# Security & Privacy Scorecard

## Thumbtack: Hire Service Pros

**Version:** 404.0 (Build 639) | **Scan Date:** 2025-12-18

**Security:** 38/100 | **Privacy:** 52/100

## What This Means for You

User activity is monitored by a fraud-detection service that profiles device and behavior. Payment processing runs through Stripe, and the app delivers marketing via Iterable. Data storage practices may leave personal and payment details with less protection than expected.

## Recommendation: Use With Caution

**Best For:** Homeowners comfortable sharing data to book local pros

## Key Findings

**Data Security** - 2 findings (1 critical, 1 high)

**Network Security** - 1 finding (1 medium)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 high, 1 medium)

## Privacy Concerns

### What Data is Collected

Thumbtack collects information about user device hardware, location, in-app behavior, and booking history. The fraud-detection service ThreatMetrix builds a profile of the device and how users interact with the app. Payment information is handled through Stripe.

### Third-Party Data Sharing

User data is shared with the following third parties:

- **ThreatMetrix** - Device fingerprinting and behavioral profiling for fraud detection
- **Stripe** - Payment processing
- **Iterable** - Marketing communications and push notifications
- **AWS WAF** - Network traffic filtering

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 38/100 |
| Privacy | 52/100 |
| Data Security | 25/100 |
| Network Security | 75/100 |
| Code Safety | 40/100 |
| Data Collection | 55/100 |
| Data Sharing | 45/100 |
| User Control | 60/100 |

## Positive Security Features

- No notable positive security practices were identified in this version of the app.

## Areas for Improvement

- **Improve data storage protections** - Personal and payment-related information stored on the device lacks adequate safeguards, increasing the risk that this data could be accessed if the device is lost or stolen.
- **Narrow the scope of device profiling** - A third-party service collects detailed information about the device and how the app is used; limiting what gets shared would better protect user privacy.
- **Strengthen in-app transparency** - User data flows to multiple outside services, and clearer disclosure within the app would give users a better understanding of what they are agreeing to share.

---

## About This Analysis

### App Details

- **App:** Thumbtack: Hire Service Pros
- **Package ID:** com.thumbtack.consumer
- **Version:** 404.0 (Build 639)
- **Scan Date:** 2025-12-18
- **Powered by:** canITrustThat