feat: privacy manifest files (#677)

Co-authored-by: Scott Wittrock (Customer.io) <[email protected]>
customerio · Apr 10, 2024 · e5c6dc7 · e5c6dc7
1 parent 5503f73
commit e5c6dc7
Show file tree

Hide file tree

Showing 9 changed files with 245 additions and 12 deletions.
diff --git a/CustomerIODataPipelines.podspec b/CustomerIODataPipelines.podspec
@@ -17,8 +17,11 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/DataPipeline/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/DataPipeline"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
   spec.module_name = "CioDataPipelines" # the `import X` name when using SDK in Swift files
 
   spec.dependency "CustomerIOCommon", "= #{spec.version.to_s}"

diff --git a/CustomerIOMessagingInApp.podspec b/CustomerIOMessagingInApp.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingInApp/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingInApp"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+
   spec.module_name = "CioMessagingInApp"  # the `import X` name when using SDK in Swift files
 
   spec.dependency "CustomerIOCommon", "= #{spec.version.to_s}"

diff --git a/CustomerIOMessagingPushAPN.podspec b/CustomerIOMessagingPushAPN.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingPushAPN/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingPushAPN"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+
   spec.module_name = "CioMessagingPushAPN" # the `import X` name when using SDK in Swift files
 
   spec.dependency "CustomerIOMessagingPush", "= #{spec.version.to_s}"

diff --git a/CustomerIOMessagingPushFCM.podspec b/CustomerIOMessagingPushFCM.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingPushFCM/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingPushFCM"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+
   spec.module_name = "CioMessagingPushFCM" # the `import X` name when using SDK in Swift files 
 
   spec.dependency "CustomerIOMessagingPush", "= #{spec.version.to_s}"  

diff --git a/Package.swift b/Package.swift
@@ -82,30 +82,42 @@ let package = Package(
         // Data Pipeline
         .target(name: "CioDataPipelines",
                 dependencies: ["CioInternalCommon", "CioTrackingMigration", .product(name: "Segment", package: "Segment")],
-                path: "Sources/DataPipeline"),
+                path: "Sources/DataPipeline",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "DataPipelineTests",
                     dependencies: ["CioDataPipelines", "SharedTests"],
                     path: "Tests/DataPipeline"),
 
         // APN
         .target(name: "CioMessagingPushAPN",
                 dependencies: ["CioMessagingPush"],
-                path: "Sources/MessagingPushAPN"),
+                path: "Sources/MessagingPushAPN",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingPushAPNTests",
                     dependencies: ["CioMessagingPushAPN", "SharedTests"],
                     path: "Tests/MessagingPushAPN"),
         // FCM 
         .target(name: "CioMessagingPushFCM",
                 dependencies: ["CioMessagingPush", .product(name: "FirebaseMessaging", package: "Firebase")],
-                path: "Sources/MessagingPushFCM"),
+                path: "Sources/MessagingPushFCM",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingPushFCMTests",
                     dependencies: ["CioMessagingPushFCM", "SharedTests"],
                     path: "Tests/MessagingPushFCM"),
 
         // Messaging in-app
         .target(name: "CioMessagingInApp",
                 dependencies: ["CioInternalCommon"],
-                path: "Sources/MessagingInApp"),
+                path: "Sources/MessagingInApp",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingInAppTests",
                     dependencies: ["CioMessagingInApp", "SharedTests"],
                     path: "Tests/MessagingInApp"),

diff --git a/Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy b/Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	Docs for this section: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_data_use_in_privacy_manifests
+	This section is describing what information our SDK collects about the app user. 
+	
+	It's my understanding that this section is for what our SDK collects automatically, not the data a customer passes to our SDK. Therefore, if a piece of data is passed to our SDK, use `false`.
+	Customers must create their own privacy file for what their app collects and provide that to Apple. That's where customers report what data they are passing to our SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+
+	  <!-- 
+	  Section for SDKs that capture "Such as screen name, handle, account ID, assigned user ID, customer number, or other user- or account-level ID that can be used to identify a particular user or account."
+	  -->
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeUserID</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/> <!-- because of anonymous profiles, linking to a person is optional -->
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>
+
+		<!--
+		Section for SDKs that capture "Such as app launches, taps, clicks, scrolling information, music listening data, video views, saved place in a game, video, or song, or other information about how the user interacts with the app."
+		-->
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+  <!-- 
+  Document on this section: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api
+  Documents if our SDK uses certain system calls and why. Prevents SDK using fingerprinting.   
+  -->
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+
+	<!-- "third-party SDK uses data for tracking as defined under the App Tracking Transparency framework."
+	See section "Asking permission to track" in this webpage: 
+	https://developer.apple.com/app-store/user-privacy-and-data-use/ 
+	-->
+	<key>NSPrivacyTracking</key>
+	<false/>
+
+	<!-- Because we use NSPrivacyTracking=false, this section is not required.
+	<key>NSPrivacyTrackingDomains</key> 
+	-->
+</dict>
+</plist>
diff --git a/Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>
diff --git a/Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+
+	**Important** - Keep this file in sync with other push modules in SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>
diff --git a/Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+
+	**Important** - Keep this file in sync with other push modules in SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>