CITT

    Scan results

    Subway Surfers

    Android

    Subway Surfers is a stylized runner arcade game featuring action-packed platformer gameplay. Join Jake on an endless chase across subway tracks in vibrant cityscapes. Contains ads and in-app purchases. Rated Everyone 10+.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Casual gamers comfortable with ad-supported play

    Not For: You share your device with young children

    What It Means For You

    User activity is shared with over a dozen advertising networks, including Facebook, Google, AppLovin, and Unity, to serve targeted ads. Gameplay data, device identifiers, and behavior are tracked by multiple analytics and attribution services. Ad targeting runs continuously in the background during gameplay.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (28)

    Data Security

    6 total
    2 Critical
    4 Medium

    Network Security

    4 total
    2 Critical
    1 High
    1 Medium

    Code Security

    8 total
    2 Critical
    3 High
    3 Medium

    Privacy

    6 total
    5 High
    1 Medium

    Third-Party Risk

    3 total
    2 High
    1 Medium

    Permission Usage

    1 total
    1 Medium

    Third-Party Services

    AppLovin MAX, IronSource, Unity Ads, Vungle, Google AdMob, Facebook Audience Network, InMobi, BidMachine, Moloco, Fyber/Digital Turbine, Mintegral, SuperAwesome, Kidoz, Firebase, Facebook Analytics, Singular, Unity Analytics, Google Play Services, Helpshift

    Security Strengths

    • ✓Uses MODE_PRIVATE for SharedPreferences preventing world-readable access
    • ✓Sybo analytics enforces HTTPS-only with HttpsURLConnection
    • ✓Singular API enforces TLS 1.2 minimum version
    • ✓WorkManager database excluded from Auto Backup via no_backup directory
    • ✓Some Facebook WebViews properly disable file access from file URLs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    ads
    analytics
    location
    sensitive data
    financial

    Package

    com.kiloo.subwaysurf

    Version

    3.58.4 (Build 88992)

    Analysis Date

    Feb 7, 2026

    Classes Analyzed

    34,223

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (2 critical, 4 medium)

    Network Security - 4 findings (2 critical, 1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (5 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    The app collects device identifiers, gameplay activity, session timing, and behavioral patterns across sessions. This information is used to build profiles for ad targeting and to measure how users interact with the app over time.

    Third-Party Data Sharing

    User data is shared with 19 third-party services across advertising, analytics, platform, and support categories:

    Advertising Networks: AppLovin MAX, IronSource, Unity Ads, Vungle, Google AdMob, Facebook Audience Network, InMobi, BidMachine, Moloco, Fyber/Digital Turbine, Mintegral, SuperAwesome, Kidoz

    Analytics and Attribution: Firebase, Facebook Analytics, Singular, Unity Analytics

    Platform Services: Google Play Services

    Customer Support: Helpshift

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy40/100
    Data Security40/100
    Network Security30/100
    Code Safety30/100
    Data Collection45/100
    Data Sharing35/100
    User Control50/100

    Positive Security Features

    No positive security practices were identified in this analysis.

    Areas for Improvement

    • Some data travels with less protection than expected, leaving user data more vulnerable on public Wi-Fi.
    • A large number of advertising partners receive user behavioral data, with limited controls offered to users for reducing or opting out of that sharing.
    • The simultaneous use of general ad networks and child-directed advertising services raises concerns about appropriate data handling for younger players.

    About This Analysis

    This scorecard reflects findings from automated static analysis of the app at the time of the scan. Scores range from 0 to 100, where higher is better. This report is intended to help users make an informed decision about installing and using the app.

    App Details

    • App: Subway Surfers
    • Package: com.kiloo.subwaysurf
    • Version: 3.58.4 (Build 88992)
    • Platform: Android
    • Scan Date: 2026-02-07
    • Powered by: canITrustThat.com

    Right of Reply

    Developer not yet contacted