You can sign the data, but this leaves the problem that the private key needs to be embedded into the application in order to verify it.
You can store the replay data on a server and allow the friends to access it using their own device.
For an average game, it is likely not worth the effort because the data can already be manipulated at the time it is recorded by modifying the game application. Depending on the type of game, it may be suitable to use fully automated bots, aim bots or map hacks.
Protect application from being modified has some more information on that topic.