Subway Surfers Security & Privacy Scorecard
Android
User activity is shared with over a dozen advertising networks, including Facebook, Google, AppLovin, and Unity, to serve targeted ads. Gameplay data, device identifiers, and behavior are tracked by multiple analytics and attribution services. Ad targeting runs continuously in the background during gameplay.
Best for
Casual gamers comfortable with ad-supported play
Avoid if
You share your device with young children
Findings
- 1 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- WebView Universal File Access Enabled
- Cleartext HTTP Traffic Allowed for Unity Ads CDN
- Hardcoded Application Secret Exposed
Top privacy issues
- Facebook SDK PII SHA-256 Hashing Vulnerable to Rainbow Tables
- Extensive Cross-App Tracking via GAID
- Data Shared with 70+ Third-Party Destinations
Full analysis
Subway Surfers
Security Score: 35/100 | Privacy Score: 40/100
Version 3.58.4 (Build 88992) - Scanned 2026-02-07
What This Means for You
User activity is shared with over a dozen advertising networks, including Facebook, Google, AppLovin, and Unity, to serve targeted ads. Gameplay data, device identifiers, and behavior are tracked by multiple analytics and attribution services. Ad targeting runs continuously in the background during gameplay.
Recommendation: Use With Caution
Best For: Casual gamers comfortable with ad-supported play
Avoid If: The device is shared with young children
Key Findings
Data Security - 6 findings (2 critical, 4 medium)
Network Security - 4 findings (2 critical, 1 high, 1 medium)
Code Safety - 0 findings
Privacy - 6 findings (5 high, 1 medium)
Privacy Concerns
What Data is Collected
The app collects device identifiers, gameplay activity, session timing, and behavioral patterns across sessions. This information is used to build profiles for ad targeting and to measure how users interact with the app over time.
Third-Party Data Sharing
User data is shared with 19 third-party services across advertising, analytics, platform, and support categories:
Advertising Networks: AppLovin MAX, IronSource, Unity Ads, Vungle, Google AdMob, Facebook Audience Network, InMobi, BidMachine, Moloco, Fyber/Digital Turbine, Mintegral, SuperAwesome, Kidoz
Analytics and Attribution: Firebase, Facebook Analytics, Singular, Unity Analytics
Platform Services: Google Play Services
Customer Support: Helpshift
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 40/100 |
| Data Security | 40/100 |
| Network Security | 30/100 |
| Code Safety | 30/100 |
| Data Collection | 45/100 |
| Data Sharing | 35/100 |
| User Control | 50/100 |
Positive Security Features
No positive security practices were identified in this analysis.
Areas for Improvement
- Some data travels with less protection than expected, leaving user data more vulnerable on public Wi-Fi.
- A large number of advertising partners receive user behavioral data, with limited controls offered to users for reducing or opting out of that sharing.
- The simultaneous use of general ad networks and child-directed advertising services raises concerns about appropriate data handling for younger players.
About This Analysis
This scorecard reflects findings from automated static analysis of the app at the time of the scan. Scores range from 0 to 100, where higher is better. This report is intended to help users make an informed decision about installing and using the app.
App Details
- App: Subway Surfers
- Package: com.kiloo.subwaysurf
- Version: 3.58.4 (Build 88992)
- Platform: Android
- Scan Date: 2026-02-07
- Powered by: canITrustThat.com
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 38/100 |