AI & TechnologyITMS-91053 and ITMS-91061: Fix Privacy Manifest Emails

If App Store Connect emailed you ITMS-91053 or ITMS-91061, a PrivacyInfo.xcprivacy file is missing or incomplete, either in your own code or in a third-party SDK. ITMS-91053 is about required reason APIs used without a declared reason. ITMS-91061 is about a commonly used SDK, such as Flutter itself, that ships without a privacy manifest. In a Flutter app the fix is usually to upgrade Flutter and your plugins first, and to add your own manifest only for native code you wrote.

The facts below come from Apple's developer documentation, Apple's SDK requirements page, the Flutter team's comments on GitHub and the plugin manifests listed in the sources. I checked each one on October 18, 2026.

Disclosure: App369 is my studio. I build and fix Android and iOS apps, mostly in Flutter, and the last section mentions what I sell. Apple doesn't pay me for anything on this page.

What the two errors mean

The wording comes from emails quoted in Flutter issues 145269 and 163455. Your email may differ a little, so read the file name it gives. That name is your first clue.

The dates

Apple's SDK page says you must include the manifest for any listed SDK when you submit a new app that includes it, or an update that adds it. It also says signatures are required where the listed SDKs are used as binary dependencies, and that any version of a listed SDK is covered. That page didn't state a date when I read it, so I rely on the other Apple page for February 12, 2025.

The list includes Flutter, FirebaseCore, FirebaseAuth, FirebaseMessaging, path_provider, shared_preferences_ios, url_launcher, image_picker_ios, sqflite and many more. Check Apple's list for the plugins in your app.

The five required reason API categories

Apple describes these APIs as ones that could be misused to fingerprint a device or user. Each category goes in the NSPrivacyAccessedAPITypes array with one or more reason codes. These are the categories and the codes I read in Apple's documentation:

Each reason comes with limits. For example, Apple says information accessed for several of these reasons may not be sent off-device. Read the full text for your code before you pick one.

Find which SDK or plugin triggers it

1. Read the email. It names the file. "Runner" means your app target, or a plugin built statically into it. A path like Frameworks/Flutter.framework/Flutter means that framework.
2. Upgrade first. The Flutter team's guidance in issue 145269 (comment dated April 22, 2024) starts with flutter pub upgrade, because many plugins added their manifests after the rules came out.
3. Look at what your build contains. The same guidance says to run find build/ios/iphoneos -name "*.xcprivacy" and look at each PrivacyInfo.xcprivacy inside the plugin bundles. Compare their declarations with the categories in your email. If all of them together don't cover the email, at least one dependency has no manifest.
4. Try packaging plugins as frameworks. The same guidance says adding the use_frameworks! line from Flutter's Podfile template can change a warning from "Runner" to a named framework. Then you know which plugin to contact. Plugins that set static_framework = true override it.
5. Search your own code. In ios/Runner.xcworkspace, use Find in Workspace for the APIs listed in the flagged category, and check whether the matches are in code you wrote or in a plugin.

The Flutter team also noted a bug in App Store Connect, at least as of April 2024, that could produce a warning for static frameworks that do declare their reasons. If your plugins all have manifests and the warning still names Runner, that comment is worth reading.

Add or edit PrivacyInfo.xcprivacy in Xcode

Do this only for code in your own app, or if an SDK can't be updated. Apple's steps:

1. Open ios/Runner.xcworkspace in Xcode.
2. Choose File > New File.
3. Scroll to the Resource section and select the App Privacy File type, then click Next.
4. Check the Runner target in the Targets list and click Create.

The file is named PrivacyInfo.xcprivacy by default, and that is the required name. Apple says the file must be in the target's resources for Xcode to use it, and that for an iOS app Xcode places it at the root of the app bundle.

A minimal manifest for an app whose own code reads and writes UserDefaults for itself looks like this. It matches the structure in Flutter's own plugin manifests:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array/>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>
            </array>
        </dict>
    </array>
</dict>
</plist>

Use this as a shape, not as an answer. The Flutter team warns that a manifest is an attestation to Apple that you use data and APIs only in the ways it describes, and that copying arbitrary text could misrepresent your app. Set NSPrivacyTracking to true and list domains only if your app tracks as Apple defines it. Fill NSPrivacyCollectedDataTypes to match what you collect.

Apple also says App Store Connect rejects submissions with invalid manifests, so use only the keys and values Apple documents.

Update Flutter, plugins and pods

• Flutter itself. Flutter's engine source has a PrivacyInfo.xcprivacy for the iOS framework. A maintainer replied to someone on Flutter 2.5.3 that the version is more than three years old and predates framework privacy manifests, so it can't be published as a new app under Apple's rules. If your ITMS-91061 names Flutter, upgrade Flutter. My advice: if the upgrade breaks the iOS build, see the iOS build-failed-after-upgrade guide and the UIScene migration guide.
• Plugins. Run flutter pub upgrade, then check the plugins on Apple's list against their changelogs. The shared_preferences iOS plugin, for example, declares UserDefaults with reason 1C8F.1 in its own manifest.
• Pods. After a plugin update, run pod install from ios/ and rebuild. My advice: delete Pods and Podfile.lock first if CocoaPods keeps the old versions.
• A plugin with no update. Ask its maintainer to add a manifest, replace the plugin, or as a last resort, declare its usage in your own manifest. Apple's documentation says an SDK can't rely on an app's manifest to report its own use, so this is a stopgap.

Check the archive and re-upload

1. In Xcode, choose Product > Archive.
2. In the Organizer, Control-click the archive and choose Generate Privacy Report.
3. Choose where to save it and open the report in Preview.

Apple says the report aggregates the privacy manifests from your app and the third-party SDKs it links to, and that Xcode won't generate it correctly if you define your own collected data types or purposes instead of Apple's listed values. Then upload again and wait for the processing email.

If Apple's email points at an invalid manifest inside an SDK, Apple's documentation says to choose Window > Organizer, click Archives, Control-click your archive and choose Show in Finder, then Control-click it in the Finder and choose Show Package Contents. My advice: contact the SDK's developer first rather than editing a signed framework.

Need a hand?

If App Store Connect keeps rejecting your upload with ITMS-91053 or ITMS-91061, the App Fix Ticket covers it in two fixed-price steps. A $450 Diagnosis gives you the root cause with evidence and a fixed repair quote within 3 business days, credited toward the fix. If you go ahead, the $1,200 Fix takes 5 business days and comes as a pull request. Or send me a short description.