Suno - AI Music & Songs Maker Security & Privacy Scorecard
Android
User activity is tracked by several third-party services including Braze, Segment, and Singular, which share usage patterns for marketing and attribution. Account and payment data flow through multiple external platforms. Users receive targeted messaging based on how they use the app.
Best for
AI music creators comfortable with standard analytics
Findings
- 4 critical
- 5 high
- 4 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Authentication Token Storage
- Hardcoded RevenueCat API Key
- JavaScript Bridge Over-Permission
Top privacy issues
- Excessive Analytics Tracking Without Consent
- User PII Exposure via JavaScript Bridge
- Full Cloud Backup of Sensitive Data
Full analysis
Suno - AI Music & Songs
com.suno.android | Version 1.37.0 (Build 223) | Analyzed: 2025-12-18
What This Means for You
User activity is tracked by several third-party services including Braze, Segment, and Singular, which share usage patterns for marketing and attribution. Account and payment data flow through multiple external platforms. Users receive targeted messaging based on how they use the app.
Recommendation: Use With Caution
Best For: AI music creators comfortable with standard analytics
Key Findings
Data Security - 3 findings (1 critical, 2 high)
Network Security - 2 findings (1 high, 1 medium)
Code Safety - 0 findings
Privacy - 2 findings (2 high)
Privacy Concerns
What Data is Collected
Suno collects behavioral and usage data including how users interact with music creation features, session activity, and engagement patterns. Account information, subscription details, and payment processing data are also collected. Device identifiers are used to link activity across sessions.
Third-Party Data Sharing
User data reaches multiple external companies. Braze and Segment receive behavioral and engagement data used for marketing automation and audience analytics. Singular receives attribution data to understand how the app was discovered and installed. Firebase handles performance and crash data. RevenueCat processes subscription and purchase history. Statsig runs experiments on app features presented to users. Ably, Clerk, hCaptcha, Google Play Billing, Google Cast, Lokalise, and Media3 each receive data relevant to their specific functions.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 48/100 |
| Privacy | 58/100 |
| Data Security | 42/100 |
| Network Security | 75/100 |
| Code Safety | 45/100 |
| Data Collection | 60/100 |
| Data Sharing | 55/100 |
| User Control | 50/100 |
Positive Security Features
- hCaptcha integration protects account actions from automated abuse.
- Clerk provides a dedicated authentication layer for managing account access.
Areas for Improvement
- Usage data is shared with over a dozen third-party services; reducing this number would limit how broadly user behavior is profiled across the advertising ecosystem.
- Stronger safeguards around how account and payment data are stored would better protect user information if any connected service experienced a problem.
- More transparent controls over which analytics services receive user data would give users greater say in how their information is used.
About This Analysis
This scorecard reflects static analysis of the app's code and configuration at the time of the scan. Scores may change as the app is updated.
App Details
- App: Suno - AI Music & Songs
- Package ID: com.suno.android
- Version: 1.37.0 (Build 223)
- Scan Date: 2025-12-18
- Platform: Android
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #3 (current) | 52/100 | |
| #2 | 52/100 | |
| #1 | 72/100 |