From e5c6dc7b6841ca31c02f2bd61cd49dc9c6604055 Mon Sep 17 00:00:00 2001
From: Levi Bostian <levi@customer.io>
Date: Wed, 10 Apr 2024 10:37:45 -0500
Subject: [PATCH] feat: privacy manifest files (#677)

Co-authored-by: Scott Wittrock (Customer.io) <153670820+scotttwittrockcio@users.noreply.github.com>
---
 CustomerIODataPipelines.podspec               |  7 +-
 CustomerIOMessagingInApp.podspec              |  8 +-
 CustomerIOMessagingPushAPN.podspec            |  8 +-
 CustomerIOMessagingPushFCM.podspec            |  8 +-
 Package.swift                                 | 20 ++++-
 .../Resources/PrivacyInfo.xcprivacy           | 79 +++++++++++++++++++
 .../Resources/PrivacyInfo.xcprivacy           | 41 ++++++++++
 .../Resources/PrivacyInfo.xcprivacy           | 43 ++++++++++
 .../Resources/PrivacyInfo.xcprivacy           | 43 ++++++++++
 9 files changed, 245 insertions(+), 12 deletions(-)
 create mode 100644 Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy
 create mode 100644 Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy
 create mode 100644 Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy
 create mode 100644 Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy

diff --git a/CustomerIODataPipelines.podspec b/CustomerIODataPipelines.podspec
index c35226c27..43c1cf642 100644
--- a/CustomerIODataPipelines.podspec
+++ b/CustomerIODataPipelines.podspec
@@ -17,8 +17,11 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/DataPipeline/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/DataPipeline"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
   spec.module_name = "CioDataPipelines" # the `import X` name when using SDK in Swift files
   
   spec.dependency "CustomerIOCommon", "= #{spec.version.to_s}"
diff --git a/CustomerIOMessagingInApp.podspec b/CustomerIOMessagingInApp.podspec
index 73e2da0b0..a20d693ac 100644
--- a/CustomerIOMessagingInApp.podspec
+++ b/CustomerIOMessagingInApp.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingInApp/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingInApp"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+
   spec.module_name = "CioMessagingInApp"  # the `import X` name when using SDK in Swift files
   
   spec.dependency "CustomerIOCommon", "= #{spec.version.to_s}"
diff --git a/CustomerIOMessagingPushAPN.podspec b/CustomerIOMessagingPushAPN.podspec
index 49fbec3c1..d9a0231aa 100644
--- a/CustomerIOMessagingPushAPN.podspec
+++ b/CustomerIOMessagingPushAPN.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingPushAPN/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingPushAPN"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+
   spec.module_name = "CioMessagingPushAPN" # the `import X` name when using SDK in Swift files
   
   spec.dependency "CustomerIOMessagingPush", "= #{spec.version.to_s}"
diff --git a/CustomerIOMessagingPushFCM.podspec b/CustomerIOMessagingPushFCM.podspec
index 3a86ab92b..b91934f83 100644
--- a/CustomerIOMessagingPushFCM.podspec
+++ b/CustomerIOMessagingPushFCM.podspec
@@ -17,8 +17,12 @@ Pod::Spec.new do |spec|
   # spec.osx.deployment_target = "10.15"
   # spec.tvos.deployment_target = '13.0'
 
-  spec.source_files  = "Sources/MessagingPushFCM/**/*"
-  spec.exclude_files = "Sources/**/*{.md}"
+  path_to_source_for_module = "Sources/MessagingPushFCM"
+  spec.source_files = "#{path_to_source_for_module}/**/*{.swift}"
+  spec.resource_bundle = {
+    "#{spec.module_name}_Privacy" => "#{path_to_source_for_module}/Resources/PrivacyInfo.xcprivacy"
+  }
+  
   spec.module_name = "CioMessagingPushFCM" # the `import X` name when using SDK in Swift files 
   
   spec.dependency "CustomerIOMessagingPush", "= #{spec.version.to_s}"  
diff --git a/Package.swift b/Package.swift
index 9cf106688..f9386b491 100644
--- a/Package.swift
+++ b/Package.swift
@@ -82,7 +82,10 @@ let package = Package(
         // Data Pipeline
         .target(name: "CioDataPipelines",
                 dependencies: ["CioInternalCommon", "CioTrackingMigration", .product(name: "Segment", package: "Segment")],
-                path: "Sources/DataPipeline"),
+                path: "Sources/DataPipeline",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "DataPipelineTests",
                     dependencies: ["CioDataPipelines", "SharedTests"],
                     path: "Tests/DataPipeline"),
@@ -90,14 +93,20 @@ let package = Package(
         // APN
         .target(name: "CioMessagingPushAPN",
                 dependencies: ["CioMessagingPush"],
-                path: "Sources/MessagingPushAPN"),
+                path: "Sources/MessagingPushAPN",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingPushAPNTests",
                     dependencies: ["CioMessagingPushAPN", "SharedTests"],
                     path: "Tests/MessagingPushAPN"),
         // FCM 
         .target(name: "CioMessagingPushFCM",
                 dependencies: ["CioMessagingPush", .product(name: "FirebaseMessaging", package: "Firebase")],
-                path: "Sources/MessagingPushFCM"),
+                path: "Sources/MessagingPushFCM",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingPushFCMTests",
                     dependencies: ["CioMessagingPushFCM", "SharedTests"],
                     path: "Tests/MessagingPushFCM"),
@@ -105,7 +114,10 @@ let package = Package(
         // Messaging in-app
         .target(name: "CioMessagingInApp",
                 dependencies: ["CioInternalCommon"],
-                path: "Sources/MessagingInApp"),
+                path: "Sources/MessagingInApp",
+                resources: [
+                    .process("Resources/PrivacyInfo.xcprivacy"),
+                ]),
         .testTarget(name: "MessagingInAppTests",
                     dependencies: ["CioMessagingInApp", "SharedTests"],
                     path: "Tests/MessagingInApp"),
diff --git a/Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy b/Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy
new file mode 100644
index 000000000..b1970e6cb
--- /dev/null
+++ b/Sources/DataPipeline/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	Docs for this section: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_data_use_in_privacy_manifests
+	This section is describing what information our SDK collects about the app user. 
+	
+	It's my understanding that this section is for what our SDK collects automatically, not the data a customer passes to our SDK. Therefore, if a piece of data is passed to our SDK, use `false`.
+	Customers must create their own privacy file for what their app collects and provide that to Apple. That's where customers report what data they are passing to our SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+	
+	  <!-- 
+	  Section for SDKs that capture "Such as screen name, handle, account ID, assigned user ID, customer number, or other user- or account-level ID that can be used to identify a particular user or account."
+	  -->
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeUserID</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/> <!-- because of anonymous profiles, linking to a person is optional -->
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>
+		
+		<!--
+		Section for SDKs that capture "Such as app launches, taps, clicks, scrolling information, music listening data, video views, saved place in a game, video, or song, or other information about how the user interacts with the app."
+		-->
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+  <!-- 
+  Document on this section: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api
+  Documents if our SDK uses certain system calls and why. Prevents SDK using fingerprinting.   
+  -->
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+	
+	<!-- "third-party SDK uses data for tracking as defined under the App Tracking Transparency framework."
+	See section "Asking permission to track" in this webpage: 
+	https://developer.apple.com/app-store/user-privacy-and-data-use/ 
+	-->
+	<key>NSPrivacyTracking</key>
+	<false/>
+	
+	<!-- Because we use NSPrivacyTracking=false, this section is not required.
+	<key>NSPrivacyTrackingDomains</key> 
+	-->
+</dict>
+</plist>
\ No newline at end of file
diff --git a/Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy
new file mode 100644
index 000000000..87eabe552
--- /dev/null
+++ b/Sources/MessagingInApp/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+	
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>
\ No newline at end of file
diff --git a/Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy
new file mode 100644
index 000000000..5acf82e23
--- /dev/null
+++ b/Sources/MessagingPushAPN/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+
+	**Important** - Keep this file in sync with other push modules in SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+	
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>
\ No newline at end of file
diff --git a/Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy b/Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy
new file mode 100644
index 000000000..5acf82e23
--- /dev/null
+++ b/Sources/MessagingPushFCM/Resources/PrivacyInfo.xcprivacy
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	See DataPipelines module for documentation of this file. Including resources for each section to learn more. 	
+
+	**Important** - Keep this file in sync with other push modules in SDK. 
+   -->   
+	<key>NSPrivacyCollectedDataTypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>				
+				<string>NSPrivacyCollectedDataTypePurposeProductPersonalization</string>
+			</array>
+		</dict>		
+	</array>
+
+	<key>NSPrivacyAccessedAPITypes</key>
+	<array>
+		<dict>
+			<key>NSPrivacyAccessedAPIType</key>
+			<string>NSPrivacyAccessedAPICategoryUserDefaults</string>
+			<key>NSPrivacyAccessedAPITypeReasons</key>
+			<array>
+				<string>CA92.1</string>
+			</array>
+		</dict>
+	</array>
+	
+	<key>NSPrivacyTracking</key>
+	<false/>
+</dict>
+</plist>
\ No newline at end of file