Privacy manifests

[NikcN22]

Hello!

How about Third-party SDK Privacy manifest. Is Kingfisher use required reason API?

Important
From Fall 2023 you’ll receive an email from Apple if you upload an app to App Store Connect that uses required reason API without describing the reason in its privacy manifest file. From Spring 2024, apps that don’t describe their use of required reason API in their privacy manifest file won’t be accepted by App Store Connect.

Important
Third-party SDKs need to provide their own privacy manifest files that record the types of data they collect. Your app’s privacy manifest file doesn’t need to cover data collected by third-party SDKs that your app links to.

[onevcat]

It is done in #2104 and #2135. But seems there are still a few things need to be done before it can automatically generate the manifest. I am working on this and will release a new version for it soon.

[onevcat]

Released as a part in 7.10.0.

[abhishekthanvi8]

It is not working after upgrading ? Apple is still sending email regarding this issues for NSPrivacyAccessedAPICategoryDiskSpace and NSPrivacyAccessedAPICategoryFileTimestamp I have upgraded the SDK to 7.11.0 Also when generating the privacy report these APITypes are not included

[onevcat]

@abhishekthanvi8

As I know now, Apple is not checking or reading any privacy manifest provided by the 3rd party SDKs. It only helps you to generate the privacy nutrition labels (as advertised in the WWDC last year), but without merging or helping you to create the API usage reasons (Apple has not promised it).

So even it is described in a 3rd party SDK (like Kingfisher is doing), you still need to manually add it to your own privacy manifest of your app level, with describing any API usage in an SDK. Otherwise, you may still receive warnings from Apple. So the easiest way now, is triggering a warning email from Apple and then add anything mentioned in your privacy manifest file.

No one knows if the situation would change soon or not forever, and there is no promise from Apple too as I know. Please keep that in mind.

[BorysKhl]

@onevcat Just an assumption but maybe .copy in Package implementation doesn't work properly.
You're using resources: [.copy("PrivacyInfo.xcprivacy")] in targets, when Firebase for example uses process command resources: [.process("Resources/PrivacyInfo.xcprivacy")],.
I understand that copy should work and it is the right way to use, though by testing on a custom Package .process resulted in no emails regarding required reason API usage.
Also from the documentation on process

If no optimization is available for a file type, Swift Package Manager copies the file

and

If possible, use this rule instead of Resource/copy(_:).

[onevcat]

@BorysKhl
Thanks for sharing the information. Let me change it to process and see how it can work locally first!

[onevcat]

@BorysKhl

It seems that changing copy to process in the Package.swift file didn't alter the outcome of the privacy manifest file in the final app. This suggests that there might be other factors contributing to the correct behavior you're having.

Although process is generally recommended over copy, it appears that this modification alone may not resolve the original issue. Nonetheless, I will go ahead and implement this change in the Package.swift file. This adjustment is still a good practice, even if it doesn't directly address the main problem at hand.

Please let me know if there's anything else we can explore or if you have any further questions.