Discuss how to secure user data, respect user data preferences, support iCloud Private Relay and Mail Privacy Protection, replace CAPTCHAs with Private Access Tokens, and more. Ask about Privacy nutrition labels, Privacy manifests, and more.

Posts under Privacy tag

150 Posts

Post

Replies

Boosts

Views

Activity

Seeking Guidance: How to Launch a Privacy-First Messaging App with Maximum Impact
Hi everyone, I’m building a messaging app because I’ve seen firsthand how much support and safety is overlooked for this generation online. My goal is to give teens a foundation of security, privacy, and mental health support, while still letting them connect freely. I want to leverage Apple’s platform to help this mission reach the right audience and have real impact. The app already includes: Community chat with message blurring for sensitive or harmful words. Anti-shoulder surfing tools to protect private conversations. Shake dashboard for quick access to emergency services. In-chat locks with ML detection for grooming patterns, offering resources while respecting privacy. Full user control: messages can be deleted anytime, blocking is permanent, and accounts can’t bypass restrictions on the same device. User consent-first design: every feature is opt-in and controlled by the user. At this point, I’m looking for guidance on how to position and prepare the app to reach Apple editorial or headline attention — what steps or best practices help mission-driven apps get noticed for features, WWDC spotlights, or App Store promotion? My focus isn’t just on improving the app, but on launch strategy and visibility in a way that amplifies the mission responsibly. If it’s helpful, I can share a TestFlight build or walkthrough to illustrate the app in action. Thank you for any insights or advice — I want to make sure this mission has the best chance to reach and support the generation it’s built for.
0
0
149
Feb ’26
Autogenerated UI Test Runner Blocked By Local Network Permission Prompt
I've recently updated one of our CI mac mini's to Sequoia in preparation for the transition to Tahoe later this year. Most things seemed to work just fine, however I see this dialog whenever the UI Tests try to run. This application BoostBrowerUITest-Runner is auto-generated by Xcode to launch your application and then run your UI Tests. We do not have any control over it, which is why this is most surprising. I've checked the codesigning identity with codesign -d -vvvv as well as looked at it's Info.plist and indeed the usage descriptions for everything are present (again, this is autogenerated, so I'm not surprised, but just wanted to confirm the string from the dialog was coming from this app) <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>BuildMachineOSBuild</key> <string>22A380021</string> <key>CFBundleAllowMixedLocalizations</key> <true/> <key>CFBundleDevelopmentRegion</key> <string>en</string> <key>CFBundleExecutable</key> <string>BoostBrowserUITests-Runner</string> <key>CFBundleIdentifier</key> <string>company.thebrowser.Browser2UITests.xctrunner</string> <key>CFBundleInfoDictionaryVersion</key> <string>6.0</string> <key>CFBundleName</key> <string>BoostBrowserUITests-Runner</string> <key>CFBundlePackageType</key> <string>APPL</string> <key>CFBundleShortVersionString</key> <string>1.0</string> <key>CFBundleSignature</key> <string>????</string> <key>CFBundleSupportedPlatforms</key> <array> <string>MacOSX</string> </array> <key>CFBundleVersion</key> <string>1</string> <key>DTCompiler</key> <string>com.apple.compilers.llvm.clang.1_0</string> <key>DTPlatformBuild</key> <string>24A324</string> <key>DTPlatformName</key> <string>macosx</string> <key>DTPlatformVersion</key> <string>15.0</string> <key>DTSDKBuild</key> <string>24A324</string> <key>DTSDKName</key> <string>macosx15.0.internal</string> <key>DTXcode</key> <string>1620</string> <key>DTXcodeBuild</key> <string>16C5031c</string> <key>LSBackgroundOnly</key> <true/> <key>LSMinimumSystemVersion</key> <string>13.0</string> <key>NSAppTransportSecurity</key> <dict> <key>NSAllowsArbitraryLoads</key> <true/> </dict> <key>NSAppleEventsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSBluetoothAlwaysUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSCalendarsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSCameraUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSContactsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDesktopFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDocumentsFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDownloadsFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSFileProviderDomainUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSFileProviderPresenceUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSLocalNetworkUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSLocationUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSMicrophoneUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSMotionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSNetworkVolumesUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSPhotoLibraryUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSRemindersUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSRemovableVolumesUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSpeechRecognitionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSystemAdministrationUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSystemExtensionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>OSBundleUsageDescription</key> <string>Access is necessary for automated testing.</string> </dict> </plist> Additionally, spctl --assess --type execute BoostBrowserUITests-Runner.app return an exit code of 0 so I assume that means it can launch just fine, and applications are allowed to be run from "anywhere" in System Settings. I've found the XCUIProtectedResource.localNetwork value, but it seems to only be accessible on iOS for some reason (FB17829325). I'm trying to figure out why this is happening on this machine so I can either fix our code or fix the machine. I have an Apple script that will allow it, but it's fiddly and I'd prefer to fix this the correct way either with the machine or with fixing our testing code.
10
1
726
Feb ’26
ASWebAuthenticationSessionWebBrowserSessionHandling begin callback not called for custom web handler app
I'm building a macOS app that registers itself for HTTP(S) url handling and would like it to participate in the ASWebAuthenticationSession fow. I did: update the plist to register as a handler for URL shemes (http, https, file) use NSWorkspace setDefaultApplication API to set this app as a default handler for urls in question wrote custom ASWebAuthenticationSessionWebBrowserSessionHandling implementation and set it as SessionManager's sessionHandler I launched this app from Xcode, then I triggered authentication flow from a third-party app. When the sign in flow is initiated, I can see that my app is activeated (willBecomeActive and didBecomeActive callbacks are both called), but there is no call for sessionHandler's begin() method. With some additional debugging I see that my app receives an apple event when the flow is started: {sfri,auth target=SafariLaunchAgent {qntp=90/$627......},aapd=TRUE If I switch system default browser back to Safari and then start the login flow, it correctly displays a sign in web page. What do I miss? PS. I'm on Tahoe 26.2
1
0
239
Feb ’26
Help! App Review Stuck in Guidelines 5.1.1(i) and 5.1.2(i) Loop
Hi, Our app (Tenkobo) received a rejection notice after review due to the fact that we use Gemini AI since 3 builds ago. Since then, we have been improving the disclosure of the data we collect, explicitly stating all the data, introducing a new feature that checks granular consent and syncs consent state for the user to the backend, and controls for whether to send to the Gemini API service for that feature depending on consent state for the user. Moreover, this feature is a premium add-on to a module that already does most things locally on the device and sends to our cloud infrastructure to allow storage and sync when users use multiple devices. It is a multi-platform app. However, despite every improvement, we keep getting the same Rejection reason that "The issues we identified still need your attention. I have asked for help or even that the rejection reason be more specific, but nothing. I have send pictures, and in this last rejection about 8 hours ago, I had to reply with a video showing that what they are asking for is already there. Why does the system work like this? It is frustrating, especially if a development team needs to be guessing how much is too much. We feel we are now close to removing the feature completely out of frustration, and it is very useful feature for our users based on the feedback we received from the android users (the android app has been live since about 6 weeks ago.) Please, what else can we do? We have requested a review meeting with App Review, the entire product plans are now on the verge of being irredeemably disrupted, and the company could go bankrupt just because our reviewer does not deem it fit to tell us exactly what they are expecting to see. Anyone with experience in this area should kindly provide some advise on what to do now. Thank you.
2
0
249
Feb ’26
Accept a Review Rejection Defeat or Play Along with Reviewer
I have a desktop application developed in SwiftUI that shows property locations on the map. That's NOT the main feature. IF you give the application permission to access your location, the blue dot will appear on the map. If you don't, the blue user dot won't appear. That's the only difference with location services. In other words, the application has no use of user's current position beyond showing it on the map. Since it's just the matter of showing or not showing the blue dot on the map, the application doesn't really need to use the location service. Anyway, the reviewer is talking about something else by rejecting the application in two aspects. Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage Guideline 5.1.5 - Legal - Privacy - Location Services As I said earlier, the application only wants to show the blue dot on the map so that you can see your property locations relative to your current location. In code, it's something like the following. Map(position: $propertyViewModel.mapPosition) { ForEach(propertyViewModel.properties) { property in Annotation("", coordinate: CLLocationCoordinate2D(latitude: property.lat, longitude: property.lon)) { ... } } UserAnnotation() } So I'm hit with two rejection reasons with this one line. UserAnnotation() And the reviewer is talking about something like the app is not functional when Location Services are disabled. To resolve this issue, please revise the app so that the app is fully functional without requiring the user to enable Location Services. Well, I can remove the UserAnnotation() line if I want to put this application through the review process. Nothing will become dysfunctional, though, if you decide to reject permission request. So would you remove it or would you play along with this reviewer if you were me? It's been three or four days since rejection. As you can imagine, the reviewer doesn't bother to answer as to What are the exact coordinates that the application has allegedly collected What won't work as a result of location permission request refusal. This isn't the first time I get my app rejected. I've probably had 150 to 200 of them rejected in the past 15 years. And just because a reviewer rejects your app for a bizarre reason, would you give in? Remove this feature and that feature because the reviewer is incompetent such that he or she makes his or her decision based on imagination? What do you think?
3
0
197
Feb ’26
iOS App Review: Guidelines 5.1.1(i) - Legal - Privacy - Data Collection and 5.1.2(i) - Legal - Privacy - Data Use
Our app (Tenkobo) received a rejection notice after review due to the fact that we use Gemini AI since 3 builds ago. Since then, we have been improving the disclosure of the data we collect, explicitly stating all the data, introducing a new feature that checks granular consent and syncs consent state for the user to the backend, and controls for whether to send to the Gemini API service for that feature depending on consent state for the user. Moreover, this feature is a premium add-on to a module that already does most things locally on the device and sends to our cloud infrastructure to allow storage and sync when users use multiple devices. It is a multi-platform app. However, despite every improvement, we keep getting the same Rejection reason that " ... Review Device: iPad Air 11-inch (M3) ... The issues we previously identified still need your attention. Guidelines 5.1.1(i) - Legal - Privacy - Data Collection and 5.1.2(i) - Legal - Privacy - Data Use The app appears to share the user’s personal data with a third-party AI service but the app does not clearly explain what data is sent, identify who the data is sent to, and ask the user’s permission before sharing the data. Apps may only use, transmit, or share personal data after they meet all of the following requirements: Disclose what data will be sent Specify who the data is sent to Obtain the user’s permission before sending data Identify in the privacy policy what data the app collects, how it collects that data, all uses of that data, and confirm any third party the app shares data with provides the same or equal protection Next Steps Revise the app to explain what data is sent, identify who the data is sent to, and ask the user’s permission before sharing personal data with a third-party AI service. If it does not already, the app’s privacy policy must also identify what data the app collects, how it collects that data, and all uses of that data, including if it is shared with a third-party AI service. " I have asked for help or even that the rejection reason be more specific, but nothing. I have send pictures, and in this last rejection about 8 hours ago, I had to reply with a video showing that what they are asking for is already there. Please, what else can we do? We have requested a review meeting with App Review, the entire product plans are now on the verge of being irredeemably disrupted, and the company could go bankrupt just because our reviewer does not deem it fit to tell us exactly what they are expecting to see. Anyone with experience in this area should kindly provide some advise on what to do now. Thank you.
1
0
248
Feb ’26
Does Showing User's Current Location on the Map Require 'NSLocationWhenInUseUsageDescription'?
I have a desktop application that shows some real estate properties chosen by the user. The application shows those GPP locations on the map. The SwiftUI code is something like the following. import SwiftUI import MapKit struct ContentView: View { var body: some View ZStack { mapView } } private var mapView: some View { Map(position: $propertyViewModel.mapPosition) { ForEach(propertyViewModel.properties) { property in Annotation("", coordinate: CLLocationCoordinate2D(latitude: property.lat, longitude: property.lon)) { Button { } label: { VStack { Image(systemName: "house.circle.fill") .resizable() .scaledToFit() .frame(width: 48) .foregroundStyle(colorScheme == .light ? .white : .black) ... } } .buttonStyle(.borderless) } } UserAnnotation() } .mapControls { MapUserLocationButton() } .mapControlVisibility(.visible) .onAppear { CLLocationManager().requestWhenInUseAuthorization() } } } The application only wants to use the CLLocationManager class so that it can show those locations on the map relative to your current GPS position. And I'm hit with two review rejections. Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage Issue Description One or more purpose strings in the app do not sufficiently explain the use of protected resources. Purpose strings must clearly and completely describe the app's use of data and, in most cases, provide an example of how the data will be used. Guideline 5.1.5 - Legal - Privacy - Location Services The app uses location data for features that are not relevant to a user's location. Specifically, the app is not functional when Location Services are disabled. So I wonder if the application is even required to have 'NSLocationWhenInUseUsageDescription' and/or 'NSLocationUsageDescription'? just in order to show user's current location so that they can see property locations relative to it? The exact location privacy statement is the following. The application needs your permission in accessing your current location so that it will appear on the map
1
0
191
Feb ’26
Apps do not trigger pop-up asking for permission to access local network on macOS Sequoia/Tahoe
We are having an issue with the Local Network permission pop-up not getting triggered for our apps that need to communicate with devices via local network interfaces/addresses. As we understand, apps using UDP should trigger this, causing macOS to prompt for access, or, if denied, fail to connect. However, we are facing issues with macOS not prompting this popup at all. Here are important and related points: Our application is packaged as a .app package and distributed independently (not on the App Store). The application controls hardware that we manufacture. In order to find the hardware on the network, we send a UDP broadcast with a message for our hardware on the local network, and the hardware responds with a message back. However, the popup (to ask for permission) never shows up. The application is not able to find the hardware device. It is interesting to note that data is still sent out to the network (without the popup) but we receive back the wrong data. The behaviour is consistent macOS Sequoia (and above) with both Apple And Intel silicon. Workarounds that have been tried: Manual Authorization: One solution suggested in various blogs was to go to "Settings → Privacy and Security-> Local network", find your application and grant access. However, the application never shows up in the list here. Firewall: No difference is seen in behaviour with firewall being ON OR OFF. Setting NSLocalNetworkUsageDescription: We have also tried setting the Info.plist adding the NSLocalNetworkUsageDescription with a meaningful string and updating the NSBonjourServices. Running Via terminal (WORKS): Running the application via terminal sees no issues. The application runs correctly and is able to send UDP and receive correct data (and find the devices on the network). But this is not an appropriate solution. How can we get this bug/issue fixed in macOS Sequoia (and above)? Are there any other solutions/workarounds that we can try on our end?
5
0
247
Feb ’26
Third-party Cookies in CORS Request
We're trying to implement Cross-domain session check for SSO by making CORS request. is Intelligent Tracking Prevention blocks all cookies in CORS requests? I saw all cookies are blocked in CORS requests. We are not able to check the auth session in source domain. Are there anyway to bypass this without user interaction? benefitier.com -> source.com
0
0
241
Feb ’26
LocationButton (SwiftUI) broken or changed in iOS 26?
I just spend the morning debugging LocationButton and the associated CLLocationManagerDelegate only to realise that it works perfectly in iOS 18.5 but no longer works for me in iOS 26.0, 26.2 or 26.2.1 (the latter on-device). It does work when I run my app on macOS 26.2 (Designed for iPad). Is there a change in behaviour or requirements on iOS I am missing? On iOS 18.5 I observe that the authorisation status changes from .notDetermined to .authorizedWhenInUse after the LocationButton has been tapped and my delegate is able to obtain the location through locationManager(_ , didUpdateLocations:). On iOS 26.x the authorisation status remains .notDetermined and my delegate receives locationManager(_:didFailWithError:) with error code .denied. Setting NSLocationWhenInUseUsageDescription in my Info.plistdid not help. Just in case ;) FB21798098 (SwiftUI LocationButton fails to acquire authorization on iOS 26)
1
0
189
Jan ’26
Request for Clarification on Repeated App Review Rejections – Kids Category
Hello App Review Team, I am writing to seek clarification regarding repeated review feedback received via App Store Connect (Resolution Center) for my app: App Name: Animal Sounds & Insects 90+ App ID: 6741077718 Team ID: 24MTF8NJ6Q Over the past two weeks, this app update has remained in review with multiple rejections referencing similar concerns, despite detailed responses and clarifications already provided in the Resolution Center. Unfortunately, I have not received follow-up responses or specific guidance there, which has prevented me from releasing even a minor update. To ensure clarity and avoid further delays, I am summarizing the key points below. Parental Gate (Guideline 1.3 – Kids Category) The review feedback indicates that the app may include links, commerce, or ad interactions without parental permission. I would like to clarify that the app implements a mandatory, non-dismissible parental gate, which is required before: Opening any external links Engaging in any form of commerce, including in-app purchases Interacting with any advertisements This parental gate cannot be bypassed or disabled and is triggered consistently across all applicable user flows. No child user can access links, purchases, or ad interactions without successfully completing the parental gate. If there is a specific screen, flow, or scenario where this behavior was interpreted differently during review, I would greatly appreciate precise details so I can verify and address it immediately. Advertising Experience (Guideline 4.0 – Design) The review also notes that users are required to view advertisements prior to using the app. I would like to clarify that the app does not require users to view advertisements before accessing its core functionality. Specifically: There are no forced ads No launch or entry interstitials No ads that block or gate access to the app’s main features Advertising within the app is passive and non-intrusive. This setup has been live for over one year, and no recent changes were introduced that would alter this behavior. Request for Guidance I fully respect and support the App Review Guidelines and am committed to complying with them. Given the repeated rejections and lack of actionable feedback so far, I kindly request: Clear and specific guidance on the exact screen, flow, or behavior being flagged Confirmation on whether the current parental gate implementation is being detected correctly during review My goal is to resolve any remaining concerns as quickly and accurately as possible so the review process can move forward. Thank you very much for your time and support. I appreciate the work of the App Review team and look forward to your guidance. Kind regards, Jiyan Aslan Developer, Animal Sounds & Insects 90+
1
0
182
Jan ’26
Local network access disabled after macOS restart
My application needs local network access. When it is started for the first time, the user gets a prompt to enable local network access (as expected). The application is then shown as enabled in Privacy & Security / Local Network and local network access is working. If macOS is then shutdown and restarted, local network access is blocked for the application even though it is still shown as enabled in Privacy & Security / Local Network. Local network access can be restored either by toggling permission off and on in Privacy & Security / Local Network or by disabling and enabling Wi-Fi. This behaviour is consistent on Sequoia 15.1. It happens sometimes on 15.0 and 15.0.1 but not every time. Is my application doing something wrong or is this a Sequoia issue? If it is a Sequoia issue, is there some change I can make to my application to work around it?
27
2
3.6k
Jan ’26
Camera Permissions Popup
We have a very strange issue that I am trying to solve or find the best practice for. We have a SwiftUI View that uses the Camera to preview. So as suggested in Apples Docs we check authorisation status and then if it's not determined we request authorisation. We also have the privacy entry in the info.plist case .notDetermined: AVCaptureDevice.requestAccess(for: .video) { accessStatusAuthorised in if !accessStatusAuthorised { self.cameraStatus = .notAuthorised } else { self.isAuthorized = true self.cameraStatus = .authorised self.startCameraSession(cameraPosition: cameraPosition) } } case .restricted: cameraStatus = .notAuthorised isAuthorized = false case .denied: cameraStatus = .notAuthorised isAuthorized = false case .authorized: cameraStatus = .authorised isAuthorized = true startCameraSession(cameraPosition: cameraPosition) break @unknown default: isAuthorized = true cameraStatus = .notAuthorised } However when we call this code it freezes the Camera feed, even when allow has been tapped. However and this is the confusing part. If we do not call the code above, we still get the permission for camera access pop up and the camera works fine after allowing. What im concerned about is changing the code to do this and its a possible apple bug that gets fixed and hey then none of the Apps allow the camera function. I cannot see any where that the process has changed for iOS 26 / Xcode 26. Can anyone shed any light on this or had similar experience ?
1
0
202
Jan ’26
Why does NSEvent.addGlobalMonitorForEvents still work in a Sandboxed macOS app
I am building a macOS utility using SwiftUI and Swift that records and displays keyboard shortcuts (like Cmd+C, Cmd+V) in the UI. To achieve this, I am using NSEvent.addGlobalMonitorForEvents(matching: [.keyDown]). I am aware that global monitoring usually requires the app to be non-sandboxed. However, I am seeing some behavior I don't quite understand during development: I started with a fresh SwiftUI project and disabled the App Sandbox. I requested Accessibility permissions using AXIsProcessTrustedWithOptions, manually enabled it in System Settings, and the global monitor worked perfectly. I then re-enabled the App Sandbox in "Signing & Capabilities." To my surprise, the app still records global events from other applications, even though the Sandbox is now active. Is this expected behavior? Does macOS "remember" the trust because the Bundle ID was previously authorized while non-sandboxed, or is there a specific reason a Sandboxed app can still use addGlobalMonitor if the user has manually granted Accessibility access? My app's core feature is displaying these shortcuts for the user's own reference (productivity tracking). If the user is the one explicitly granting permission via the Accessibility privacy pane, will Apple still reject the app for using global event monitors within a Sandboxed environment? Code snippet of my monitor: // This is still firing even after re-enabling Sandbox eventMonitor = NSEvent.addGlobalMonitorForEvents(matching: [.keyDown]) { event in print("Captured: \(event.charactersIgnoringModifiers ?? "")") } I've tried cleaning the build folder and restarting the app, removing the app from accessibility permission, but the events keep coming through. I want to make sure I'm not relying on a "development glitch" before I commit to the App Store path. Here is the full code anyone can use to try this :- import SwiftUI import Cocoa import Combine struct ShortcutEvent: Identifiable { let id = UUID() let displayString: String let timestamp: Date } class KeyboardManager: ObservableObject { @Published var isCapturing = false @Published var capturedShortcuts: [ShortcutEvent] = [] private var eventMonitor: Any? // 1. Check & Request Permissions func checkAccessibilityPermissions() -> Bool { let options: NSDictionary = [kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String: true] let accessEnabled = AXIsProcessTrustedWithOptions(options) return accessEnabled } // 2. Start Capture func startCapture() { guard checkAccessibilityPermissions() else { print("Permission denied") return } isCapturing = true let mask: NSEvent.EventTypeMask = [.keyDown, .keyUp] eventMonitor = NSEvent.addGlobalMonitorForEvents(matching: mask) { [weak self] event in self?.processEvent(event) } } // 3. Stop Capture func stopCapture() { if let monitor = eventMonitor { NSEvent.removeMonitor(monitor) eventMonitor = nil } isCapturing = false } private func processEvent(_ event: NSEvent) { // Only log keyDown to avoid double-counting the UI display guard event.type == .keyDown else { return } var modifiers: [String] = [] var symbols: [String] = [] // Map symbols for the UI if event.modifierFlags.contains(.command) { modifiers.append("command") symbols.append("⌘") } if event.modifierFlags.contains(.shift) { modifiers.append("shift") symbols.append("⇧") } if event.modifierFlags.contains(.option) { modifiers.append("option") symbols.append("⌥") } if event.modifierFlags.contains(.control) { modifiers.append("control") symbols.append("⌃") } let key = event.charactersIgnoringModifiers?.uppercased() ?? "" // Only display if a modifier is active (to capture "shortcuts" vs regular typing) if !symbols.isEmpty && !key.isEmpty { let shortcutString = "\(symbols.joined(separator: " ")) + \(key)" DispatchQueue.main.async { // Insert at the top so the newest shortcut is visible self.capturedShortcuts.insert(ShortcutEvent(displayString: shortcutString, timestamp: Date()), at: 0) } } } } PS :- I just did another test by creating a fresh new project with the default App Sandbox enabled, and tried and there also it worked!! Can I consider this a go to for MacOs app store than?
1
0
688
Jan ’26
Submission Rejected: Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage
Hi, I am in need of your help with publishing my game. I got the following explanation for the negative review of my app/game. Issue Description One or more purpose strings in the app do not sufficiently explain the use of protected resources. Purpose strings must clearly and completely describe the app's use of data and, in most cases, provide an example of how the data will be used. Next Steps Update the local network information purpose string to explain how the app will use the requested information and provide a specific example of how the data will be used. See the attached screenshot. Resources Purpose strings must clearly describe how an app uses the ability, data, or resource. The following are hypothetical examples of unclear purpose strings that would not pass review: "App would like to access your Contacts" "App needs microphone access" See examples of helpful, informative purpose strings. The problem is that they say my app asks to allow my app to find devices on local networks. And that this needs more explanation in the purpose strings. Totally valid to ask, but the problem is my app doesn't need local access to devices, and there shouldn't be code that asks this?? FYI the game is build with Unity. Would love some help on how to turn this off so that my app can get published.
1
0
363
Jan ’26
Local network request blocked in Safari but working in Chrome
For Local network access, Chrome prompts the user to allow access and adds it to Settings --> Privacy & Security --> Local Network. However, for Safari, no prompt appears. How do I force Safari to authorise these local network access requests if it won't trigger the permission dialogue? Is there a specific WKWebView configuration or Safari-specific header required to satisfy this security check?
1
0
503
Jan ’26
sshd-keygen-wrapper permissions problem
On macOS 26.1 (25B78) I can't give Full Disk Access to sshd-keygen-wrapper. Now my Jenkins jobs do not work because they do not have the permission to execute the necessary scripts. Until macOS 26.1 everything worked fine. I restarted the machine several times and tried to give access from Settings -> Privacy & Security -> Full Disk Access but it just does not work. I tried logging with ssh on the machine and executing a script but again nothing happened.
20
3
6.6k
Jan ’26
Can't remove "tracking" in my app privacy policy
I was planning to add the Facebook SDK in one of the releases, and I had everything prepared (including changing the privacy policy to state that my app tracks users for advertising). I changed the privacy policy in the App Store connect, thinking that this wouldn't take effect until I sent the app to review. However, after careful consideration, I decided not to move on with the Facebook SDK. My app does not currently track users for advertising. Even though I sent a new release (UI improvements only), I still can't change the privacy policy to remove that my app "tracks" the user. I read multiple posts with people facing similar issues. For my binary, I have: No PrivacyInfo.xcprivacy file NSUserTrackingUsageDescription in Info.plist No tracking declarations in my app configuration I contacted support, and I was redirected here. My case number is 102778907920
0
1
242
Dec ’25
Seeking Guidance: How to Launch a Privacy-First Messaging App with Maximum Impact
Hi everyone, I’m building a messaging app because I’ve seen firsthand how much support and safety is overlooked for this generation online. My goal is to give teens a foundation of security, privacy, and mental health support, while still letting them connect freely. I want to leverage Apple’s platform to help this mission reach the right audience and have real impact. The app already includes: Community chat with message blurring for sensitive or harmful words. Anti-shoulder surfing tools to protect private conversations. Shake dashboard for quick access to emergency services. In-chat locks with ML detection for grooming patterns, offering resources while respecting privacy. Full user control: messages can be deleted anytime, blocking is permanent, and accounts can’t bypass restrictions on the same device. User consent-first design: every feature is opt-in and controlled by the user. At this point, I’m looking for guidance on how to position and prepare the app to reach Apple editorial or headline attention — what steps or best practices help mission-driven apps get noticed for features, WWDC spotlights, or App Store promotion? My focus isn’t just on improving the app, but on launch strategy and visibility in a way that amplifies the mission responsibly. If it’s helpful, I can share a TestFlight build or walkthrough to illustrate the app in action. Thank you for any insights or advice — I want to make sure this mission has the best chance to reach and support the generation it’s built for.
Replies
0
Boosts
0
Views
149
Activity
Feb ’26
Autogenerated UI Test Runner Blocked By Local Network Permission Prompt
I've recently updated one of our CI mac mini's to Sequoia in preparation for the transition to Tahoe later this year. Most things seemed to work just fine, however I see this dialog whenever the UI Tests try to run. This application BoostBrowerUITest-Runner is auto-generated by Xcode to launch your application and then run your UI Tests. We do not have any control over it, which is why this is most surprising. I've checked the codesigning identity with codesign -d -vvvv as well as looked at it's Info.plist and indeed the usage descriptions for everything are present (again, this is autogenerated, so I'm not surprised, but just wanted to confirm the string from the dialog was coming from this app) <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>BuildMachineOSBuild</key> <string>22A380021</string> <key>CFBundleAllowMixedLocalizations</key> <true/> <key>CFBundleDevelopmentRegion</key> <string>en</string> <key>CFBundleExecutable</key> <string>BoostBrowserUITests-Runner</string> <key>CFBundleIdentifier</key> <string>company.thebrowser.Browser2UITests.xctrunner</string> <key>CFBundleInfoDictionaryVersion</key> <string>6.0</string> <key>CFBundleName</key> <string>BoostBrowserUITests-Runner</string> <key>CFBundlePackageType</key> <string>APPL</string> <key>CFBundleShortVersionString</key> <string>1.0</string> <key>CFBundleSignature</key> <string>????</string> <key>CFBundleSupportedPlatforms</key> <array> <string>MacOSX</string> </array> <key>CFBundleVersion</key> <string>1</string> <key>DTCompiler</key> <string>com.apple.compilers.llvm.clang.1_0</string> <key>DTPlatformBuild</key> <string>24A324</string> <key>DTPlatformName</key> <string>macosx</string> <key>DTPlatformVersion</key> <string>15.0</string> <key>DTSDKBuild</key> <string>24A324</string> <key>DTSDKName</key> <string>macosx15.0.internal</string> <key>DTXcode</key> <string>1620</string> <key>DTXcodeBuild</key> <string>16C5031c</string> <key>LSBackgroundOnly</key> <true/> <key>LSMinimumSystemVersion</key> <string>13.0</string> <key>NSAppTransportSecurity</key> <dict> <key>NSAllowsArbitraryLoads</key> <true/> </dict> <key>NSAppleEventsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSBluetoothAlwaysUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSCalendarsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSCameraUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSContactsUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDesktopFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDocumentsFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSDownloadsFolderUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSFileProviderDomainUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSFileProviderPresenceUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSLocalNetworkUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSLocationUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSMicrophoneUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSMotionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSNetworkVolumesUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSPhotoLibraryUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSRemindersUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSRemovableVolumesUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSpeechRecognitionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSystemAdministrationUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>NSSystemExtensionUsageDescription</key> <string>Access is necessary for automated testing.</string> <key>OSBundleUsageDescription</key> <string>Access is necessary for automated testing.</string> </dict> </plist> Additionally, spctl --assess --type execute BoostBrowserUITests-Runner.app return an exit code of 0 so I assume that means it can launch just fine, and applications are allowed to be run from "anywhere" in System Settings. I've found the XCUIProtectedResource.localNetwork value, but it seems to only be accessible on iOS for some reason (FB17829325). I'm trying to figure out why this is happening on this machine so I can either fix our code or fix the machine. I have an Apple script that will allow it, but it's fiddly and I'd prefer to fix this the correct way either with the machine or with fixing our testing code.
Replies
10
Boosts
1
Views
726
Activity
Feb ’26
ASWebAuthenticationSessionWebBrowserSessionHandling begin callback not called for custom web handler app
I'm building a macOS app that registers itself for HTTP(S) url handling and would like it to participate in the ASWebAuthenticationSession fow. I did: update the plist to register as a handler for URL shemes (http, https, file) use NSWorkspace setDefaultApplication API to set this app as a default handler for urls in question wrote custom ASWebAuthenticationSessionWebBrowserSessionHandling implementation and set it as SessionManager's sessionHandler I launched this app from Xcode, then I triggered authentication flow from a third-party app. When the sign in flow is initiated, I can see that my app is activeated (willBecomeActive and didBecomeActive callbacks are both called), but there is no call for sessionHandler's begin() method. With some additional debugging I see that my app receives an apple event when the flow is started: {sfri,auth target=SafariLaunchAgent {qntp=90/$627......},aapd=TRUE If I switch system default browser back to Safari and then start the login flow, it correctly displays a sign in web page. What do I miss? PS. I'm on Tahoe 26.2
Replies
1
Boosts
0
Views
239
Activity
Feb ’26
Privacy issues related to uploading user health data to servers
How to legally and compliantly upload users' fitness and health data to our own server—while adhering to Apple's strict privacy policies—for analysis by our AI large model to provide personalized feedback and recommendations to users.
Replies
1
Boosts
0
Views
210
Activity
Feb ’26
Help! App Review Stuck in Guidelines 5.1.1(i) and 5.1.2(i) Loop
Hi, Our app (Tenkobo) received a rejection notice after review due to the fact that we use Gemini AI since 3 builds ago. Since then, we have been improving the disclosure of the data we collect, explicitly stating all the data, introducing a new feature that checks granular consent and syncs consent state for the user to the backend, and controls for whether to send to the Gemini API service for that feature depending on consent state for the user. Moreover, this feature is a premium add-on to a module that already does most things locally on the device and sends to our cloud infrastructure to allow storage and sync when users use multiple devices. It is a multi-platform app. However, despite every improvement, we keep getting the same Rejection reason that "The issues we identified still need your attention. I have asked for help or even that the rejection reason be more specific, but nothing. I have send pictures, and in this last rejection about 8 hours ago, I had to reply with a video showing that what they are asking for is already there. Why does the system work like this? It is frustrating, especially if a development team needs to be guessing how much is too much. We feel we are now close to removing the feature completely out of frustration, and it is very useful feature for our users based on the feedback we received from the android users (the android app has been live since about 6 weeks ago.) Please, what else can we do? We have requested a review meeting with App Review, the entire product plans are now on the verge of being irredeemably disrupted, and the company could go bankrupt just because our reviewer does not deem it fit to tell us exactly what they are expecting to see. Anyone with experience in this area should kindly provide some advise on what to do now. Thank you.
Replies
2
Boosts
0
Views
249
Activity
Feb ’26
Accept a Review Rejection Defeat or Play Along with Reviewer
I have a desktop application developed in SwiftUI that shows property locations on the map. That's NOT the main feature. IF you give the application permission to access your location, the blue dot will appear on the map. If you don't, the blue user dot won't appear. That's the only difference with location services. In other words, the application has no use of user's current position beyond showing it on the map. Since it's just the matter of showing or not showing the blue dot on the map, the application doesn't really need to use the location service. Anyway, the reviewer is talking about something else by rejecting the application in two aspects. Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage Guideline 5.1.5 - Legal - Privacy - Location Services As I said earlier, the application only wants to show the blue dot on the map so that you can see your property locations relative to your current location. In code, it's something like the following. Map(position: $propertyViewModel.mapPosition) { ForEach(propertyViewModel.properties) { property in Annotation("", coordinate: CLLocationCoordinate2D(latitude: property.lat, longitude: property.lon)) { ... } } UserAnnotation() } So I'm hit with two rejection reasons with this one line. UserAnnotation() And the reviewer is talking about something like the app is not functional when Location Services are disabled. To resolve this issue, please revise the app so that the app is fully functional without requiring the user to enable Location Services. Well, I can remove the UserAnnotation() line if I want to put this application through the review process. Nothing will become dysfunctional, though, if you decide to reject permission request. So would you remove it or would you play along with this reviewer if you were me? It's been three or four days since rejection. As you can imagine, the reviewer doesn't bother to answer as to What are the exact coordinates that the application has allegedly collected What won't work as a result of location permission request refusal. This isn't the first time I get my app rejected. I've probably had 150 to 200 of them rejected in the past 15 years. And just because a reviewer rejects your app for a bizarre reason, would you give in? Remove this feature and that feature because the reviewer is incompetent such that he or she makes his or her decision based on imagination? What do you think?
Replies
3
Boosts
0
Views
197
Activity
Feb ’26
iOS App Review: Guidelines 5.1.1(i) - Legal - Privacy - Data Collection and 5.1.2(i) - Legal - Privacy - Data Use
Our app (Tenkobo) received a rejection notice after review due to the fact that we use Gemini AI since 3 builds ago. Since then, we have been improving the disclosure of the data we collect, explicitly stating all the data, introducing a new feature that checks granular consent and syncs consent state for the user to the backend, and controls for whether to send to the Gemini API service for that feature depending on consent state for the user. Moreover, this feature is a premium add-on to a module that already does most things locally on the device and sends to our cloud infrastructure to allow storage and sync when users use multiple devices. It is a multi-platform app. However, despite every improvement, we keep getting the same Rejection reason that " ... Review Device: iPad Air 11-inch (M3) ... The issues we previously identified still need your attention. Guidelines 5.1.1(i) - Legal - Privacy - Data Collection and 5.1.2(i) - Legal - Privacy - Data Use The app appears to share the user’s personal data with a third-party AI service but the app does not clearly explain what data is sent, identify who the data is sent to, and ask the user’s permission before sharing the data. Apps may only use, transmit, or share personal data after they meet all of the following requirements: Disclose what data will be sent Specify who the data is sent to Obtain the user’s permission before sending data Identify in the privacy policy what data the app collects, how it collects that data, all uses of that data, and confirm any third party the app shares data with provides the same or equal protection Next Steps Revise the app to explain what data is sent, identify who the data is sent to, and ask the user’s permission before sharing personal data with a third-party AI service. If it does not already, the app’s privacy policy must also identify what data the app collects, how it collects that data, and all uses of that data, including if it is shared with a third-party AI service. " I have asked for help or even that the rejection reason be more specific, but nothing. I have send pictures, and in this last rejection about 8 hours ago, I had to reply with a video showing that what they are asking for is already there. Please, what else can we do? We have requested a review meeting with App Review, the entire product plans are now on the verge of being irredeemably disrupted, and the company could go bankrupt just because our reviewer does not deem it fit to tell us exactly what they are expecting to see. Anyone with experience in this area should kindly provide some advise on what to do now. Thank you.
Replies
1
Boosts
0
Views
248
Activity
Feb ’26
Does Showing User's Current Location on the Map Require 'NSLocationWhenInUseUsageDescription'?
I have a desktop application that shows some real estate properties chosen by the user. The application shows those GPP locations on the map. The SwiftUI code is something like the following. import SwiftUI import MapKit struct ContentView: View { var body: some View ZStack { mapView } } private var mapView: some View { Map(position: $propertyViewModel.mapPosition) { ForEach(propertyViewModel.properties) { property in Annotation("", coordinate: CLLocationCoordinate2D(latitude: property.lat, longitude: property.lon)) { Button { } label: { VStack { Image(systemName: "house.circle.fill") .resizable() .scaledToFit() .frame(width: 48) .foregroundStyle(colorScheme == .light ? .white : .black) ... } } .buttonStyle(.borderless) } } UserAnnotation() } .mapControls { MapUserLocationButton() } .mapControlVisibility(.visible) .onAppear { CLLocationManager().requestWhenInUseAuthorization() } } } The application only wants to use the CLLocationManager class so that it can show those locations on the map relative to your current GPS position. And I'm hit with two review rejections. Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage Issue Description One or more purpose strings in the app do not sufficiently explain the use of protected resources. Purpose strings must clearly and completely describe the app's use of data and, in most cases, provide an example of how the data will be used. Guideline 5.1.5 - Legal - Privacy - Location Services The app uses location data for features that are not relevant to a user's location. Specifically, the app is not functional when Location Services are disabled. So I wonder if the application is even required to have 'NSLocationWhenInUseUsageDescription' and/or 'NSLocationUsageDescription'? just in order to show user's current location so that they can see property locations relative to it? The exact location privacy statement is the following. The application needs your permission in accessing your current location so that it will appear on the map
Replies
1
Boosts
0
Views
191
Activity
Feb ’26
Apps do not trigger pop-up asking for permission to access local network on macOS Sequoia/Tahoe
We are having an issue with the Local Network permission pop-up not getting triggered for our apps that need to communicate with devices via local network interfaces/addresses. As we understand, apps using UDP should trigger this, causing macOS to prompt for access, or, if denied, fail to connect. However, we are facing issues with macOS not prompting this popup at all. Here are important and related points: Our application is packaged as a .app package and distributed independently (not on the App Store). The application controls hardware that we manufacture. In order to find the hardware on the network, we send a UDP broadcast with a message for our hardware on the local network, and the hardware responds with a message back. However, the popup (to ask for permission) never shows up. The application is not able to find the hardware device. It is interesting to note that data is still sent out to the network (without the popup) but we receive back the wrong data. The behaviour is consistent macOS Sequoia (and above) with both Apple And Intel silicon. Workarounds that have been tried: Manual Authorization: One solution suggested in various blogs was to go to "Settings → Privacy and Security-> Local network", find your application and grant access. However, the application never shows up in the list here. Firewall: No difference is seen in behaviour with firewall being ON OR OFF. Setting NSLocalNetworkUsageDescription: We have also tried setting the Info.plist adding the NSLocalNetworkUsageDescription with a meaningful string and updating the NSBonjourServices. Running Via terminal (WORKS): Running the application via terminal sees no issues. The application runs correctly and is able to send UDP and receive correct data (and find the devices on the network). But this is not an appropriate solution. How can we get this bug/issue fixed in macOS Sequoia (and above)? Are there any other solutions/workarounds that we can try on our end?
Replies
5
Boosts
0
Views
247
Activity
Feb ’26
Third-party Cookies in CORS Request
We're trying to implement Cross-domain session check for SSO by making CORS request. is Intelligent Tracking Prevention blocks all cookies in CORS requests? I saw all cookies are blocked in CORS requests. We are not able to check the auth session in source domain. Are there anyway to bypass this without user interaction? benefitier.com -> source.com
Replies
0
Boosts
0
Views
241
Activity
Feb ’26
LocationButton (SwiftUI) broken or changed in iOS 26?
I just spend the morning debugging LocationButton and the associated CLLocationManagerDelegate only to realise that it works perfectly in iOS 18.5 but no longer works for me in iOS 26.0, 26.2 or 26.2.1 (the latter on-device). It does work when I run my app on macOS 26.2 (Designed for iPad). Is there a change in behaviour or requirements on iOS I am missing? On iOS 18.5 I observe that the authorisation status changes from .notDetermined to .authorizedWhenInUse after the LocationButton has been tapped and my delegate is able to obtain the location through locationManager(_ , didUpdateLocations:). On iOS 26.x the authorisation status remains .notDetermined and my delegate receives locationManager(_:didFailWithError:) with error code .denied. Setting NSLocationWhenInUseUsageDescription in my Info.plistdid not help. Just in case ;) FB21798098 (SwiftUI LocationButton fails to acquire authorization on iOS 26)
Replies
1
Boosts
0
Views
189
Activity
Jan ’26
Request for Clarification on Repeated App Review Rejections – Kids Category
Hello App Review Team, I am writing to seek clarification regarding repeated review feedback received via App Store Connect (Resolution Center) for my app: App Name: Animal Sounds & Insects 90+ App ID: 6741077718 Team ID: 24MTF8NJ6Q Over the past two weeks, this app update has remained in review with multiple rejections referencing similar concerns, despite detailed responses and clarifications already provided in the Resolution Center. Unfortunately, I have not received follow-up responses or specific guidance there, which has prevented me from releasing even a minor update. To ensure clarity and avoid further delays, I am summarizing the key points below. Parental Gate (Guideline 1.3 – Kids Category) The review feedback indicates that the app may include links, commerce, or ad interactions without parental permission. I would like to clarify that the app implements a mandatory, non-dismissible parental gate, which is required before: Opening any external links Engaging in any form of commerce, including in-app purchases Interacting with any advertisements This parental gate cannot be bypassed or disabled and is triggered consistently across all applicable user flows. No child user can access links, purchases, or ad interactions without successfully completing the parental gate. If there is a specific screen, flow, or scenario where this behavior was interpreted differently during review, I would greatly appreciate precise details so I can verify and address it immediately. Advertising Experience (Guideline 4.0 – Design) The review also notes that users are required to view advertisements prior to using the app. I would like to clarify that the app does not require users to view advertisements before accessing its core functionality. Specifically: There are no forced ads No launch or entry interstitials No ads that block or gate access to the app’s main features Advertising within the app is passive and non-intrusive. This setup has been live for over one year, and no recent changes were introduced that would alter this behavior. Request for Guidance I fully respect and support the App Review Guidelines and am committed to complying with them. Given the repeated rejections and lack of actionable feedback so far, I kindly request: Clear and specific guidance on the exact screen, flow, or behavior being flagged Confirmation on whether the current parental gate implementation is being detected correctly during review My goal is to resolve any remaining concerns as quickly and accurately as possible so the review process can move forward. Thank you very much for your time and support. I appreciate the work of the App Review team and look forward to your guidance. Kind regards, Jiyan Aslan Developer, Animal Sounds & Insects 90+
Replies
1
Boosts
0
Views
182
Activity
Jan ’26
Local network access disabled after macOS restart
My application needs local network access. When it is started for the first time, the user gets a prompt to enable local network access (as expected). The application is then shown as enabled in Privacy & Security / Local Network and local network access is working. If macOS is then shutdown and restarted, local network access is blocked for the application even though it is still shown as enabled in Privacy & Security / Local Network. Local network access can be restored either by toggling permission off and on in Privacy & Security / Local Network or by disabling and enabling Wi-Fi. This behaviour is consistent on Sequoia 15.1. It happens sometimes on 15.0 and 15.0.1 but not every time. Is my application doing something wrong or is this a Sequoia issue? If it is a Sequoia issue, is there some change I can make to my application to work around it?
Replies
27
Boosts
2
Views
3.6k
Activity
Jan ’26
New South Korea Account Notification Requirement
https://developer.apple.com/news/?id=j9zukcr6 starting from Jan 2026 there is change in requirements for account notifications for Sign in with Apple. Does this apply only to developers based in South Korea or all apps which are avai via the korean App Store?
Replies
1
Boosts
0
Views
646
Activity
Jan ’26
Camera Permissions Popup
We have a very strange issue that I am trying to solve or find the best practice for. We have a SwiftUI View that uses the Camera to preview. So as suggested in Apples Docs we check authorisation status and then if it's not determined we request authorisation. We also have the privacy entry in the info.plist case .notDetermined: AVCaptureDevice.requestAccess(for: .video) { accessStatusAuthorised in if !accessStatusAuthorised { self.cameraStatus = .notAuthorised } else { self.isAuthorized = true self.cameraStatus = .authorised self.startCameraSession(cameraPosition: cameraPosition) } } case .restricted: cameraStatus = .notAuthorised isAuthorized = false case .denied: cameraStatus = .notAuthorised isAuthorized = false case .authorized: cameraStatus = .authorised isAuthorized = true startCameraSession(cameraPosition: cameraPosition) break @unknown default: isAuthorized = true cameraStatus = .notAuthorised } However when we call this code it freezes the Camera feed, even when allow has been tapped. However and this is the confusing part. If we do not call the code above, we still get the permission for camera access pop up and the camera works fine after allowing. What im concerned about is changing the code to do this and its a possible apple bug that gets fixed and hey then none of the Apps allow the camera function. I cannot see any where that the process has changed for iOS 26 / Xcode 26. Can anyone shed any light on this or had similar experience ?
Replies
1
Boosts
0
Views
202
Activity
Jan ’26
Why does NSEvent.addGlobalMonitorForEvents still work in a Sandboxed macOS app
I am building a macOS utility using SwiftUI and Swift that records and displays keyboard shortcuts (like Cmd+C, Cmd+V) in the UI. To achieve this, I am using NSEvent.addGlobalMonitorForEvents(matching: [.keyDown]). I am aware that global monitoring usually requires the app to be non-sandboxed. However, I am seeing some behavior I don't quite understand during development: I started with a fresh SwiftUI project and disabled the App Sandbox. I requested Accessibility permissions using AXIsProcessTrustedWithOptions, manually enabled it in System Settings, and the global monitor worked perfectly. I then re-enabled the App Sandbox in "Signing & Capabilities." To my surprise, the app still records global events from other applications, even though the Sandbox is now active. Is this expected behavior? Does macOS "remember" the trust because the Bundle ID was previously authorized while non-sandboxed, or is there a specific reason a Sandboxed app can still use addGlobalMonitor if the user has manually granted Accessibility access? My app's core feature is displaying these shortcuts for the user's own reference (productivity tracking). If the user is the one explicitly granting permission via the Accessibility privacy pane, will Apple still reject the app for using global event monitors within a Sandboxed environment? Code snippet of my monitor: // This is still firing even after re-enabling Sandbox eventMonitor = NSEvent.addGlobalMonitorForEvents(matching: [.keyDown]) { event in print("Captured: \(event.charactersIgnoringModifiers ?? "")") } I've tried cleaning the build folder and restarting the app, removing the app from accessibility permission, but the events keep coming through. I want to make sure I'm not relying on a "development glitch" before I commit to the App Store path. Here is the full code anyone can use to try this :- import SwiftUI import Cocoa import Combine struct ShortcutEvent: Identifiable { let id = UUID() let displayString: String let timestamp: Date } class KeyboardManager: ObservableObject { @Published var isCapturing = false @Published var capturedShortcuts: [ShortcutEvent] = [] private var eventMonitor: Any? // 1. Check & Request Permissions func checkAccessibilityPermissions() -> Bool { let options: NSDictionary = [kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String: true] let accessEnabled = AXIsProcessTrustedWithOptions(options) return accessEnabled } // 2. Start Capture func startCapture() { guard checkAccessibilityPermissions() else { print("Permission denied") return } isCapturing = true let mask: NSEvent.EventTypeMask = [.keyDown, .keyUp] eventMonitor = NSEvent.addGlobalMonitorForEvents(matching: mask) { [weak self] event in self?.processEvent(event) } } // 3. Stop Capture func stopCapture() { if let monitor = eventMonitor { NSEvent.removeMonitor(monitor) eventMonitor = nil } isCapturing = false } private func processEvent(_ event: NSEvent) { // Only log keyDown to avoid double-counting the UI display guard event.type == .keyDown else { return } var modifiers: [String] = [] var symbols: [String] = [] // Map symbols for the UI if event.modifierFlags.contains(.command) { modifiers.append("command") symbols.append("⌘") } if event.modifierFlags.contains(.shift) { modifiers.append("shift") symbols.append("⇧") } if event.modifierFlags.contains(.option) { modifiers.append("option") symbols.append("⌥") } if event.modifierFlags.contains(.control) { modifiers.append("control") symbols.append("⌃") } let key = event.charactersIgnoringModifiers?.uppercased() ?? "" // Only display if a modifier is active (to capture "shortcuts" vs regular typing) if !symbols.isEmpty && !key.isEmpty { let shortcutString = "\(symbols.joined(separator: " ")) + \(key)" DispatchQueue.main.async { // Insert at the top so the newest shortcut is visible self.capturedShortcuts.insert(ShortcutEvent(displayString: shortcutString, timestamp: Date()), at: 0) } } } } PS :- I just did another test by creating a fresh new project with the default App Sandbox enabled, and tried and there also it worked!! Can I consider this a go to for MacOs app store than?
Replies
1
Boosts
0
Views
688
Activity
Jan ’26
Submission Rejected: Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage
Hi, I am in need of your help with publishing my game. I got the following explanation for the negative review of my app/game. Issue Description One or more purpose strings in the app do not sufficiently explain the use of protected resources. Purpose strings must clearly and completely describe the app's use of data and, in most cases, provide an example of how the data will be used. Next Steps Update the local network information purpose string to explain how the app will use the requested information and provide a specific example of how the data will be used. See the attached screenshot. Resources Purpose strings must clearly describe how an app uses the ability, data, or resource. The following are hypothetical examples of unclear purpose strings that would not pass review: "App would like to access your Contacts" "App needs microphone access" See examples of helpful, informative purpose strings. The problem is that they say my app asks to allow my app to find devices on local networks. And that this needs more explanation in the purpose strings. Totally valid to ask, but the problem is my app doesn't need local access to devices, and there shouldn't be code that asks this?? FYI the game is build with Unity. Would love some help on how to turn this off so that my app can get published.
Replies
1
Boosts
0
Views
363
Activity
Jan ’26
Local network request blocked in Safari but working in Chrome
For Local network access, Chrome prompts the user to allow access and adds it to Settings --> Privacy & Security --> Local Network. However, for Safari, no prompt appears. How do I force Safari to authorise these local network access requests if it won't trigger the permission dialogue? Is there a specific WKWebView configuration or Safari-specific header required to satisfy this security check?
Replies
1
Boosts
0
Views
503
Activity
Jan ’26
sshd-keygen-wrapper permissions problem
On macOS 26.1 (25B78) I can't give Full Disk Access to sshd-keygen-wrapper. Now my Jenkins jobs do not work because they do not have the permission to execute the necessary scripts. Until macOS 26.1 everything worked fine. I restarted the machine several times and tried to give access from Settings -> Privacy & Security -> Full Disk Access but it just does not work. I tried logging with ssh on the machine and executing a script but again nothing happened.
Replies
20
Boosts
3
Views
6.6k
Activity
Jan ’26
Can't remove "tracking" in my app privacy policy
I was planning to add the Facebook SDK in one of the releases, and I had everything prepared (including changing the privacy policy to state that my app tracks users for advertising). I changed the privacy policy in the App Store connect, thinking that this wouldn't take effect until I sent the app to review. However, after careful consideration, I decided not to move on with the Facebook SDK. My app does not currently track users for advertising. Even though I sent a new release (UI improvements only), I still can't change the privacy policy to remove that my app "tracks" the user. I read multiple posts with people facing similar issues. For my binary, I have: No PrivacyInfo.xcprivacy file NSUserTrackingUsageDescription in Info.plist No tracking declarations in my app configuration I contacted support, and I was redirected here. My case number is 102778907920
Replies
0
Boosts
1
Views
242
Activity
Dec ’25