Shazam: Find Music & Concerts Security & Privacy Scorecard
by Apple · iOS
The microphone is used to listen for songs, but audio samples are not stored on the device long-term. The app collects user search history and listening activity to build a personal music profile. No third-party advertising or analytics companies were identified receiving user data.
Best for
Music lovers who want to identify songs quickly
Findings
- 0 critical
- 0 high
- 0 medium
- 6 low
- 11 info
1 issue identified across security and privacy analysis.
Top security issues
- WebView exempt from ATS with JS bridge exposes HTTP content to MITM injection
- JS bridge (callbackHandler) lacks origin validation — any WebView content can invoke native handlers
- Apple Media token stored in UserDefaults (plaintext plist) instead of hardware-backed Keychain
Top privacy issues
- 8 data categories all linked to user identity including vague 'Other Data Types' catch-all
- Beacon analytics tracks scroll depth, playback duration, and impressions per UI section linked to identity
- Coarse location collected and linked for geo-tagging and concert discovery
Full analysis
What This Means for You
The microphone is used to listen for songs, but audio samples are not stored on the device long-term. The app collects user search history and listening activity to build a personal music profile. No third-party advertising or analytics companies were identified receiving user data.
Recommendation: Trustworthy
Best For: Music lovers who want to identify songs quickly
Key Findings
Data Security - 2 findings (1 low, 1 info)
Network Security - 2 findings (1 low, 1 info)
Code Safety - 0 findings
Privacy - 5 findings (2 low, 3 info)
Privacy Concerns
What Data is Collected
The app collects user music search history and listening activity to build a personalized profile. Microphone access is used only during active song identification sessions. The app does not collect location data or contact information.
Third-Party Data Sharing
No third-party advertising or analytics companies were identified receiving user data during this analysis.
Understanding the Scores
- Security: 94/100
- Privacy: 88/100
- Data Security: 95/100
- Network Security: 93/100
- Code Safety: 93/100
- Data Collection: 85/100
- Data Sharing: 100/100
- User Control: 96/100
Positive Security Features
- User data is not shared with any third-party advertising or analytics companies.
- Strong user controls are in place over personal information.
- Data transmission between the app and its servers follows secure practices.
- The app limits data collection to what is needed for its core features.
Areas for Improvement
- Some listening history and search activity is retained beyond the immediate needs of song identification, which could be reduced to give users more control over their personal profile.
- Minor improvements to how data is stored locally on the device would further reduce the chance of unintended access by other apps.
- Greater in-app transparency about how long music history is kept would help users make more informed choices about their data.
About This Analysis
This scorecard is generated from automated static analysis of the app's code and behavior patterns. Scores reflect security and privacy practices observed at the time of the scan.
App Details
- App: com.shazam.Shazam
- Scan Date: 2026-03-23
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 91/100 |