Subway Surfers Security & Privacy Scorecard

Android

38
Overall trust score
Unsafe
35
Security
40
Privacy

User activity is shared with over a dozen advertising networks, including Facebook, Google, AppLovin, and Unity, to serve targeted ads. Gameplay data, device identifiers, and behavior are tracked by multiple analytics and attribution services. Ad targeting runs continuously in the background during gameplay.

Best for

Casual gamers comfortable with ad-supported play

Avoid if

You share your device with young children

Findings

  • 1 critical
  • 0 high
  • 0 medium
  • 0 low
  • 0 info

0 issues identified across security and privacy analysis.

Top security issues

  • WebView Universal File Access Enabled
  • Cleartext HTTP Traffic Allowed for Unity Ads CDN
  • Hardcoded Application Secret Exposed

Top privacy issues

  • Facebook SDK PII SHA-256 Hashing Vulnerable to Rainbow Tables
  • Extensive Cross-App Tracking via GAID
  • Data Shared with 70+ Third-Party Destinations

Full analysis

Subway Surfers

Security Score: 35/100 | Privacy Score: 40/100

Version 3.58.4 (Build 88992) - Scanned 2026-02-07

What This Means for You

User activity is shared with over a dozen advertising networks, including Facebook, Google, AppLovin, and Unity, to serve targeted ads. Gameplay data, device identifiers, and behavior are tracked by multiple analytics and attribution services. Ad targeting runs continuously in the background during gameplay.

Recommendation: Use With Caution

Best For: Casual gamers comfortable with ad-supported play
Avoid If: The device is shared with young children

Key Findings

Data Security - 6 findings (2 critical, 4 medium)

Network Security - 4 findings (2 critical, 1 high, 1 medium)

Code Safety - 0 findings

Privacy - 6 findings (5 high, 1 medium)

Privacy Concerns

What Data is Collected

The app collects device identifiers, gameplay activity, session timing, and behavioral patterns across sessions. This information is used to build profiles for ad targeting and to measure how users interact with the app over time.

Third-Party Data Sharing

User data is shared with 19 third-party services across advertising, analytics, platform, and support categories:

Advertising Networks: AppLovin MAX, IronSource, Unity Ads, Vungle, Google AdMob, Facebook Audience Network, InMobi, BidMachine, Moloco, Fyber/Digital Turbine, Mintegral, SuperAwesome, Kidoz

Analytics and Attribution: Firebase, Facebook Analytics, Singular, Unity Analytics

Platform Services: Google Play Services

Customer Support: Helpshift

Understanding the Scores

Category Score
Security 35/100
Privacy 40/100
Data Security 40/100
Network Security 30/100
Code Safety 30/100
Data Collection 45/100
Data Sharing 35/100
User Control 50/100

Positive Security Features

No positive security practices were identified in this analysis.

Areas for Improvement

  • Some data travels with less protection than expected, leaving user data more vulnerable on public Wi-Fi.
  • A large number of advertising partners receive user behavioral data, with limited controls offered to users for reducing or opting out of that sharing.
  • The simultaneous use of general ad networks and child-directed advertising services raises concerns about appropriate data handling for younger players.

About This Analysis

This scorecard reflects findings from automated static analysis of the app at the time of the scan. Scores range from 0 to 100, where higher is better. This report is intended to help users make an informed decision about installing and using the app.

App Details

  • App: Subway Surfers
  • Package: com.kiloo.subwaysurf
  • Version: 3.58.4 (Build 88992)
  • Platform: Android
  • Scan Date: 2026-02-07
  • Powered by: canITrustThat.com

Versions & scan history

ScanDateOverall score
#1 (current) 38/100