_reason_finder.py)"

You may also download this script separately, inspect it, and run it using python3.

If you need to bundle the PrivacyInfo.xcprivacy file with your Kotlin artifacts, use the apple-privacy-manifests plugin:

plugins {
    kotlin("multiplatform")
    kotlin("apple-privacy-manifests") version "1.0.0"
}

kotlin {
    privacyManifest {
        embed(
            privacyManifest = layout.projectDirectory.file("PrivacyInfo.xcprivacy").asFile,
        )
    }
}

The plugin will copy the privacy manifest file to the corresponding output location.