Thumbtack: Hire Service Pros Security & Privacy Scorecard
Android
User activity is monitored by a fraud-detection service that profiles device and behavior. Payment processing runs through Stripe, and the app delivers marketing via Iterable. Data storage practices may leave personal and payment details with less protection than expected.
Best for
Homeowners comfortable sharing data to book local pros
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Hardcoded HMAC Signing Keys
- Unencrypted Authentication Token Storage
- API Key Exposure
Top privacy issues
- Hidden Device Fingerprinting via ThreatMetrix SDK
- Privacy Leaks Through Logging
- Extensive Third-Party Code Without Vulnerability Scanning
Full analysis
Thumbtack: Hire Service Pros
Version: 404.0 (Build 639) | Scan Date: 2025-12-18
Security: 38/100 | Privacy: 52/100
What This Means for You
User activity is monitored by a fraud-detection service that profiles device and behavior. Payment processing runs through Stripe, and the app delivers marketing via Iterable. Data storage practices may leave personal and payment details with less protection than expected.
Recommendation: Use With Caution
Best For: Homeowners comfortable sharing data to book local pros
Key Findings
Data Security - 2 findings (1 critical, 1 high)
Network Security - 1 finding (1 medium)
Code Safety - 0 findings
Privacy - 2 findings (1 high, 1 medium)
Privacy Concerns
What Data is Collected
Thumbtack collects information about user device hardware, location, in-app behavior, and booking history. The fraud-detection service ThreatMetrix builds a profile of the device and how users interact with the app. Payment information is handled through Stripe.
Third-Party Data Sharing
User data is shared with the following third parties:
- ThreatMetrix - Device fingerprinting and behavioral profiling for fraud detection
- Stripe - Payment processing
- Iterable - Marketing communications and push notifications
- AWS WAF - Network traffic filtering
Understanding the Scores
| Category | Score |
|---|---|
| Security | 38/100 |
| Privacy | 52/100 |
| Data Security | 25/100 |
| Network Security | 75/100 |
| Code Safety | 40/100 |
| Data Collection | 55/100 |
| Data Sharing | 45/100 |
| User Control | 60/100 |
Positive Security Features
- No notable positive security practices were identified in this version of the app.
Areas for Improvement
- Improve data storage protections - Personal and payment-related information stored on the device lacks adequate safeguards, increasing the risk that this data could be accessed if the device is lost or stolen.
- Narrow the scope of device profiling - A third-party service collects detailed information about the device and how the app is used; limiting what gets shared would better protect user privacy.
- Strengthen in-app transparency - User data flows to multiple outside services, and clearer disclosure within the app would give users a better understanding of what they are agreeing to share.
About This Analysis
App Details
- App: Thumbtack: Hire Service Pros
- Package ID: com.thumbtack.consumer
- Version: 404.0 (Build 639)
- Scan Date: 2025-12-18
- Powered by: canITrustThat
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #2 (current) | 42/100 | |
| #1 | 58/100 |