Privacy Manifest Lint - xcprivacy & ITMS-91053

Five defects come out of the nine-line PrivacyInfo.xcprivacy below - the kind a .NET MAUI or Flutter team ships without noticing, because Xcode never reads it back to them.

<key>NSPrivacyAccessedAPICategory</key>
<string>NSPrivacyAccessedAPICategoryUserDefault</string>
<key>NSPrivacyAccessedAPIReasons</key>
<array>
	<string>CA92.2</string>
	<string>AC6B.1</string>
</array>

Line 1: the key is NSPrivacyAccessedAPIType. The category name is its string value, not the key itself. Line 2: the category is plural - NSPrivacyAccessedAPICategoryUserDefaults. Line 3: the key is NSPrivacyAccessedAPITypeReasons. The word "Type" is missing. Line 5: CA92.2 is not a code Apple issues. Exactly 17 exist and every one of them ends in .1. Line 6: AC6B.1 is real, but it is only for MDM managed app configuration - reading com.apple.configuration.managed or writing com.apple.feedback.managed. The code for a third-party SDK that wraps the user-defaults APIs is C56D.1.

That last one is the expensive line, and it is the reason a language model is a bad place to get these. Ask a chatbot which reason code covers an SDK wrapper around NSUserDefaults and AC6B.1 is a very plausible answer. It is also wrong, it looks correct in the file, and nothing on your machine tells you otherwise. App Store Connect tells you, with ITMS-91055 or ITMS-91056, after the build, on the day you were going to release.

The second half of the problem is where the call actually lives. Apple's tooling inspects Swift and Objective-C. A .NET MAUI app reaches user defaults through Preferences.Default, reads the boot clock through Environment.TickCount, and calls stat through File.GetLastWriteTime. Flutter does it through shared_preferences and File.lastModifiedSync. React Native does it through react-native-device-info. None of those lines are Swift, so none of them show up in the place you are looking.

Privacy Manifest Lint is a VS Code extension and a free web page that read both halves. Open a PrivacyInfo.xcprivacy and it decodes every reason code in it back to the category Apple assigns it to, quoting Apple's own condition on that line, and flags any code Apple never issued. Open a .cs, .dart, .ts, .swift, .m or .kt file and it names the required-reason API you called, the category to declare, and the codes you are allowed to choose from. It ships 48 rules and all 17 reason codes, and it runs entirely on your machine - the file is never uploaded anywhere.

The free version checks one open file completely - every rule, every code, no watermark, no trial clock. The paid version changes the scope rather than the quality: the whole repository instead of one file, the report exported as CSV, JSON or HTML, CI JSON so a pipeline fails before App Store Connect does, and an in-place fix for the misspelled keys.

Paste your manifest into the free page first. If it comes back clean, you have lost nothing but a minute. If it comes back with five lines, you have just kept a release date.