Guideline 5.1.1 rejection: Data Collection and Storage
How the rejection usually reads: "Your app's Info.plist does not include a purpose string" / "the app is missing a privacy manifest" / "the app supports account creation but does not include an option to delete the account"
Why it happens
5.1.1 covers everything about what data the app touches and whether the user was told. In practice three sub-cases account for most rejections: a permission string that is missing, unclear, or declared for an API the app never calls; a missing PrivacyInfo.xcprivacy for the app or for an SDK on Apple's required list; and account creation without an in-app deletion path (5.1.1(v)). All three can be checked against the binary before submitting — the manifest is a file, the strings are keys, the APIs are symbols.
What can be checked before you submit
15 of RejectProof’s checks map to Guideline 5.1.1. Each one reads your .ipa — no upload — and reports the evidence with a fix.
- Camera used without a usage description
PB-01 · guideline 5.1.1 · likely rejection
Add a sentence to Info.plist explaining what the camera is used for. Expo: app.json → expo.ios.infoPlist.NSCameraUsageDescription. Swift: add the NSCameraUsageDescription key + description to Info.plist.
- Photo library used without a usage description
PB-02 · guideline 5.1.1 · likely rejection
Explain why you access photos. Expo: expo.ios.infoPlist.NSPhotoLibraryUsageDescription. Swift: add the Info.plist key.
- Location used without a usage description
PB-03 · guideline 5.1.1 · likely rejection
Say what location is used for (e.g. "to show the nearest store"). Expo: if you use expo-location, add the key in app.json. Swift: add it to Info.plist.
- Microphone used without a usage description
PB-04 · guideline 5.1.1 · likely rejection
Explain the microphone's purpose. Expo: expo.ios.infoPlist.NSMicrophoneUsageDescription.
- Contacts used without a usage description
PB-05 · guideline 5.1.1 · likely rejection
Explain why the app reads contacts (NSContactsUsageDescription).
- Calendar used without a usage description
PB-06 · guideline 5.1.1 · likely rejection
Explain why the app accesses the calendar (NSCalendarsUsageDescription / NSCalendarsFullAccessUsageDescription).
- Bluetooth used without a usage description
PB-07 · guideline 5.1.1 · likely rejection
Explain the Bluetooth purpose (NSBluetoothAlwaysUsageDescription).
- Face ID used without a usage description
PB-08 · guideline 5.1.1 · likely rejection
Explain the Face ID purpose (e.g. "to sign in to your account securely") in NSFaceIDUsageDescription.
- Privacy manifest (PrivacyInfo.xcprivacy) missing
PB-10 · guideline 5.1.1 · likely rejection
Add a Privacy Manifest (PrivacyInfo.xcprivacy) to your app target — Apple has required it for required-reason API usage since May 1, 2024. Expo: declare it in app.json under expo.ios.privacyManifests (NSPrivacyAccessedAPITypes with the reason codes your app needs); EAS injects the file at build time. Xcode: File → New → File → App Privacy, then fill in NSPrivacyAccessedAPITypes.
- Privacy manifest says tracking but lists no tracking domains
PB-11 · guideline 5.1.1 · probable
If you declare that you track, you must also list the domains you send data to (NSPrivacyTrackingDomains). Get the domain list from your SDK vendor's documentation.
- Required Reason API used but not declared in the privacy manifest
PB-12 · guideline 5.1.1 · probable
Every "sensitive" API you use needs a reason code in the privacy manifest (NSPrivacyAccessedAPITypes). Usually this comes from a third-party SDK's own manifest — update the SDK. For your own code, add the category with an approved reason code.
- ATT prompt text present but manifest says no tracking
PB-21 · guideline 5.1.1 / 5.1.2 · warning
Your two declarations contradict each other — decide which one is true and update the other. Reviewers notice this inconsistency and may ask follow-up questions.
- Known ad/analytics SDK without its own privacy manifest
PB-22 · guideline 5.1.1 (SDK manifest) · likely rejection
Update the ad/analytics SDK to its latest version — Apple rejects third-party SDKs without a signed privacy manifest since 2024. Check the SDK vendor's changelog for "privacy manifest" support.
- Permission declared in Info.plist but never used
PB-26 · guideline 5.1.1 · probable
Remove usage-description keys for permissions the app does not actually use, or the reviewer will ask why you request them. Expo: delete the key from expo.ios.infoPlist (many templates ship with camera/photo/location keys pre-filled). Swift: delete the key from Info.plist. Keep only what the app really calls.
- Account creation without an in-app account deletion path
PB-40 · guideline 5.1.1(v) · warning
Since June 2022 any app that lets users create an account must let them delete it from inside the app (not just a support email). Add a 'Delete account' action in settings that removes the account and its data, and make sure the label is visible — reviewers look for it. Expo/RN: put the string in your settings screen; Swift: a destructive button in the profile view.
What a scan cannot tell you
Static checks read the build; they do not run it. Whether a reviewer likes your design, agrees with your content, or considers the app “sufficiently different” is their call. Fix the mechanical layer first so the human review is about your product, not about a missing plist key.