Quick answer: Your binary uses “required reason” APIs (UserDefaults, file timestamps, system boot time, disk space) without declaring why. Add a PrivacyInfo.xcprivacy with an NSPrivacyAccessedAPITypes entry and approved reason code for each category Apple lists in the email, update your engine to a version that ships its own manifest, and update third-party SDKs to versions that include theirs.
Since May 2024, App Store Connect rejects uploads whose code calls certain APIs without a privacy manifest explaining why. Game engines hit this constantly, because saving settings, measuring time and checking free space are exactly the APIs on Apple's list. The email tells you which categories and which binary.
The exact message
ITMS-91053: Missing API declaration - Your app's code in the "UnityFramework" file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app's privacy manifest to provide approved reasons for these APIs used by your app's code.The file named in quotes is the binary that uses the API (your engine framework, the app itself, or a third-party SDK). The categories are what you must declare.
The categories games usually need
| Category | Typical game use | Common reason code |
|---|---|---|
UserDefaults | Settings and saves (Unity's PlayerPrefs uses UserDefaults on iOS) | CA92.1: data used only by the app itself |
FileTimestamp | Checking save or cache file dates | C617.1: files inside the app container |
SystemBootTime | Frame timing, elapsed time | 35F9.1: measuring time between events |
DiskSpace | Checking space before downloads or saves | E174.1: checking space before writing |
Each category's full key is the name above prefixed with NSPrivacyAccessedAPICategory, as in the email. Choose reasons that are true for your app from Apple's documentation on required reason APIs. Declaring a reason that does not match your use is itself a review problem.
Add a privacy manifest
Create PrivacyInfo.xcprivacy (Xcode has a template under App Privacy) and include it in the app target:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>NSPrivacyAccessedAPITypes</key>
<array>
<dict>
<key>NSPrivacyAccessedAPIType</key>
<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
<key>NSPrivacyAccessedAPITypeReasons</key>
<array><string>CA92.1</string></array>
</dict>
<dict>
<key>NSPrivacyAccessedAPIType</key>
<string>NSPrivacyAccessedAPICategorySystemBootTime</string>
<key>NSPrivacyAccessedAPITypeReasons</key>
<array><string>35F9.1</string></array>
</dict>
</array>
<key>NSPrivacyTracking</key><false/>
<key>NSPrivacyTrackingDomains</key><array/>
<key>NSPrivacyCollectedDataTypes</key><array/>
</dict>
</plist>If you collect data (analytics, accounts, crash reports), declare it under NSPrivacyCollectedDataTypes to match your App Store privacy labels.
Engine-specific notes
- Unity: recent patch releases of Unity 2021.3 and 2022.3, and Unity 6, include a privacy manifest for the engine's own API use. Upgrading the patch version is often the whole fix for warnings about
UnityFramework. For your own native plugins, ship a manifest with the plugin for iOS. - Godot: recent versions expose privacy manifest options in the iOS export preset; set the accessed API reasons there instead of editing the Xcode project by hand.
- Unreal: recent engine versions include a manifest for engine API use. For older versions, add your own to the Xcode project as part of your build pipeline so it survives regeneration.
Third-party SDKs
Apple maintains a list of commonly used SDKs that must include their own privacy manifest and signature. Ads, analytics and attribution SDKs are on it. If the email names an SDK's framework, or you get ITMS-91061 (missing privacy manifest for a listed SDK), update that SDK to a version that ships a manifest; you cannot fix another SDK's declaration from your own file.
Check before you upload
In Xcode, archive the build, then in the Organizer right-click the archive and choose Generate Privacy Report. It merges every manifest in the app and shows what you are declaring, so you can spot missing categories before App Store Connect does.
Privacy and crash reporting
Crash and bug reporting is data collection too, and belongs in your declarations. Bugnet captures device model, OS and app version with each report and screenshots only when you enable them for the project. Bugnet imports your Google Play and App Store reviews every hour with device and OS details, files one- and two-star reviews that describe a bug as reports automatically, and its SDKs for Unity, Godot and Unreal mobile builds capture errors with the device attached.
Related problems
- How to Fix TestFlight Builds Stuck “Processing” or Rejected as Invalid Binary
- How to Fix “ITMS-90717: Invalid App Store Icon” (Alpha Channel) Rejections
- How to Run a TestFlight Beta for Your iOS Game
Frequently asked questions
What is ITMS-91053 Missing API declaration?
Apple found calls to required reason APIs, such as UserDefaults or system boot time, in your app without a privacy manifest declaring an approved reason. Uploads without one are rejected.
Which reason code should a game use for UserDefaults?
CA92.1, when the data is only read and written by the app itself, such as settings and saves.
How do I fix ITMS-91053 in Unity?
Update to a recent Unity patch release that includes the engine’s privacy manifest, update third-party SDKs, and add a PrivacyInfo.xcprivacy for any remaining categories your own code uses.
The email names the binary. If it is an SDK, update the SDK; your own manifest cannot speak for it.