Baemin

Is Baemin safe to use?

Baemin is a fair choice for ordering food in Korea, and Korean privacy law gives you more control here than most delivery apps offer. You can delete your data and switch off targeted ads inside the app, and the policy names every company abroad that gets your details. The catches are real, though. The app still tracks you for advertising, it sends your address and building door code to its parent's systems in Germany and the US, and in 2026 a criminal gang used a planted call-centre worker to find a customer's home. A competition case that could end in a fine of hundreds of billions of won is pending. We score it 54/100, between foodpanda (56) and talabat (51), its sister apps in the Delivery Hero group.

The call-centre leak

The most serious incident is recent. A revenge-for-hire gang that takes commissions over Telegram got one of its members hired as an agent at an outsourced company running Baemin's customer service. The agent looked up customers' names and addresses, and the gang used one address to smear filth on a victim's front door and spray-paint insults, ZDNet Korea reported.

Woowa Brothers, the company behind Baemin, reported the misuse to the Personal Information Protection Commission (PIPC) and to police, audited the contractor and ended its contract. At a meeting on 9 September 2026 the PIPC found that one Baemin user's data had been leaked to the gang and that 467 users' records had been viewed without authorisation. It decided that Woowa could not have spotted the planted agent in advance and that giving agents access was not itself illegal, so it issued an improvement recommendation instead of a fine. Woowa must check access logs for unusual lookups, train and supervise staff at contractors, and report back within 90 days.

Since then, agents can look up orders only by order number, not by phone number, and see data from a shorter period, with watermarks on screen and download blocks. Woowa says it has added penetration testing and security monitoring and raised its contractor security checklist from 31 to 53 items.

An older leak in July 2021 came through a hacked customer-chat provider and exposed about 10,000 support chats with riders and restaurant owners, not customers, some with names, birth dates and phone numbers. We found no public bug bounty for Baemin on HackerOne or Bugcrowd. The policy says passwords are hashed and account numbers and ID numbers are encrypted.

What Baemin collects and where it goes

Apple's label lists user ID, device ID, product interaction and advertising data under "Data Used to Track You". Coarse location and device ID are linked to you for third-party advertising. Google Play says device IDs, app interactions and approximate location may be shared for advertising.

The privacy policy, in force since 30 September 2026, says Baemin automatically collects purchase and search history, device details and advertising IDs and uses them for targeted ads. It promises not to combine this behavioural data with your identity without consent and not to show targeted ads to children under 14.

The overseas transfer table is the part to read. Your delivery address, including the building door code you enter for riders, phone number or safe number, email, order details and device ID go to Delivery Hero SE in Germany and the US "for system development and maintenance" and statistics. Braze in the US gets your phone number, gender, district and usage records for messaging. OpenAI, Anthropic and Google receive delivery addresses, orders, support chats and profile data to run a virtual customer agent, in regions including the US, Japan and Singapore. You can refuse these transfers only by leaving the service.

The competition case

Baemin has the largest share of Korea's delivery market, and the Korea Fair Trade Commission (KFTC) has three cases against it. Examiners say Baemin demanded that restaurants not offer lower prices on rival apps, pushed them toward its own Baemin Delivery service, and advertised delivery times as faster than they really were. In June 2026 the KFTC rejected Baemin's offer to settle through a consent decree with a ₩300 billion support package for restaurants, and moved to a full hearing. In the same decision it turned down an offer from Coupang Eats, which faces the price-parity charge too. Reports put the possible fine at ₩239–510 billion. The price-parity part is about restaurants, which counts at half weight for us; the delivery-time ads affected customers.

We found no final decision yet, so the case counts as a pending regulator proceeding. HuffPost Korea reports that Delivery Hero is trying to sell Woowa Brothers.

How to use Baemin more safely

1. Turn off targeted ads under My Baemin, then settings, and on iPhone tap "Ask App Not to Track".
2. Use the safe number option so restaurants and riders see a relay number, not your real phone number.
3. Think twice before saving your building door code in the app, since it travels with your address to the parent company's systems.
4. If a call or text about your order asks for a code or payment, hang up and use the in-app chat.
5. If you stop using Baemin, delete your account under My Baemin rather than just removing the app.

How we scored it

Transparency and control (66) is Baemin's strongest factor, thanks to in-app deletion, an in-app ad opt-out and a dated policy that lists every processor and country. Privacy (44) is the weakest: tracking for ads and wide transfers abroad, door code included. Security (52) reflects the 2026 insider leak, and the regulatory record (63) a large competition case still waiting for a decision.