Privacy Manifest Lint - xcprivacy & ITMS-91053

Five defects come out of the seven-line PrivacyInfo.xcprivacy below, and they belong to the .NET MAUI, Flutter and React Native teams shipping iOS apps to Apple's App Store.

line 1: The key is NSPrivacyAccessedAPIType; the category name is its <string> value, not the key. Upload returns ITMS-91056.
line 2: Category is plural: NSPrivacyAccessedAPICategoryUserDefaults. Upload returns ITMS-91056.
line 3: The key is NSPrivacyAccessedAPITypeReasons. "Type" is missing here. Upload returns ITMS-91056.
line 5: Not a reason code Apple issues. Exactly 17 exist and every one ends in ".1".
line 6: AC6B.1 belongs to NSPrivacyAccessedAPICategoryUserDefaults - read com.apple.configuration.managed or write com.apple.feedback.managed for MDM managed app configuration - MDM ONLY.

Those five came out of these seven lines, which is the whole file:

<key>NSPrivacyAccessedAPICategory</key>
<string>NSPrivacyAccessedAPICategoryUserDefault</string>
<key>NSPrivacyAccessedAPIReasons</key>
<array>
	<string>CA92.2</string>
	<string>AC6B.1</string>
</array>

The last finding is the expensive one, and it is the reason a language model is a bad place to get these. Ask a chatbot which reason code covers an SDK wrapper around NSUserDefaults and AC6B.1 is a very plausible answer. It is also wrong, it looks correct in the file, and nothing on your machine tells you otherwise. App Store Connect tells you, with ITMS-91055 or ITMS-91056, after the build, on the day you were going to release.

The second half of the problem is where the call actually lives. Apple's tooling inspects Swift and Objective-C. A .NET MAUI app reaches user defaults through Preferences.Default, reads the boot clock through Environment.TickCount, and calls stat through File.GetLastWriteTime. Flutter does it through shared_preferences and File.lastModifiedSync. React Native does it through react-native-device-info. None of those lines are Swift, so none of them show up in the place you are looking.

Privacy Manifest Lint is a VS Code extension and a free web page that read both halves. Open a PrivacyInfo.xcprivacy and it decodes every reason code in it back to the category Apple assigns it to, quoting Apple's own condition on that line, and flags any code Apple never issued. Open a .cs, .dart, .ts, .swift, .m or .kt file and it names the required-reason API you called, the category to declare, and the codes you are allowed to choose from. It ships 48 rules and all 17 reason codes, and it runs entirely on your machine - the file is never uploaded anywhere.

The free version checks one open file completely - every rule, every code, no watermark, no trial clock. The paid version changes the scope rather than the quality: the whole repository instead of one file, the report exported as CSV, JSON or HTML, CI JSON so a pipeline fails before App Store Connect does, and an in-place fix for the misspelled keys. That is $29 once.

Paste your manifest into the free page first. If it comes back clean, you have lost nothing but a minute. If it comes back with five findings, you have just kept a release date.