Missing Apple privacy manifest (PrivacyInfo.xcprivacy)

No PrivacyInfo.xcprivacy is present. Apple has required a privacy manifest since 2024; without it the app cannot declare tracking, data collection, or required-reason API usage and is subject to App Store rejection.

How it's exploited

With no PrivacyInfo.xcprivacy the app cannot declare its tracking, data collection, or required-reason API usage. Apple has required the manifest since 2024, so App Store Connect rejects or warns on submission, and reviewers treat the omission as undisclosed data practice.

Why it matters

Blocked or delayed releases, plus a real transparency gap: users and Apple have no declared record of what the app collects or why it touches sensitive APIs.

How to fix it

1. Add a PrivacyInfo.xcprivacy to the app target and to every SDK you ship.
2. Declare NSPrivacyTracking, NSPrivacyTrackingDomains, NSPrivacyCollectedDataTypes, and NSPrivacyAccessedAPITypes with approved reason codes.

<dict>
  <key>NSPrivacyTracking</key><false/>
  <key>NSPrivacyAccessedAPITypes</key><array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key><string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key><array><string>CA92.1</string></array>
    </dict>
  </array>
</dict>

References

• OWASP Mobile Top 10: M6
• OWASP MASVS: MASVS-PRIVACY-1
• Apple: privacy manifest files