ITMS-91053 and the privacy-manifest landmine
It builds fine. It uploads fine. Then Apple emails you. Welcome to the privacy manifest.
This one’s sneaky because it passes every check you’d think to run. The app builds, archives, and uploads clean. Then, sometime after, an email: ITMS-91053, “Missing API declaration.” Nothing crashed. You just skipped a file Apple now expects.
What’s actually wrong
“Required-reason” APIs. Apple keeps a list of ordinary APIs that could be abused for fingerprinting, and if you touch one, you have to say why in a privacy manifest. The one almost everyone hits is UserDefaults — and if you use SwiftUI’s @AppStorage for a setting, that’s UserDefaults. File-timestamp APIs are another common one.
The fix
Small. Add a PrivacyInfo.xcprivacy to your app target and declare the reason codes — e.g. CA92.1 for UserDefaults, C617.1 for file timestamps. These are standard, approved reasons; you’re filling in a form, not justifying anything.
Two things worth knowing:
- A Data Not Collected app still needs this. The manifest declares reasons you touched an API, not data you collect. Different question.
- “It built fine” is not “it’ll ship.” This whole category only shows up after upload. Add the manifest up front and you never see the email.
That’s the landmine: boring file, quiet rejection, easy to defuse once you know it’s there.
The full playbook — every screen, in order — is in the guides.
Rather not wrestle with this yourself?
We handle the App Store Connect and Google Play submission for you — the listing, the errors, the resubmits — and get your app into review. See App Submission →