# App Privacy in App Store Connect: what to declare for SDKs > App Privacy declares the data your app and its SDKs collect, how it's used, whether it's linked to the user and tracking. Publish it before you submit. Original page: [App Privacy in App Store Connect: what to declare for SDKs](https://devoria.fr/en/blog/app-privacy-app-store-connect-sdks) Author: [Mehdi Azizi](https://devoria.fr/en/mehdi-azizi) Published: 2026-11-04 Content last revised: 2026-11-04 App Privacy is the App Store Connect section that generates the privacy labels on your product page. In it, you declare every type of data your app **and the SDKs you've added to it** collect: what it's used for, whether it's linked to the user, whether it's used for tracking. **Until your answers are published, App Store Connect won't let you add your version to a submission.** You can fix your answers at any time, no build needed. The hard part is knowing what to declare for RevenueCat, Sentry, PostHog, Supabase, AppsFlyer, Meta or Expo notifications. The table below is based on each SDK's documentation and the manifests they ship, reviewed on October 15, 2026. I publish my own iOS apps with Expo and these SDKs. This guide covers what Apple asks for and what I actually did. It's not legal advice. ## App Privacy, privacy policy and manifest: three different things - **The privacy policy** is a web page whose URL you provide. The method is in [privacy policy for an iOS app](https://devoria.fr/en/blog/app-privacy-policy-ios-apple-requirements). - **The privacy manifest** is a `PrivacyInfo.xcprivacy` file shipped inside the build. It's covered in detail in [the ITMS-91053 guide](https://devoria.fr/en/blog/itms-91053-missing-api-declaration-expo). - **App Privacy** is the App Store Connect questionnaire. It shows up on your product page in three blocks: Data Used to Track You, Data Linked to You, Data Not Linked to You. **All three must tell the same story.** Apple's [App Privacy Details](https://developer.apple.com/app-store/app-privacy-details/) page states that this information is required to submit an app and its updates, and that it also covers your third-party partners: analytics tools, ad networks, SDKs and vendors whose code you've added. ## Filling out App Privacy step by step [App Store Connect Help](https://developer.apple.com/help/app-store-connect/manage-app-information/manage-app-privacy) details the steps below. To fill out the questionnaire, your role must be Account Holder, Admin or App Manager. 1. In Apps, open your app, then **App Privacy** in the sidebar. 2. Click **Get Started**. 3. Answer the first question: do you or your partners collect data? If the answer is no, choose "No, we do not collect data from this app" and save. You're done. 4. Otherwise, check every data type collected, by your code or by your SDKs. 5. For each type, answer the three questions: purposes, linked to the user, tracking. 6. Review the Product Page Preview, click **Publish** and confirm. If your app is already live, Apple asks that your answers describe the data of the live version. **Publish before you submit.** In September 2026, on Piaf, adding the version to the submission failed with this message: "You must have published answers to your app's data usages." I haven't found a way to fill out this form through the public App Store Connect API. So I do it in the web interface, before anything else. ## The three questions asked for each data type ### What collecting means For Apple, collecting means **sending data off the device and being able to access it for longer than it takes to serve the request**. So: - data processed only on the iPhone isn't collected; - a token or IP address that's sent and then immediately discarded isn't either; - data collected solely to make the app work still has to be declared, with that purpose. ### Purposes Apple offers six purposes: Third-Party Advertising, Developer's Advertising or Marketing, Analytics, Product Personalization, App Functionality and Other Purposes. A single data type can check several: an email used for sign-in and to personalize the app checks App Functionality and Product Personalization. ### Linked to the user Data is linked when it's tied to the person's identity, through their account, their device or some other means. Apple notes that it often is, unless you anonymize it before collecting it and never try to link it back afterward. **As soon as you pass the account ID to an SDK (identify, setUser, logIn), that SDK's data becomes linked.** ### Tracking Tracking means linking your app's data with data from other companies' apps or websites, for targeted advertising or ad measurement. Sharing data with a data broker counts too. **An SDK that combines your data with data from other apps for advertising counts as tracking, even if you don't use it for that.** A "yes" to tracking has two consequences: the App Tracking Transparency prompt before any tracking, explained in [guideline 5.1.2](https://devoria.fr/en/blog/guideline-5-1-2-third-party-ai-att-data-sharing), and a manifest that declares tracking along with its domains. Without those domains, you get [error ITMS-91064](https://devoria.fr/en/blog/itms-91064-invalid-tracking-information-fix). ## What to declare for the SDKs in an Expo app This table is based on each SDK's default configuration. **As soon as you send them more (email, account ID or custom events), you declare more.** | SDK | Data to declare | Tracking | Source | | ------------------ | ----------------------- | -------------- | ---------------------- | | RevenueCat | Purchase history | No | RevenueCat docs | | Sentry | Crashes, performance | No | Docs and manifest | | PostHog | App interactions | No | PostHog iOS manifest | | Supabase Auth | Email, user ID | No | No docs found | | AppsFlyer | Device ID, interactions | Yes, device ID | AppsFlyer manifest | | Meta SDK | Device ID, crashes | Yes, device ID | Meta docs and manifest | | Expo Notifications | Device ID (push token) | No | No docs found | ### RevenueCat [Its App Privacy documentation](https://www.revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy) asks you to declare purchase history, with two purposes every RevenueCat user must check: Analytics and App Functionality. Linked: no if your IDs are anonymous, yes if your RevenueCat user ID can be tied to an email. Add User ID if you pass your own ID, and contact info if you send an email as an attribute. The SDK's manifest only lists App Functionality: follow the docs, they're more complete. The setup is in [RevenueCat for in-app subscriptions](https://devoria.fr/en/blog/revenuecat-ios-in-app-subscription-setup). ### Sentry [Its mobile privacy page](https://docs.sentry.io/security-legal-pii/security/mobile-privacy/) says it plainly: Sentry is a partner you must declare, its standard purposes are Analytics and App Functionality, it doesn't track and doesn't need the advertising identifier. [Its manifest](https://github.com/getsentry/sentry-cocoa/blob/main/Sources/Resources/PrivacyInfo.xcprivacy) declares crash data, performance data and other diagnostic data, not linked. If you attach the account ID to reports with `Sentry.setUser`, they become linked. ### PostHog I didn't find any App Privacy recommendation published by PostHog. The [manifest of its iOS SDK](https://github.com/PostHog/posthog-ios/blob/main/PostHog/Resources/PrivacyInfo.xcprivacy) declares product interaction and other usage data, not linked, no tracking, for analytics. For React Native, [its documentation](https://posthog.com/docs/libraries/react-native) says app lifecycle events are captured by default, screen views too with React Navigation 6 or older, that `identify` links past events to the user, and that an IP-based location is added unless you use `disableGeoip`. In my view, if you keep that location, declare coarse location. ### Supabase Auth As far as I know, Supabase doesn't publish an App Privacy recommendation. Based on Apple's definitions, email sign-in means declaring email address and user ID, for App Functionality, linked. [Its audit logs](https://supabase.com/docs/guides/auth/audit-logs) also record the IP address of every sign-in: Apple asks you to declare a retained IP according to how you use it. And everything you store in your tables counts: content, photos, history. ### AppsFlyer and Meta Both manifests declare **the device ID as used for tracking, for third-party advertising**. [AppsFlyer's](https://github.com/AppsFlyerSDK/AppsFlyerFramework/blob/master/Resources/PrivacyInfo.xcprivacy) adds product interaction, for analytics. [Meta's](https://github.com/facebook/facebook-ios-sdk/blob/main/FBSDKCoreKit/FBSDKCoreKit/PrivacyInfo.xcprivacy) adds crash data and other data. [Meta's iOS documentation](https://developers.facebook.com/docs/ios) states that its manifest only covers default collection: any extra data is yours to declare. In July 2026, when I added AppsFlyer to TradaZen, I added the device ID, for third-party advertising and analytics, used for tracking. The "Data Used to Track You" block appeared on the product page. The first build with AppsFlyer, though, was rejected during processing: the app's manifest declared tracking without its domains. ### Expo Notifications I didn't find any recommendation published by Expo, and [the expo-notifications manifest](https://github.com/expo/expo/blob/main/packages/expo-notifications/ios/PrivacyInfo.xcprivacy) declares no collected data. But the push token you store on your server identifies the device for your app. My cautious reading: device ID, for App Functionality, linked if you store it with the account, no tracking. This isn't a rule written by Apple. ## My method: one list to keep everything aligned I reread the published policy before touching the questionnaire. TradaZen's lists the sign-in email, the subscription, the notification token, usage stats, error reports and ad attribution subject to consent. Each line of the policy becomes a data type in App Privacy. **When I add an SDK or a feature that sends data, I update the policy, App Privacy and the manifest on the same day.** To check, list the bundled manifests with the command from the ITMS-91053 guide mentioned above. With a Mac and Xcode, [the privacy report](https://developer.apple.com/documentation/bundleresources/describing-data-use-in-privacy-manifests) pulls them together: Product, then Archive, then Generate Privacy Report in the Organizer. Apple presents it as a help for filling out App Store Connect. ## Updating App Privacy without a build Apple says so: you can change your answers at any time, without an app update. **Your privacy policy URL, however, only changes with your next version**, according to App Store Connect Help. Update App Privacy when you add an SDK, when you pass the account ID to an existing tool, or when a feature sends a new type of data. A rejection that's only about these declarations can be fixed online, just like for [guideline 5.1.1](https://devoria.fr/en/blog/guideline-5-1-1-app-store-rejection). ## Check your submission before Apple does The [Review Kit](https://devoria.fr/en/kits/app-review) bundles my pre-submission checklist, my fixed rejections and two Claude Code skills that review your project and your product page, then draft your reply if Apple rejects you. Want to know what's still blocking you? The [free diagnostic](https://devoria.fr/en/diagnostic) sends you my Apple anti-rejection checklist. For the whole launch process, read [publishing an app on the App Store](https://devoria.fr/en/expertise/publish-an-app-on-the-app-store). ## Frequently asked questions ### What is App Privacy in App Store Connect? It's the questionnaire that generates the privacy labels on your App Store product page: data collected by your app and its SDKs, purposes, whether it's linked to the user, and tracking. It's required to submit an app and its updates. ### Do I need a new build to change App Privacy? No. Apple says you can change your answers at any time, without an app update: you edit, then click Publish. Only the privacy policy URL waits for the next version. ### What should I declare for RevenueCat in App Privacy? Purchase history, with the Analytics and App Functionality purposes, according to RevenueCat's documentation. Add User ID if you pass your own ID, and contact info if you send an email as an attribute. ### Do Sentry and PostHog track users by Apple's definition? No, not in their default configuration. Sentry says it doesn't use your data to track users, and PostHog's iOS manifest declares no tracking. Their data does become linked, though, as soon as you pass them the account ID. ### Why can't I add my version to the submission? Often because App Privacy isn't published. App Store Connect then shows "You must have published answers to your app's data usages." Publish your answers, then add the version. ## Your project [Review Kit](https://devoria.fr/en/kits/app-review): My App Store review checklist, the Apple rejections I fixed, a Google Play checklist and three Claude Code skills. $55. [iOS & Android Kit](https://devoria.fr/en/kits/ios): Build your iPhone and Android app with Claude Code: the starter code from my apps, the path all the way to the stores, and every kit. $109. [Diagnostic: what's between you and your iPhone app](https://devoria.fr/en/diagnostic): 7 questions, 60 seconds: find out what's really stopping you from publishing your iPhone app, get your 4-step path and the kit that fits you.