Apple Privacy Manifest

[ilanahaddad]

Hi team,

Is there a plan to include the PrivacyInfo.xcprivacy manifest as required by Apple?
ref: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files

Apple has announced the updated schedule for sending warnings starting March 13th and rejections starting May 1st here.

Thanks,
Ilana

[stephencelis]

@ilanahaddad We believe that privacy manifests are only required for the SDKs listed here:

https://developer.apple.com/support/third-party-SDK-requirements/

Per your link:

And if you add a new third-party SDK that’s on the list of commonly used third-party SDKs, these API, privacy manifest, and signature requirements will apply to that SDK.

That said we are open to adding a privacy manifest if someone submits a pull request, or if someone encounters a warning or rejection due to our library.

[ilanahaddad]

Thanks Stephen! should be good then thanks, i'll keep you posted if we receive any warnings regarding your library

[DandyLyons]

I did a little more digging. According to this page, we have to include a privacy manifest if we access UserDefaults at all.

https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api#4278401

With the addition of @Shared(.appStorage()) I think this will be necessary.

[DandyLyons]

I believe that from the point of view of the app developer, it's only necessary to declare it if UserDefaults is actually accessed, (in other words if we don't actually use @Shared(.appStorage) then this doesn't matter.

However, I think the .xcprivacy could be quite helpful, and over time I expect Apple to clamp down on this more and more such that it will be quite cumbersome to not have a .xcprivacy.

[kamcma]

I do see some other UserDefaults wrapper library packages adding privacy manifests here, and here. I don't know if they know better though, or are just being defensive.

One thing that kinda confuses me: even if a library declares reason C56D.1, that they are a UserDefaults wrapper library, doesn't the consumer of said library still have to declare another UserDefaults reason, eg CA92.1 or 1C8F.1, to indicate whether they are using UserDefaults only within the app or app group, respectively? Isn't it compiled to one binary, from Apple's perspective (at least when consumed via SPM)? Of what value is a wrapper library-only declaration?

Apple could have done a better job explaining this.

[DandyLyons]

My understanding is that the App Store is reviewing the privacy compliance of the app, not the dependencies (after all libraries are not released in the App Store). They simply provide the privacy manifest (.xcprivacy) as a way for libraries to self audit their code, which lessens the burden on individual app developers. (Also, there's not really a way to audit a closed-source dependency, so this addresses that problem as well.)

When the app dev submits their app to the app store, they must send a privacy report (which is partially derived from all the available .xcprivacy files).

In other words, the library just declares what they are using UserDefaults for. But if the app is using it for something above and beyond that use case, then it's the app's responsibility to declare that as well.

I could be wrong, but i think that's how it works.

[DandyLyons]

I opened an Issue here: #2928
I hope to have a PR submitted later today.

[DandyLyons]

Closed the issue, per this conversation: https://pointfreecommunity.slack.com/archives/C03LPTDEY90/p1710874460774779?thread_ts=1710855012.994449&cid=C03LPTDEY90