Rejection decoder › Guideline 5.1.2 / ITMS-91053

Guideline 5.1.2 and ITMS-91053: privacy manifest and tracking

Two related privacy problems show up for wrapped apps. ITMS-91053 is an upload email saying the build uses certain system APIs without declaring why. Guideline 5.1.2 is a rejection about data used for tracking without asking. Both are fixed by knowing exactly what your build and its SDKs do.

Apple decides. This page is our own reading of the App Review Guidelines as of September 2026, not Apple's wording, and following it does not guarantee approval. The current text at developer.apple.com is the authority.

What Apple's message says

ITMS-91053, Missing API declaration. Paraphrased: the app or a framework inside it uses one or more "required reason" APIs, such as file timestamps, system boot time, disk space or user defaults, and there is no privacy manifest (PrivacyInfo.xcprivacy) that declares an approved reason. The email lists the API categories. Apple has required these declarations for new uploads since May 2024.

Guideline 5.1.2, Data Use and Sharing. Paraphrased: the app, or an SDK in it, collects data used to track people across other companies' apps or websites without asking through App Tracking Transparency. Or your App Privacy answers say you track, but the app never asks.

Why AI-built apps hit it

A Capacitor app is a native shell plus plugins plus your web code. The shell and plugins use system APIs you never wrote yourself:

The iOS project has no PrivacyInfo.xcprivacy file at all.
An old Capacitor version or plugin predates privacy manifests, so its API use is undeclared.
Storage plugins read user defaults and file timestamps, which fall in the required reason categories.
An analytics or attribution SDK added from a tutorial tracks by default, or App Privacy was answered "used to track you" by mistake.

How to fix it, step by step

Read the upload email and list every API category it names.
Update Capacitor and every plugin to current versions. Recent versions usually include their own manifests, which removes many warnings.
Add a privacy manifest to the app target (in Xcode: New File > App Privacy). For each remaining category, add an entry with the reason code that matches what the code actually does. Apple's documentation lists the allowed codes, for example CA92.1 for user defaults read and written by the app itself.
Declare collected data and tracking in the same file, and set tracking to false if the app does not track.
List every SDK in the build and what it collects. Remove tracking SDKs you do not need, or show the App Tracking Transparency prompt before any tracking and respect the answer.
Make App Privacy answers in App Store Connect match the manifest and your privacy policy.
Upload a new build and confirm the ITMS email does not return.

What to reply in the Resolution Center

Fill in the brackets and delete anything you did not do. The ITMS-91053 email alone usually needs no reply; a new build is the answer. Reply only if it came with a rejection.

Hello,

Thank you. Build [version] includes a privacy manifest declaring [API categories] with reasons [codes]. [For 5.1.2, either: "We removed (SDK); the app does not track users, and we corrected our App Privacy answers." Or: "The app now asks for permission through App Tracking Transparency before (SDK) collects any data."]

Best regards,
[Your name]

Related guidelines

Guideline 4.2: Minimum functionality because the same wrapped-app setup is behind most 4.2 findings.
Guideline 5.1.1(v): Account deletion for the other privacy requirement wrapped apps commonly miss.
Guideline 4.8: Login services / Sign in with Apple because auth plugins also need current versions and manifests.

Questions

What does ITMS-91053 Missing API declaration mean?

Your build, or a framework inside it, uses system APIs that need a declared reason, and no privacy manifest declares one. Add a PrivacyInfo.xcprivacy file with the matching reason codes and update plugins to versions that ship their own manifests.

Does a Capacitor app need a privacy manifest?

In practice, yes. The native shell and common plugins use APIs in the required reason categories. Current versions include manifests for their own code, but your app target should still have one for the app.

Do I need App Tracking Transparency if I only use analytics?

Only if data is used to track users across other companies' apps or websites, or shared with data brokers. Many first-party analytics setups do not track in that sense. Check what each SDK does and answer App Privacy to match.

Stuck on this rejection?

Paste the full message into the free rejection decoder to see every cited guideline explained, with a reply draft. It runs in your browser and nothing is uploaded.

Or order a rejection fix, $99: we read the full message, find the cause, fix it in your project, upload a new build and draft the reply for your approval. Target turnaround 72 hours from access. Apple still makes the final decision, and its review time is separate.

Order a $99 rejection fix Decode my rejection (free)