# Security & Privacy Scorecard

## Shazam: Find Music & Concerts

### App Details

- Package: com.shazam.android
- Developer: Apple Inc.
- Platform: android
- Scan date: 2026-09-08T06:26:06.237720Z

## What This App Collects

The code sends precise location to Android platform Geocoder service; approximate location to Google Cloud Firestore; credentials to Google Firebase Authentication, Android Credential Manager provider (e.g. Google Password Manager), Apple Media Services (AMSKit native), Google Firebase Auth and 1 other recipient; and authentication tokens to Google Firebase Authentication, Apple Music, Firebase UI Auth (google-services), Google Cloud Firestore and 6 other recipients. Another 11 data points are sent out, each to the recipients its own findings name.

Other findings record data the code reads on the device without the analysis tracing it further, data arriving from a server and flows whose direction the available code left open.

## Can This Be Trusted

Read what this build shares first, and two findings with it.

The code sends data out of the device on 156 traced flows, reaching 53 distinct recipients. On 6 of those flows the analysis looked for a consent gate and could not locate one. On the rest the question was left open.

Of the 852 findings recorded, 2 sit at high severity or above, worth reading before this build handles anything a user would want kept to themselves. The other 850 are lighter. They fall mostly under Third-Party Risk, Privacy and Code Security.

An adversarial review also weakened two findings at high severity or above that this page does count: the review did not sustain them as written and kept them in a smaller form, and nothing in the analysis rewrites the wording to that smaller form. The detailed findings carry them with what the review made of them.

## What Needs Attention

Two findings need attention. One is about how data is stored on the device, one about the permissions requested. The detailed report states each of these in full.

## Scores

- Overall: 76/100
- Security: 77/100. Held down by how data is stored on the device and by how the app is put together.
- Privacy: 76/100. Held down by the amount collected and by how little of it is recorded as consented to.
- Data Security: 82/100
- Network Security: 90/100
- Code Safety: 84/100
- Data Collection: 83/100
- Data Sharing: 85/100
- User Control: 77/100
- Permission Usage: 88/100

## What the Score Set Aside

Of the 780 findings that describe something this build contains, 21 describe code inside bundled libraries that the call graph shows this build leaves unused. They keep their recorded severity and are named in full in the detailed report; the score was computed over the other 759.

The largest groups are firebase (11) and play-services (10).

Set aside by library:

- firebase (11)
- play-services (10)

## How This Was Checked

Of 193 planned analysis tasks, 1 was asked for and did not come back. This page covers the rest.

CITT examined 1,434 files, traced 378 data flows and recorded 852 findings, of which 2 are high severity.

Whether the user was asked first is mostly unrecorded, across the 378 flows recorded, not only the outbound ones: 350 were recorded without establishing whether the user had been asked at that point; 18 record a flow the analysis looked for a consent gate on and could not locate one; 3 sit on a path reachable before the app could have prompted; 7 run after the user granted permission.

An unsettled consent state is a gap in what the analysis could trace, and it is a different thing from a record that the user agreed.

## Method and Limitations

Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

## About This Analysis

This assessment was produced by CITT (Can I Trust That), an independent analysis service. Each statement above comes from one recorded claim, given here as a summary of what was found rather than as the evidence for it.