PrivacyInfo.xcprivacy: an example file and the required-reason APIs explained

By Alok Singh · Published November 10, 2026

Built by Alok Singh (Best Latest Apps). The privacy manifest generator linked here is ours.

Short answer: PrivacyInfo.xcprivacy is a property list with four keys: whether you track, your tracking domains, the data you collect and why, and the required-reason APIs you call, each with an approved reason code. Most apps need at least NSPrivacyAccessedAPICategoryUserDefaults with CA92.1. You can build the file in our privacy manifest generator or copy the example below.

Last updated: 2026-11-10

The four keys

Key	Type	What it says
`NSPrivacyTracking`	Boolean	Whether the app or SDK tracks users as defined by App Tracking Transparency
`NSPrivacyTrackingDomains`	Array of strings	Domains used for tracking; iOS blocks them until the person allows tracking
`NSPrivacyCollectedDataTypes`	Array of dictionaries	Each data type collected, whether it's linked to the user, whether it's used for tracking, and the purposes
`NSPrivacyAccessedAPITypes`	Array of dictionaries	Each required-reason API category used, with `NSPrivacyAccessedAPITypeReasons`

The five required-reason API categories

Category (`NSPrivacyAccessedAPIType`)	Typical APIs	Common reason	Other approved codes
`NSPrivacyAccessedAPICategoryUserDefaults`	`UserDefaults`, `@AppStorage`	`CA92.1`: data only this app reads and writes	`1C8F.1` (App Group), `C56D.1` (SDK wrapper), `AC6B.1` (MDM managed configuration)
`NSPrivacyAccessedAPICategoryFileTimestamp`	`creationDate`, `modificationDate`, `stat`, `getattrlist`	`C617.1`: timestamps of files in your own container (for example cache age)	`DDA9.1` (showing dates to the user), `3B52.1`, `0A2A.1`
`NSPrivacyAccessedAPICategorySystemBootTime`	`systemUptime`, `mach_absolute_time`	`35F9.1`: measuring time between events in the app	`8FFB.1`, `3D61.1`
`NSPrivacyAccessedAPICategoryDiskSpace`	`volumeAvailableCapacity`, `statfs`	`E174.1`: checking free space before writing files	`85F4.1`, `7D9E.1`, `B728.1`
`NSPrivacyAccessedAPICategoryActiveKeyboards`	`activeInputModes`	`3EC4.1`: a custom keyboard app checking active keyboards	`54BD.1`

Read Apple's wording for each code before you pick one: the privacy manifest generator shows every approved code with what it allows, and Apple's list is in Describing use of required reason API. Apple updates the list from time to time.

Example PrivacyInfo.xcprivacy

An app that doesn't track, collects crash data for app functionality, and uses UserDefaults and timestamps of its own files:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyTrackingDomains</key>
  <array/>
  <key>NSPrivacyCollectedDataTypes</key>
  <array>
    <dict>
      <key>NSPrivacyCollectedDataType</key>
      <string>NSPrivacyCollectedDataTypeCrashData</string>
      <key>NSPrivacyCollectedDataTypeLinked</key>
      <false/>
      <key>NSPrivacyCollectedDataTypeTracking</key>
      <false/>
      <key>NSPrivacyCollectedDataTypePurposes</key>
      <array>
        <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
      </array>
    </dict>
  </array>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>CA92.1</string>
      </array>
    </dict>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>C617.1</string>
      </array>
    </dict>
  </array>
</dict>
</plist>

Step by step

List every required-reason API your code calls, including helpers: @AppStorage is UserDefaults, and a "time since launch" helper is usually system boot time.
Do the same for each SDK. Check that SDKs ship their own manifests; your file doesn't cover them.
Tick the categories and reasons in the generator, or edit the example above.
Add the file to the app target (File > New > File > App Privacy).
Archive, then in Xcode's Organizer generate the privacy report and check it matches your App Store privacy label.

Ways to create the file

Option	Pros	Cons
Xcode's App Privacy template	Built in; edit as a property list	You look up every key and reason code yourself
Our privacy manifest generator	Ticks instead of typing; shows every approved code with what it allows; opens an existing file to edit; runs in your browser	It can't see your code, so you still decide which APIs you use
Writing the plist by hand	Full control	Easy to mistype a key or code

Want the details of how the generator models Apple's rules and catches half-finished manifests? See Writing PrivacyInfo.xcprivacy without guesswork.

FAQ

Do I need a PrivacyInfo.xcprivacy file?

Yes if your app or SDK uses any required-reason API, which most apps do through UserDefaults or file timestamps. Since May 1, 2024, App Store Connect doesn't accept apps that use these APIs without declaring a reason in the privacy manifest.

What are required-reason APIs?

System APIs that could be misused to fingerprint a device. Apple groups them into five categories: file timestamps, system boot time, disk space, active keyboards and UserDefaults. For each category you use, you declare one or more approved reason codes.

Which reason code should I use for UserDefaults?

CA92.1 for data only your app reads and writes. Use 1C8F.1 when apps, extensions or App Clips in the same App Group share it, and C56D.1 if you are a third-party SDK wrapping UserDefaults for the host app.

Where do I put PrivacyInfo.xcprivacy in Xcode?

Add it to your app target with File > New > File > App Privacy, or drag the file into the project and tick your target. Third-party SDKs ship their own manifest inside the framework or package.

Does my app's manifest cover the SDKs I use?

No. Each SDK that uses a required-reason API has to declare it in its own privacy manifest; it can't rely on the app's file. Xcode combines all of them into a privacy report.

Do I need a manifest if my app collects no data?

Yes, if you use any required-reason API. Declare the APIs and reasons, set tracking to false and leave the collected data types empty.

Sources: Apple, "Describing use of required reason API" (developer.apple.com, enforcement from May 1, 2024; each SDK declares its own use), fetched 10 Nov 2026. Reason codes and their meanings match the live generator and the existing article on bestlatestapps.com. Codes in the "other approved codes" column are listed without descriptions on purpose; the page sends readers to the generator and to Apple for their exact wording.

← All guides