Blinkit

Is Blinkit safe to use?

Blinkit is safe enough to order groceries in India, and its security testing is better than most delivery apps', because it shares Zomato's paid bug bounty. The weak point is how much it collects and passes to advertisers. Apple's privacy label says your precise location, home address, phone number, searches and purchase history may be used for third-party advertising. Google Play lists sexual orientation among optional data used for ads. The policy also lets Blinkit read which other apps are on your phone. We score it 53/100, between Zomato (54) and Swiggy (52).

Blinkit, Grofers and Eternal

Blinkit began as Grofers and is still run by Blink Commerce Private Limited, "formerly known as Grofers India Private Limited". It belongs to Eternal Limited, the group that also owns Zomato. Many of the app's internal web addresses still use the grofers.com domain. The privacy policy lets Blinkit share your data with "subsidiaries and affiliates" under its ultimate parent, which it still calls Zomato Limited, a name the group dropped in 2025.

What the app collects and who sees it

Blinkit's Apple label is short in one section and long in another. Under "Data Used to Track You" it lists only product interaction. But the "Data Linked to You" section names third-party advertising as a purpose for precise and coarse location, physical address, phone number, search history, purchase history, user and device IDs, and advertising data. That is more ad use than Zomato's label shows.

Google Play's data safety section says Blinkit may share your phone number and device IDs for advertising, and lists sexual orientation and "other info" as optional data collected for analytics, advertising and personalisation. It also lists files and documents.

The privacy policy, last updated in January 2025, adds more:

• Installed apps. Blinkit may collect "the presence and/or absence" of other apps on your phone, across shopping, fashion, food and travel, to "understand you and your preferences better".
• Data from others. It may get information about you from partners, marketers, third-party websites and researchers, and combine it with its own.
• Ad networks. Google Analytics, OpenX, PubMatic and DoubleClick are named among the outside companies allowed to serve tailored ads inside the app.
• Recorded chats. Some communications with delivery partners and sellers may be recorded.

Because the policy and the "linked" section go well beyond the tracking section, we score privacy on the broader picture.

Security: Zomato's bug bounty covers Blinkit

Eternal runs one paid programme on HackerOne for its apps. The scope lists blinkit.com, the Android app (com.grofers.customerapp) and the iPhone app as eligible for rewards, and the programme shows 1,310 resolved reports across the group. Few Indian shopping apps put their customer app in a paid bounty.

We found no confirmed breach of Blinkit or Grofers customers. The policy says card payments go through PCI-compliant processors. Its other security wording is generic, and it says Blinkit takes no responsibility for disclosures caused by "unauthorized third-party access".

Consumer complaints and regulators

We found no regulator fine on Blinkit. In October 2024 India's Central Consumer Protection Authority (CCPA) reportedly sent notices to 11 shopping and quick commerce companies, Blinkit among them, according to Inc42, citing CNBC-TV18, after complaints about products listed without the mandatory declarations, such as manufacturing or expiry dates, that the Legal Metrology Act requires. We found no order on Blinkit since. A distributors' federation has also asked the Competition Commission of India to look at quick commerce pricing, but a complaint is not an investigation.

Blinkit's rival Zepto was fined by the CCPA in 2025 under the 2023 guidelines on dark patterns, deceptive designs such as hidden fees and pre-ticked add-ons. We found no such finding against Blinkit. Still, compare the final bill with the prices you saw while browsing, since the Zepto case was about fees added only at checkout.

Age limits

The App Store rates Blinkit 13+, citing infrequent alcohol, tobacco or drug references, and Google Play rates it 3+. Blinkit's own policy is stricter: the service is "not intended for users under the age of 18". If your teenager has a phone with a saved card or UPI app, that gap matters more than any content in the app.

How to use Blinkit more safely

1. On iPhone, tap "Ask App Not to Track", and allow location only while using the app.
2. Leave optional profile fields, such as gender or anniversary dates, empty.
3. Check the item's expiry date when it arrives, and refuse or report products without one.
4. Treat calls about refunds or "failed deliveries" as suspect; use in-app help instead.
5. If you leave, ask for deletion through "Contact Us" rather than just removing the app.

How we scored it

Regulatory record (82) is Blinkit's strongest factor: no fine, only a reported consumer-authority notice. Privacy (34) is the weakest, because the label ties your location, address and searches to third-party advertising and the policy covers installed apps and bought-in data. Security (64) rests on a paid bug bounty and a clean breach record. For a quick commerce rival with a weaker record, see Zepto.