ITMS-91061 — Missing privacy manifest

Apple's list is the ground truth

Apple publishes a list of "commonly used SDKs in apps on the App Store" that must include a privacy manifest and a signature. As transcribed on 6 September 2026 it contains 86 entries, and the rule is broad: "Any version of a listed SDK, as well as any SDKs that repackage those on the list, are included in the requirement."

The React Native and Expo entries most likely to be in your tree:

Note how many of those are transitive. You did not install nanopb. You installed Firebase, which installed gRPC, which installed nanopb. That is the actual shape of this problem, and it is why "just check your dependencies" is not useful advice.

Finding the responsible framework

# 1. Which packages already ship a manifest?
find node_modules -name "PrivacyInfo.xcprivacy" | sed 's|node_modules/||' | cut -d/ -f1 | sort -u

# 2. Which frameworks are actually in the built app?
find ios/build -name "*.framework" -maxdepth 6 2>/dev/null | xargs -n1 basename | sort -u

# 3. Which of those have a manifest inside them?
for f in $(find ios/build -name "*.framework" -maxdepth 6 2>/dev/null); do
  [ -f "$f/PrivacyInfo.xcprivacy" ] || echo "NO MANIFEST: $(basename "$f")"
done

Then intersect step 3's output with Apple's list. The overlap is your answer.

The four ways out

1. Update the dependency. By far the most common fix. Most actively maintained libraries added PrivacyInfo.xcprivacy during 2024. Check the package's changelog for "privacy manifest" and bump.

2. Update the transitive pod, not the wrapper. If nanopb is the problem, updating @react-native-firebase/app may not move it — check Podfile.lock for the resolved version and, if necessary, pin the pod explicitly in the Podfile.

3. Replace the package. For abandoned libraries this is the only real answer. An unmaintained package that will never ship a manifest is now a shipping blocker, not just technical debt.

4. Remove it. Frequently viable, and frequently the fastest. A charting library used on one screen, a keyboard manager you added in 2022 and no longer need, an analytics SDK nobody reads — each one removed is a class of rejection removed.

What is not a way out: adding entries for the framework to your app's PrivacyInfo.xcprivacy. That does not satisfy the per-bundle requirement, and it produces an upload that fails the same way.

The cost, and why it is worth pre-checking

ITMS-91061 arrives after an upload. So the loop is build → upload → wait → read a message that does not name the package → guess → repeat. For an EAS build that is 15 to 40 minutes per iteration, and the message gives you a haystack rather than a needle.

shipcheck reads the dependency tree, the built products, and every manifest in it locally, before you build, and reports which listed SDK is missing a manifest — with Apple's clause quoted next to it. No repository upload, no account: it runs inside the Claude Code session you already have open. How it works.

Related codes

• ITMS-91053 — Missing API declaration
• ITMS-91054 — Invalid API category declaration
• ITMS-91055 — Invalid API reason declaration
• ITMS-91056 — Invalid privacy manifest at a given path
• Full required-reason API reference

Questions and answers