## TL;DR
Add a PrivacyInfo.xcprivacy manifest to the app, and to any third-party SDK that uses required-reason APIs, declaring the APIs and data types Apple requires, then re-upload. Apple validates manifests at upload and rejects with ITMS-91053 when the app or an embedded SDK touches required-reason APIs such as user defaults or file timestamps without declared reasons. Use the exact reason codes from Apples documentation that match your real usage.

```text
ITMS-91053 missing privacy manifest - iOS upload
```

## Use this when
- Upload validation fails or warns with ITMS-91053 naming your app or an SDK.
- You updated an SDK that uses required-reason APIs.
- The app itself reads user defaults, disk space or timestamps through those APIs.

## Not for this skill when
- The rejection is ITMS-91061 about missing manifest for data collection in a specific SDK version. Related but a different code; check which code you received.
- Your privacy nutrition labels on the store page are wrong. Labels and manifests are separate artefacts.

## Steps
1. Read the full validation message to list every bundle, yours and SDKs, named as missing a manifest. Verify: each named bundle is listed
2. For SDK bundles, upgrade to the first SDK version that ships its own manifest rather than writing one for them. Verify: the upgraded SDK versions and their included manifests are confirmed in the package contents
3. Create PrivacyInfo.xcprivacy for the app target declaring each required-reason API the app uses with its approved reason code. Verify: the manifest file is added to the target and appears in the project
4. Declare collected data types in the manifest only if your setup requires the tracking or data sections there, keeping them consistent with your store privacy labels. Verify: manifest data entries match the App Store privacy answers
5. Archive and inspect the built app bundle to confirm the manifest sits at the app root and inside any SDK bundles that need it. Verify: the files are present in the archive at the expected locations
6. Upload again and confirm no ITMS-91053 appears in validation or the follow-up email. Verify: the build processes without the manifest error
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

## Why it happens
Apple requires privacy manifests so required-reason APIs, which can be abused for fingerprinting, are declared with an approved justification. Validation walks every bundle in the upload, so one lagging SDK fails the whole submission. Because the check is at upload time, teams discover it at the worst moment: release day, with an SDK upgrade as the only fix for third-party bundles.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

## Variants and edge cases
### ITMS-91053 missing privacy manifest fix
Code phrasing; add manifests per named bundle. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.
### PrivacyInfo.xcprivacy required reason API upload rejected
Manifest phrasing; declare the exact APIs you use with approved reasons. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.
### Edge case: declaring APIs you do not use
Over-declaring invites review questions. Declare only APIs present in your binary and SDK set. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_elCfah0p2raJRiA1nBgeeA