Steam
The thinnest data base in this batch - 5 verified scans from 4 devices, which we state up front - but those five agree exactly: Steam's companion app carries four SDKs, and one of them is the Meta SDK. Facebook code in a gaming platform's app is the finding here, alongside Firebase, Google Sign-In, and Google Maps. The manifest asks for READ_PHONE_STATE, an old-school device-identity permission most modern apps have dropped, plus read and write access to your calendar for event features. Camera and microphone map to Steam Guard QR login and voice chat.
Read from the bytecode.
The Meta SDK classes most plausibly serve Facebook login and social features, and static analysis cannot show what they transmit at runtime. But Meta's SDK is the piece of third-party code with the industry's deepest cross-app profile machinery behind it, and it ships in an app logged into your gaming identity. Combined with READ_PHONE_STATE and calendar write access, Steam's companion asks for more reach than its job strictly needs - worth knowing, not alarming.
This is static analysis of the APK bytecode installed on real devices: it proves which SDK classes and manifest permissions ship in the app, not what the app transmits at runtime. Traffic analysis is a different measurement.
Hidden inside the code.
What it asks for.
Device identity and phone status - old-school broad, most apps no longer need it
Reads and writes calendar entries - for event reminders, unusually much access for that
Precise location - present in the manifest in 4 of 5 scans
Steam Guard QR login and voice chat - expected
Keep reading.
The Apps That Sell Your Data Are Not the Ones You Think
Most articles warn about sketchy apps, but Candy Crush shares data with 131 companies. Here's who actually profits from ...
What trackers are actually hiding in your apps
We scanned 32 of the most-installed Android apps and counted every embedded tracker SDK. The average app hides 5 tracker...
Similar risk profiles.
Scan Steam yourself.
Get the full report on your device - with real-time DEX analysis, permission auditing, and breach monitoring. Free, no account needed.