99

Is the 99 app safe?

For riders, 99 is one of the better-equipped ride apps on safety and one of the weaker ones on data. It lets you record the audio of every trip automatically, checks passengers' identity against their CPF and card, and runs facial checks to keep banned users off the platform. But its privacy policy says your data sits on servers in the United States and may go to group companies in the US and China, and Brazilian consumer regulators have fined it twice. We score it 48/100, a little below DiDi Rider (52), DiDi's app for other countries, and above DiDi in China (41).

99 started as a Brazilian taxi app and now belongs to DiDi. It is published by 99 Tecnologia Ltda in São Paulo and covers car rides, motorcycle rides under the 99Moto name, food delivery through 99Food and payments.

What 99 does with your data

The App Store label is the same shape as DiDi Rider's. Only the device ID is listed as used to track you, for third-party advertising and 99's own marketing. Linked to you are precise and coarse location, name, email, phone number, contacts, photos or videos, audio data, your user ID and how you use the app. Google Play says 99 shares payment info and device IDs with other companies, for fraud prevention and advertising.

The privacy policy, updated on 9 April 2026, goes further than the labels:

• 99 stores personal data on servers in the United States and may share it with group companies in the US and China, for purposes that include improving its platforms.
• Passenger photos taken during identity checks can be compared biometrically with the faces of users banned for breaking the terms.
• The app watches for screen capture, screen mirroring and text typed or pasted during use, which 99 says helps it spot fraud tools without reading your messages.
• 99 uses your data to target its own and third parties' ads, which you can switch off in the privacy settings.
• It recommends that you allow location access at all times, in the background.

Under our rules we score privacy on the broader of label and policy, which puts it at 38, two points below the 40 we give Uber for privacy.

The payment side has had one leak. In July 2024 Brazil's central bank said registration data linked to 39,088 Pix keys held at 99Pay had been exposed between 26 June and 2 July: names, partly masked CPF numbers, branch and account numbers, but no passwords or balances. 99Pay said the fault was fixed. Watch for scam calls that quote your bank details. 99 runs no public bug bounty we could find, and login is by a phone code with no authenticator option, so security scores 51.

Fines and the moto-taxi fight

Most of 99's regulatory trouble comes from consumer authorities, not data regulators. We found no decision by Brazil's data protection authority, the ANPD, about 99.

In June 2025 Procon-SP, the São Paulo state consumer authority, fined 99 Tecnologia R$3.53 million and Uber R$13.79 million. It said both kept offering moto-taxi rides in the city of São Paulo while a court decision suspending the service was in force, which it treated as a breach of the consumer code's rules on service safety. Both companies could appeal, and their trade association, Amobitec, said they had complied once the ruling was clarified. Earlier, in 2022, the Rio de Janeiro city consumer agency Procon Carioca fined 99 about R$3 million over drivers refusing rides. In January 2023 Rio's state prosecutors opened an inquiry into complaints that 99 had no phone line or other effective channel for complaints. We found no published outcome. After the 2024 Pix leak described above, the central bank said it would apply the sanctions its rules provide for; we found no published penalty.

The food side has drawn new cases in 2026. On 23 June Senacon, the federal consumer secretariat, opened a sanction process against 99Food for not showing how much of a price goes to the platform, the courier and the restaurant, the same rule it used against iFood and Keeta a month earlier. 99Food had 20 days to answer, fines can reach R$14 million, and the company said it meets the consumer code. Separately, CADE, the competition authority, is investigating 99Food's exclusive contracts with restaurants after a complaint by Keeta; in September 2026 its tribunal refused Keeta's request to suspend the clauses while the inquiry runs. That case is about restaurants rather than riders, so it counts only as context.

Two small consumer fines and a pending Senacon case put regulatory record at 65.

Rider safety on 99

99's safety centre, the blue shield in the app, is its strongest feature. You can start audio recording at any point in a trip or record every trip automatically, and the other person is not told when a recording starts mid-trip. 99 keeps the encrypted audio for 30 days, or 5 years if someone reports a safety incident. Some partner cars carry a security camera, which records the outside of the car and, if the emergency button is pressed, audio inside it. Passengers are checked against their CPF, date of birth and card, and drivers go through facial recognition and criminal record checks.

The risks are Brazilian roads and the push into motorcycles. 99Moto rides carry more injury risk than car trips, and Procon-SP found that 99 kept selling them in São Paulo during a court suspension. Brazil's official rating on the App Store is 18, which the Ministry of Justice gave for location sharing and online purchases. The US App Store rates the same app 4+.

How to use 99 more safely

1. Turn on automatic audio recording for all trips in the safety centre.
2. Add a trusted contact and share long or late trips with them.
3. Prefer car rides over 99Moto on fast roads or in heavy rain.
4. In Settings, open Privacy and turn off marketing and personalised ads.
5. Set location access to "while using the app" instead of always, unless you need background features.

How we scored it

Regulatory record (65) is the strongest factor: two small consumer fines and a pending Senacon case over 99Food's fees, with no data protection fine. Privacy (38) is the weakest, because the policy allows transfers to group companies in China, stores data in the US and compares passengers' faces with banned users. Scams and harmful content (46) balances strong recording tools against motorcycle rides sold during a court suspension. For a Latin American ride app with a different business model, compare inDrive.