Privacy manifest generator and checker
Tick what your app or SDK does and get a valid PrivacyInfo.xcprivacy to copy or download: tracking and its domains, the required reason APIs you use with Apple's approved reason codes (CA92.1 for UserDefaults and the rest), and the data you collect. You can also paste an existing manifest to find unknown keys, missing or misplaced reason codes and broken XML. It all runs in this page; nothing is uploaded.
Category names, reason codes and data keys are copied from Apple's documentation, checked on 2026-10-30.
Tracking
Tracking as defined by App Tracking Transparency: linking data from your app with data from other companies' apps or websites for advertising, or sharing it with a data broker.
Required reason APIs (NSPrivacyAccessedAPITypes)
Tick every reason that applies to code in this target. Almost every app uses UserDefaults, so it almost always needs CA92.1. A category is written only when at least one of its reasons is ticked.
Collected data (NSPrivacyCollectedDataTypes)
Tick each kind of data this app or SDK collects, meaning it leaves the device and you or a partner can access it. For each one, say whether it is linked to the person's identity, used for tracking, and why you collect it.
0 selected
Your PrivacyInfo.xcprivacy
Add it to Xcode with File > New File > App Privacy, then replace its contents with this, or drag the downloaded file into your target and tick the target's checkbox so it is copied into the bundle.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>NSPrivacyAccessedAPITypes</key> <array/> <key>NSPrivacyCollectedDataTypes</key> <array/> <key>NSPrivacyTracking</key> <false/> <key>NSPrivacyTrackingDomains</key> <array/> </dict> </plist>
Checks on this file
No problems found. The file parses and uses only keys and codes on Apple's lists.
How it works
- •Every category, reason code, data type and purpose comes from Apple's privacy manifest documentation, copied on 30 October 2026. Each code is shown with Apple's own description so you can match it to what your code does.
- •The file is an XML property list with the four top-level keys Apple describes (NSPrivacyAccessedAPITypes, NSPrivacyCollectedDataTypes, NSPrivacyTracking, NSPrivacyTrackingDomains). Keys are sorted and indented with tabs, the same bytes macOS plutil writes, so it diffs cleanly against a file Xcode made.
- •Text is escaped for XML, so a domain or value with &, < or > cannot break the file.
- •The checker reads the XML in this page and reports: malformed XML with the line number, unknown keys, values of the wrong type, a category with no reason, a reason code that belongs to another category or is not on Apple's list, unknown data types and purposes, and tracking set to true with no domains.
- •A checked file can be opened in the generator, fixed with the checkboxes, and downloaded again.
What it does not do
- •It does not scan your code or binary to find which APIs you call. You tick them; a search of your project for UserDefaults, stat, systemUptime, mach_absolute_time and the disk-space keys is a good start.
- •It does not decide which reason is right for you. Apple's description of each code is the rule, and App Review has the final word.
- •It does not cover third-party SDKs. Each SDK ships its own privacy manifest in its own bundle.
- •It does not fill in the App Privacy section in App Store Connect. That is a separate form; Xcode's privacy report (Product > Archive, then Generate Privacy Report) helps you fill it.
- •It does not read binary property lists. Convert one first with plutil -convert xml1.
- •Apple updates the list of required reason APIs from time to time. The codes here were checked on the date shown above the form.
Questions
- Does my app need a privacy manifest?
- Almost certainly. Apple says that since 1 May 2024 App Store Connect does not accept apps that use a required reason API without describing it in a privacy manifest, and nearly every app uses UserDefaults. The required reason part applies to iOS, iPadOS, tvOS, visionOS and watchOS; the collected data part applies to every platform.
- Which reason code do I use for UserDefaults?
- CA92.1 if only your app reads and writes its own defaults. 1C8F.1 if you share defaults with your extensions or other apps in the same App Group. C56D.1 is only for third-party SDKs that wrap UserDefaults for the app, and AC6B.1 is for reading MDM managed configuration or writing MDM feedback.
- Where does the PrivacyInfo.xcprivacy file go?
- In your target's resources, named exactly PrivacyInfo.xcprivacy. In Xcode choose File > New File, pick App Privacy in the Resource section and tick your target. Each executable or dynamic library that uses a required reason API needs a manifest in its own bundle.
- Do I need to list data that my analytics or ad SDK collects?
- Not in your app's manifest. Apple says third-party SDKs provide their own privacy manifests, and your app's file does not need to cover data collected by SDKs it links. You still declare that data in App Store Connect's App Privacy section, and Xcode's privacy report gathers all the manifests together.
- What happens when NSPrivacyTracking is true?
- You must list the tracking domains in NSPrivacyTrackingDomains. If the person has not allowed tracking through App Tracking Transparency, the system makes network requests to those domains fail. Leave tracking false if your app does not track in the App Tracking Transparency sense.
- Can I use a reason code from another category?
- No. Each code belongs to one category: C617.1, for example, is a file timestamp reason and means nothing under UserDefaults. The checker flags a code placed under the wrong category and names the category it belongs to.