Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageWhat the email means
Apple keeps a list of "required reason APIs": system calls that are useful for normal app features but could also be misused to fingerprint a device. There are five categories: file timestamps, system boot time, disk space, active keyboards and user defaults. Any app or SDK that uses them must say why in a privacy manifest, choosing from a fixed set of approved reasons.
The email names two things: the file whose code uses the API (your app's main executable, or a framework inside the Frameworks folder) and the API categories, written like NSPrivacyAccessedAPICategoryUserDefaults. In early 2024 these emails were reminders; according to Apple's required reason API documentation, uploads without the declarations have not been accepted since May 1, 2024. That is why old forum threads call it "just a warning" and yours is not.
A web-wrapped app triggers it through the native shell, never through your JavaScript. Every iOS app stores settings in user defaults, caches files and measures time, and the SDKs for push, ads and analytics do the same. The usual moments it appears: you added an SDK, you let Cursor or Claude Code write custom Swift, or you rebuilt an older project with a current Xcode.
Four upload errors that travel together
| Code | What App Store Connect is saying (paraphrased) | Fix |
|---|---|---|
| ITMS-91053 Missing API declaration | Code in the named file uses a required reason API, and no privacy manifest in that bundle declares a reason for it. | Add the category and an approved reason to the manifest of the bundle that contains the code. If the file is a third-party framework, update the SDK instead. |
| ITMS-91061 Missing privacy manifest | An SDK from Apple's list of commonly used SDKs is in the build without its own privacy manifest. | Update that SDK to a version that ships a manifest. The list includes Firebase components, OneSignal and the Facebook SDK frameworks, among many others. |
| ITMS-91065 Missing signature | A listed SDK is included as a binary dependency without the vendor's code signature. | Use the signed release from the vendor. Do not edit files inside a framework; that breaks the signature. |
| ITMS-91056 Invalid privacy manifest | A PrivacyInfo.xcprivacy file exists but has a wrong key, value or structure. | Open it in Xcode's property list editor, compare the keys with the example below and remove typos or invented reason codes. |
The five categories and the honest reason for a WebView app
Pick only reasons that describe what the code really does. Apple's reason list attaches conditions to each one, for example that the data never leaves the device.
| Category in the email | Approved reasons (Apple) | Usual choice for a WebViewGold app |
|---|---|---|
NSPrivacyAccessedAPICategoryUserDefaults | CA92.1 data only this app reads and writes; 1C8F.1 shared inside your App Group; C56D.1 SDK wrapper (SDKs only); AC6B.1 managed configuration via MDM | CA92.1. Add 1C8F.1 only if the app shares settings with an extension through an App Group (push service extension, widget, share extension). |
NSPrivacyAccessedAPICategoryFileTimestamp | C617.1 files inside the app or App Group container; DDA9.1 timestamps shown to the user; 3B52.1 files the user picked; 0A2A.1 SDK wrapper (SDKs only) | C617.1 for caches and downloaded files in the app container. 3B52.1 only if the code reads metadata of files the user selected. |
NSPrivacyAccessedAPICategorySystemBootTime | 35F9.1 elapsed time between in-app events and timers; 8FFB.1 absolute timestamps of in-app events; 3D61.1 optional bug report | 35F9.1, the normal case for timers, timeouts and loading measurements. |
NSPrivacyAccessedAPICategoryDiskSpace | E174.1 check space before writing files, with visible behavior; 85F4.1 show space to the user; 7D9E.1 optional bug report; B728.1 health research apps | E174.1 only if the app really checks free space before saving downloads. If you cannot say why, find out which code uses it before declaring anything. |
NSPrivacyAccessedAPICategoryActiveKeyboards | 3EC4.1 custom keyboard apps; 54BD.1 UI adapted to the active keyboard | Rare in a WebView app. If your own target is named, look for custom Swift that an AI agent added. |
With a good optimized version of your web app you can have a stunning mobile app within a couple of minutes. Additionally to that the customer service is very nice and very helpful! I can just recommend WebViewGold :-)
Fix ITMS-91053 in a WebViewGold project
Twenty minutes in Xcode, then a new build number.
Read which file the email names
If it is your app's executable (the name of your .app), the declaration belongs in the app target's manifest. If it is a path like
Frameworks/SomeSDK.framework, the SDK has to declare it in its own manifest, and your file cannot fix that.Start from the current WebViewGold release
Updates are free. If your project is old, download the current version, move over your Config.swift values, Info.plist texts, icons and splash, and check whether the error persists before editing anything by hand. Newer releases can include newer SDK versions; if you are unsure, ask WebViewGold support which version you need.
Find or create PrivacyInfo.xcprivacy
Search the project navigator for
PrivacyInfo.xcprivacy. If the app target already has one, extend it; never add a second manifest to the same target. If there is none, choose File, New, File from Template, pick App Privacy, keep the name PrivacyInfo and tick the main app target.Add one dictionary per category
Under
NSPrivacyAccessedAPITypes, add an entry withNSPrivacyAccessedAPITypeset to the category from the email andNSPrivacyAccessedAPITypeReasonsholding the reason codes that are true for your app. The example below shows the shape.Check every extension the email names
Apple expects a manifest in each bundle whose executable uses the API. If the email names an extension (a notification service extension, widget, share extension or App Clip), give that target its own manifest with the matching reasons.
Verify, bump the build number, upload
Archive, then in the Organizer control-click the archive and choose Generate Privacy Report: Xcode combines all manifests into one PDF, so you can see your categories listed. Increase the build number, upload, and wait for the processing email before submitting.
A minimal PrivacyInfo.xcprivacy for the app target
Two common categories as an example. Use only the categories your email lists and the reasons that match your app; keep any other keys already in your file.
xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- Existing keys such as NSPrivacyTracking or NSPrivacyCollectedDataTypes stay as they are -->
<key>NSPrivacyAccessedAPITypes</key>
<array>
<dict>
<key>NSPrivacyAccessedAPIType</key>
<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
<key>NSPrivacyAccessedAPITypeReasons</key>
<array>
<string>CA92.1</string>
</array>
</dict>
<dict>
<key>NSPrivacyAccessedAPIType</key>
<string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
<key>NSPrivacyAccessedAPITypeReasons</key>
<array>
<string>C617.1</string>
</array>
</dict>
</array>
</dict>
</plist>Keep the manifest consistent with the rest of your privacy story
- Declare reasons that match how the app behaves. A reviewer or an automated check that compares them with your features expects them to agree.
NSPrivacyTrackingbelongs to the same story as App Tracking Transparency. If you show personalized AdMob ads, read ATT for web apps with ads before you set it.- The manifest does not replace the App Privacy answers in App Store Connect. Fill those in separately; the privacy labels guide covers what a web-wrapped app collects.
- Purpose strings in Info.plist are a separate check with its own error, ITMS-90683; see the missing purpose string fix.
- Your web app's cookies, localStorage and IndexedDB run inside WebKit, Apple's own framework. You declare what the native binary does, not what your JavaScript does.
Let an AI agent prepare the change
Paste the full ITMS email where indicated. Review the diff before you build; the agent must not invent reason codes. More on agent setups: configuring the WebViewGold project with Claude Code.
Prompt for Claude Code or Cursor, opened in the WebViewGold Xcode project folder
App Store Connect rejected my upload with the email below. Fix it in this WebViewGold iOS project. 1. For every ITMS-91053 entry, tell me which file it names and whether that file is my app target, one of my extensions, or a third-party framework. 2. For my own targets: find an existing PrivacyInfo.xcprivacy (do not create a second one per target). If none exists, create one with membership in that target only. 3. Add one NSPrivacyAccessedAPITypes dictionary per category named in the email. Choose reasons only from this list and explain each choice in one sentence: UserDefaults CA92.1, 1C8F.1 (only if an App Group is used); FileTimestamp C617.1, DDA9.1, 3B52.1; SystemBootTime 35F9.1, 8FFB.1, 3D61.1; DiskSpace E174.1, 85F4.1, 7D9E.1; ActiveKeyboards 3EC4.1, 54BD.1. If you cannot find code that justifies a reason, stop and ask me. 4. For third-party frameworks: do not touch them. List the SDK, the version in this project and tell me which update would include its own privacy manifest. 5. Do not change Config.swift, Info.plist purpose strings or any other file. Email: [paste the complete ITMS email here]
Frequently asked questions
Is ITMS-91053 a rejection by App Review?
No. It is an automated check when the build is processed, before any person looks at the app. The build is not accepted, so App Review never sees it; once a fixed build uploads cleanly, you submit as usual.
Can I add every reason code to be safe?
No. Each reason is a statement about how your code uses the API and the data, and some reasons are reserved for SDKs or for specific app types such as health research. Declare what is true and nothing more.
Do I have to declare localStorage or cookies used by my web app?
No. Your web app runs inside WebKit, which is Apple's system framework. The manifest covers the native code in your binary and the SDKs you ship with it.
I build with the Cloud Builder. What do I do with this email?
You do not edit an Xcode project in that setup. Send the full email text to WebViewGold support so the build configuration can be checked, and do not change your web app; the manifest is part of the native build.
Do I need a new build number after adding the manifest?
Yes. The manifest lives inside the app bundle, so it only reaches Apple with a new upload. Increase the build number, archive and upload again.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.