Get App Privacy, age rating and compliance right with Xcode
Your privacy manifests already say what the app and its SDKs collect. Xcode reads them, MetaRun turns them into the exact App Privacy answers App Store Connect asks for, and the age rating questionnaire and export compliance go through previews.
Setup checked October 2026 against Apple: extending and customizing agents, giving external agents access to Xcode
Connect Xcode once
01 · Add the MetaRun plug-in
In Xcode 27, open Settings, Intelligence, Plug-ins. Choose Add Plug-in, then Add from URL, and paste:
https://github.com/metarun/metarun-skills02 · Or with one click
Opens Xcode's plug-in sheet with the repository filled in.
xcode://agent-plugin-clone?repo=https%3A%2F%2Fgithub.com%2Fmetarun%2Fmetarun-skills03 · Sign in
Install MetaRun from the list, then click Sign in next to it. MetaRun opens in your browser; pick read-only or read and change.
04 · Ask the coding assistant
Claude Agent, Codex and Gemini in Xcode all get MetaRun's tools and its six workflow skills.
Attach build 312 to version 2.4 and tell me what blocks submission.What Xcode handles here
App Privacy is the questionnaire behind your App Store privacy label: 35 data types, six purposes, linked or not, tracking or not, for your code and every SDK you ship. Getting it wrong is a common rejection, and Apple's API can't read or write it.
A coding agent has the input App Privacy needs: your PrivacyInfo.xcprivacy and the ones inside each Swift package or pod. MetaRun maps them one to one onto App Store Connect's answers and flags what App Review rejects. The age rating and export compliance do have an API, and go through previews.
Before you start
- Your app's PrivacyInfo.xcprivacy and each SDK's.
- Access to App Store Connect in a browser, to enter the App Privacy answers.
- The age rating questionnaire's facts: user content, web access, purchases.
How it runs
- 01
Collect the manifests
Xcode finds your app's PrivacyInfo.xcprivacy and each SDK's: Swift packages under DerivedData's SourcePackages checkouts, CocoaPods under Pods.
- 02
Build the answers
MetaRun merges them strictest-wins and returns every data type to tick, whether it's linked to the user or used for tracking, its purposes, and how the label will read.
- 03
Fix what review would reject
Findings name the problems App Review flags: unknown keys, a data type with no purpose, tracking declared with nothing marked for tracking, missing tracking domains.
- 04
Enter and publish
Because App Privacy has no API, you enter the answers in App Store Connect; MetaRun returns the steps and a link to the right page. Age rating and compliance apply through previews.
An example session in Xcode
Read the privacy manifests in this project and its packages and give me the App Privacy answers to enter.
- apple_build_privacy_answersAnswers built from four manifests, with one finding: an SDK declares tracking without a tracking domain.
- apple_get_age_rating_declarationThree age rating questions were never answered.
- apple_preview_set_age_ratingPreview: your answers plus the three unanswered questions, listed so you can see them.
- Xcode asks before running apple_apply_set_age_rating. You read the preview above and approve.
- apple_apply_set_age_ratingApplied. Apple derives the rating from the answers.
Illustrative: your apps, versions and numbers will differ. The tool names and their order are real.
The MetaRun tools Xcode calls
| Tool | What it does |
|---|---|
| apple_build_privacy_answersread | Turns PrivacyInfo.xcprivacy files into App Privacy answers, with findings App Review rejects. |
| apple_get_age_rating_declarationread | The age rating questionnaire as answered now. |
| apple_preview_set_age_ratingpreview + apply | Answer or change the questionnaire, and overrides. |
| apple_list_encryption_declarationsread | Existing export compliance declarations. |
| apple_preview_declare_build_encryptionpreview + apply | Answer export compliance for a build. |
| apple_preview_set_content_rightspreview + apply | Declare whether the app uses third-party content. |
| apple_list_accessibility_declarationsread | Accessibility Nutrition Labels per device family. |
| apple_preview_set_accessibility_declarationpreview + apply | Declare which accessibility features the app supports. |
Each preview has an apply twin (the same name with apply instead of preview) that only runs with the confirm token from a fresh preview, and refuses if App Store Connect changed in between. MetaRun tools save to your MetaRun workspace only (studio projects, tracked keywords), never to Apple.
What Apple enforces, and how MetaRun handles it
App Privacy has no API
There's no App Store Connect API endpoint for App Privacy at all. MetaRun builds the answers and the label; publishing them is done in App Store Connect.
Unanswered isn't the same as No
Apple stores an unanswered age rating question as empty, not No. An override sent on an empty questionnaire comes back as a server error, so MetaRun stages every unanswered question alongside your edits and lists them for you to see.
Korea's override needs the right category
Apple only accepts a Korea age rating override for apps in the Games or Entertainment category. The preview warns before the attempt instead of letting Apple refuse it.
Compliance declarations are permanent
An export compliance declaration can't be withdrawn once assigned to a build. Setting ITSAppUsesNonExemptEncryption in Info.plist avoids the question for future builds.
What to ask Xcode
- Ask Xcode: Read the privacy manifests in this project and its packages and give me the App Privacy answers to enter.
- Ask Xcode: Set ITSAppUsesNonExemptEncryption correctly in Info.plist, then check build 312's compliance.
- Ask Xcode: Declare VoiceOver and Dynamic Type support in our accessibility labels for iPhone.
How Xcode asks before a change
Xcode asks before an agent uses a tool it hasn't been allowed. Tools you've allowed are listed in Settings, Intelligence, under Permissions, where you can remove them. Leave MetaRun's apply tools off that list so every App Store change asks first; reads and previews are safe to allow.
Frequently asked questions
Can Xcode fill in App Privacy for me?
It can do all the thinking: Xcode reads the manifests and MetaRun produces the exact answers and the label. The last step, entering them in App Store Connect, is manual because Apple offers no API for App Privacy.
Which manifests should it read?
Your app's own PrivacyInfo.xcprivacy and every SDK's: Swift packages under DerivedData/<project>/SourcePackages/checkouts, CocoaPods under Pods. App Privacy covers everything the app links.
Can it set the age rating?
Yes. The questionnaire has an API, so Xcode reads it, stages your answers through a preview, and applies on your approval.
What about export compliance?
Per build, via apple_preview_declare_build_encryption. It's permanent for that build, so the preview says so before you approve.
How do I connect Xcode to App Store Connect?
In Xcode 27, add the plug-in from https://github.com/metarun/metarun-skills (Settings, Intelligence, Plug-ins, Add from URL) and click Sign in next to MetaRun. After that, ask for "app privacy and compliance" in plain words and Xcode picks the MetaRun tools.
Does Xcode see my App Store Connect key?
No. Your App Store Connect API key stays envelope-encrypted on MetaRun's servers and is decrypted per request. Xcode holds a MetaRun token that you can revoke in Settings at any time.
More with Xcode
Xcode
Submit for review
Attach the build, clear export compliance, run the readiness sweep, submit.
OpenXcode
TestFlight
Hand builds to tester groups, write What to Test, and read crash feedback.
OpenXcode
Subscriptions and IAPs
Create subscription groups, subscriptions and in-app purchases with copy and prices.
OpenXcode
Localize your listing
Name, subtitle, keywords and description in every App Store language, limits checked.
OpenApp Privacy and compliance with another agent
In depth: App Store Connect MCP server
Agent access
14-day free trial with agent access. No credit card. Your Apple key stays encrypted on MetaRun.