Do you have Ad Colony enabled? I had the same issue outside of Corona with Ad Colony. They also use the EventKitUI which prompts the users in iOS 10 for access to view and edit their Calendar. Since my app does not have any calendar functionality it was rejected.
I sent an e-mail to Ad Colony and this is what I got:
There are no plans a this time to make any changes to the permissions needed by our network. I have however, passed on your concerns to our Product team.
Here are some examples of why we require these permissions:
Camera and Photo Library permissions are used for campaigns that have a selfie component to their end card; camera to take the picture and Photo Library to save it. One campaign we worked with using this type of end card was the Angry Birds movie launch. This campaign had an “Angrify Yourself” selfie as part of the end card; which you can view at http://rm3.adtilt.com/2016/04/angry_birds/index.html. Note that this is a static page showing the end card layout only, as our cards rely on our SDK to provide the button functionality. But, you can see the function on your computer on the website at https://www.angrify.me/#!/. Essentially the user takes a fun selfie and the Angry Birds eye brows are added and the photo is saved; the user could take as many of these selfies as they chose and then use them off of their phone to post on social media or text to friends or whatever else they might choose.
The key to this functionality is that there was no requirement for the user to take a selfie. If they weren’t interested; they just closed the end card and returned to the app they were using. We will never require a user to interact with this type of function to return to their app. Additionally I want to further clarify when I mention posting the photos to social media; this is not something that our SDK or AdColony does, this is the user’s choice based on having the photo saved to their device through the Photo Library.
The Calendar permission allows us to create an event for the user and add it to their calendar. Again, this requires the user to opt in by clicking the button that would appear on the end card; the button will be labeled with either “Remind Me” or “Add to Calendar” for clarity to the user. When the user clicks the button, they will be taken to their calendar where they will have to approve/save the event that is created by our system. At this point they could still discard the event and return to the end card without and issue. They also have the option to not click the button at all and close the end card to return to the app that they are using. For this permission as well, we will never add to the user’s calendar without their permisison through opting in by clicking the button on the end card and approving the event. You can also view an example of an end card containing this function at http://d1e5xacotudrwg.cloudfront.net/production/builds/2016-10/22298/22b4a132-05b5-4509-abb4-140c5eb581cb/index.html. Again the “Remind Me” button will not produce a calendar event in this case as our SDK is required for this to work.
Please let me know if you have any further questions on this.
Best,
Melissa