3.1 KiB
Integrated prototype static privacy/API audit — 2026-09-18
Scope: tracked source and local package graph on integration/first-device-prototype. This is a static review and unsigned build check, not a signed archive privacy report or App Store acceptance.
| Surface | Implemented use / retention | Declaration / remaining evidence |
|---|---|---|
| iPhone URLSession | User-selected TV, TLS WebSocket, ephemeral session; credentials never logged or sent to watch | NSLocalNetworkUsageDescription; real prompt/denial and ATS/TLS behavior pending |
| WatchConnectivity | Live bounded commands/replies; latest opaque TV ID, label and readiness in context | No tokens, hostnames, motion samples, certificates or command backlog in context |
| Core Motion | Watch device-motion rotation rates at requested 50 Hz, neutral calibration, bounded active sessions | NSMotionUsageDescription; samples in memory; physical permission/lifecycle behavior pending |
| Security / CryptoKit | Per-TV token/pin and selected-TV metadata on iPhone, SHA-256 certificate comparison | Device-only Keychain, candidate AfterFirstUnlock accessibility to evaluate locked-phone relay; no shared access group or cloud sync |
| Required-reason APIs | No direct UserDefaults/AppStorage, systemUptime/mach_absolute_time, file timestamps, disk-space queries or active-keyboard enumeration found in app/adapter/core sources | Empty NSPrivacyAccessedAPITypes retained for reviewed source; ContinuousClock and CM sample timestamps replace boot-time API calls |
| Collection / tracking | No developer backend, analytics, ads or third-party runtime SDK | Empty collected-data categories and tracking=false retained; archive and store answers require release review |
App-generated data stays between the user's devices and selected TV. This does not excuse a release privacy policy. No raw motion persistence/export was added. Calibration and orientation are held in watch memory. Forget removes selected-TV metadata, token and trust record; device Keychain deletion needs signed hardware evidence. No background workout/audio/location entitlement or blanket ATS exception was introduced.
The certificate approval screen explains unauthenticated first-use trust. Approval stores only the exact per-TV SHA-256 pin. Challenge failure stops the connection; a UI review candidate does not itself approve trust. Changed-certificate approval drops prior credentials.
Source audit used searches for the required-reason API families plus manual review of every adapter and the two composition roots. Both app Info.plists and bundled PrivacyInfo.xcprivacy must be checked in the generated build; a signed release archive privacy report remains mandatory.
References: Apple required-reason API categories, Apple local-network privacy TN3179. Local-network permission has no general status-query API; the UI does not claim that a failed socket proves denial.