You can include it in the reviewer notes.

The original source of the model should have a license that you can look at to see what uses are allowed.

You can create an app without ever having an iPhone. All you need is a Mac.

Does the user that reported the crash have analytics shared with developers turned off? If so you won't get a crash file. You can ask them to send you the file. You can get the file by going to settings privacy analytics analytics data

Yes you can put your name. Yes user videos are 3rd party content. Disclaimer: I am NOT a lawyer.

Firebase uses SSL so you need to answer yes to "Does your app use encryption?". You'll need to submit a report in January. You can find instructions for doing this report by googling "Does your app use encryption?"

@developerms your customers will use Apple Business Manager to download your app. I wrote an article with more details at getonthestore.com/private-app-distribution.

My understanding is that a privacy prompt is only needed for accessing the advertisingIdentifier, and not the identifierForVendor.

Regarding your first question, it doesn't matter whether you or the SDK you integrate accesses the data. What matters is how the SDK uses the data. You should read the SDK's terms of use and privacy policies to understand how they use your user's data. Regarding your second question, you don't need to show the prompt if you don't want to access the device's advertising identifier. If you don't show the prompt the device’s advertising identifier value will be all zeros.

I would say collecting IP addresses counts as Coarse Location. You can enter your App Privacy details in App Store Connect and get a preview of what will be displayed on your app's product page. If you don't think it fairly portrays how you're using IP address you can remove it again.

My understanding is that yes you should disclose that you are using Apple's crash reporting. I drew that conclusion from their statement that "If you collect data about your app from Apple frameworks or services, you should indicate what data you collect and how you use it."

“Collect” refers to transmitting data off the device in a way that allows you and/or your third-party partners to access it for a period longer than what is necessary to service the transmitted request in real time. So you don't need to disclose this data type if you don't store it after the request has completed.

You need to create a new version to release a new build to the App Store.

There are a few different options for private app distribution that would fit your requirements. You could use TestFlight, AdHoc, Enterprise (In-House) or Apple Business Manager (Custom Apps) distribution. I wrote an article on this topic getonthestore.com/private-app-distribution