Info.plist & Permissions

Overview

BidMachine SDK does not require any iOS permissions.

The SDK never requests access to tracking, location, camera, microphone, photos, calendar, or any other protected system resource. As a result, BidMachine does not require any permission-related entries in your application's Info.plist.

If your project already contains permission usage descriptions, they were most likely added by your application, another SDK, or a build script. Keep only the keys required by features your app actually uses.

Permission Usage Descriptions

Include a usage description only when your application itself uses the corresponding feature. Each key you include should describe that feature in terms a user would recognize.

One key deserves special mention:

App Tracking Transparency

BidMachine reads the current ATT authorization status if available, but never requests tracking authorization itself. If another component in your app presents the ATT dialog, you must include NSUserTrackingUsageDescription. See App Tracking Transparency.

App Store Review

Apple reviews permission usage descriptions under App Store Review Guideline 5.1.1. Purpose strings must explain a user-facing feature of your app rather than advertising-related functionality.

If your app doesn't use a permission, remove the corresponding Info.plist key instead of providing a generic or placeholder description.

Purpose string	Outcome
"We use your location to show nearby stores and local content."	Describes a user-facing feature
"Your location will be used to provide you an ad in location."	Describes advertising only
"-"	Placeholder

Permission Reference

Permission	BidMachine	Recommendation
Tracking (ATT)	Not required	Include NSUserTrackingUsageDescription if your app or any other component presents the ATT dialog. BidMachine reads the resulting status but never requests authorization itself.
Location	Not required	Include only if your app provides location-based features. BidMachine uses location information only when permission has already been granted by your application.
Calendar	Not required	Include only if your application accesses the user's calendar.
Photos	Not required	Include only if your application reads from or writes to the photo library.
Camera & Microphone	Not required	Include only if your application captures photos, video, or audio.

MRAID calendar and photo features

BidMachine's distributed iOS SDK does not include MRAID calendar or store-picture support. Adding calendar or photo library permission keys will not enable this functionality, so these keys should only be present if your application uses the Calendar or Photos frameworks.

Technical details

The MRAID createCalendarEvent and storePicture code paths are guarded by the MRAID_CALENDAR_ENABLED and MRAID_STORE_PICTURE_ENABLED compile-time flags, which are defined only in debug configurations. The published XCFrameworks therefore contain no EventKit, EventKitUI, or Photos symbols.

The SDK likewise links no camera or microphone APIs. The only AVFoundation usage is the read-only AVAudioSession.isOtherAudioPlaying contextual signal, which requires no permission.

Unity Integration Notes

Some Unity post-process build scripts add permission usage descriptions automatically. The following pattern is common and worth reviewing, since the location strings describe advertising rather than an app feature, and the calendar value is a placeholder:

plistRoot.SetString("NSLocationAlwaysUsageDescription", "Your location will be used to provide you an ad in location.");
plistRoot.SetString("NSLocationWhenInUseUsageDescription", "Your location will be used to provide you an ad in location.");
plistRoot.SetString("NSCalendarsUsageDescription", "-");

If your app does not use location or calendar features, remove these keys from the script. If it does, replace the strings with descriptions of the corresponding app feature.

Troubleshooting

If App Store Connect reports a missing permission usage description, you can verify which framework references the corresponding API using the following commands.

# Check whether the BidMachine framework references the API
nm -u BidMachine.framework/BidMachine | grep -iE 'EKEventStore|PHPhotoLibrary|AVCaptureDevice|requestTrackingAuthorization'

# List frameworks linked by your app
otool -L YourApp.app/YourApp | grep -iE 'EventKit|Photos|AppTrackingTransparency|CoreLocation'

For a missing privacy manifest, confirm the manifest reached your app bundle. Xcode's Organizer → Archives → Generate Privacy Report is the most reliable check; for CocoaPods integrations, pod deintegrate && pod install resolves most cases. See Privacy Manifest.

Optional URL Scheme Support

MRAID creatives may include tel: and sms: links. Support for these is detected with UIApplication.canOpenURL, which requires the scheme to be declared in LSApplicationQueriesSchemes. Declaring them enables click-through on such creatives and has no effect on App Store review.

Info.plist

<key>LSApplicationQueriesSchemes</key>
<array>
    <string>tel</string>
    <string>sms</string>
    <string>itms-apps</string>
</array>

Application Metadata

Key	Notes
CFBundleShortVersionString / CFBundleVersion	Use a valid SemVer X.Y.Z value (2.7.0, not 2.70). Non-SemVer values have been observed to prevent SKAdNetwork items from initializing. If an embedded framework such as UnityFramework.framework omits these keys, upload validation fails — add them to that framework's own Info.plist.
ITSAppUsesNonExemptEncryption	Set to false to skip Apple's export-compliance question on each upload, if your app uses no non-exempt encryption.

Monetization Configuration

These keys are not permissions, but the SDK reads them from your Info.plist and they affect attribution and demand.

Key	Purpose
SKAdNetworkItems	Required for install attribution. Keep the list current — an outdated list is reported in the dashboard as "SKAdNetwork Items are missing / outdated" and reduces the demand available to your inventory. Partner IDs change independently of the SDK version, so re-check the list at each update. See SKAdNetwork Support.
AdNetworkIdentifiers	AdAttributionKit network identifiers, forwarded to buyers in the bid request. See AdAttributionKit Support.
NSAdvertisingAttributionReportEndpoint	Endpoint for copies of attribution postbacks. Include only if you operate one.

Network Security

NSAppTransportSecurity with NSAllowsArbitraryLoads enabled allows non-HTTPS creatives by signalling HTTP support in the bid request. Apple asks for a justification for arbitrary loads during review, so include it only if your app requires it. Leaving App Transport Security at its default is the recommended production configuration. See Network security configuration.