<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Privacy Manifest for Chanora.
         Apple started enforcing this file at App Store submission in
         May 2024 for iOS / iPadOS / visionOS / watchOS apps. Without
         it, archive upload to App Store Connect is rejected.

         Reference: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files
     -->

    <!-- Whether the app collects data that has been linked to the
         user's identity. Chanora never gathers third-party analytics,
         user accounts, ad identifiers, or device identifiers. The
         only "data" leaving the device is the voice + chat content
         the user explicitly sends to a TeamSpeak server they have
         chosen. Per Apple's definition that is "not collected by
         the app" because the destination is user-selected, not us.
     -->
    <key>NSPrivacyCollectedDataTypes</key>
    <array>
        <dict>
            <!-- Microphone audio that is transmitted to the user's
                 chosen voice server while the user is connected and
                 unmuted. Apple's data-type taxonomy classifies this
                 as "Audio Data". The audio is not linked to the user
                 (no Apple ID, no IDFA tied to the stream) and not
                 used for tracking. -->
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypeAudioData</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <false/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <!-- Communications: the user is talking to other
                     people on their chosen server. -->
                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
            </array>
        </dict>
    </array>

    <!-- The app does not track users across other apps + websites
         owned by other companies. -->
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>

    <!-- "Required reason" APIs Chanora uses. Apple maintains a list
         of system APIs that need a declared reason because they
         historically were abused for fingerprinting. Chanora uses
         the file-timestamp APIs (via tokio file I/O for storing the
         identity key + bookmark db + audio_meta + chanora.log) and
         the user-defaults API (via Flutter's path_provider plugin
         which queries NSUserDefaults to resolve Application Support
         paths). Documented reasons below match Apple's published
         allow-list. -->
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <!-- File-timestamp APIs used by tokio + rusqlite when
                 reading / writing identity.tskey, chanora.db, and
                 chanora.log. Reason `C617.1`: app-internal,
                 timestamps of files inside the app's container. -->
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>C617.1</string>
            </array>
        </dict>
        <dict>
            <!-- UserDefaults read indirectly via path_provider's
                 query for the app's documents directory. Reason
                 `CA92.1`: access user defaults to read information
                 only accessible to the app itself. -->
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>
            </array>
        </dict>
        <dict>
            <!-- System boot time read by tracing-subscriber for
                 timestamping log records. Reason `35F9.1`: measure
                 elapsed time between events that occur within the
                 app. -->
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategorySystemBootTime</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>35F9.1</string>
            </array>
        </dict>
        <dict>
            <!-- Disk space queried by rusqlite when checking sqlite
                 page capacity. Reason `E174.1`: display disk space
                 to the user. Actually we don't display it; we just
                 read it. The next-closest reason is `85F4.1`:
                 ensure disk space available before writes. -->
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryDiskSpace</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>85F4.1</string>
            </array>
        </dict>
    </array>
</dict>
</plist>
