Deliveroo

Is Deliveroo safe to use?

Your payment details are reasonably safe on Deliveroo, and we found no disclosed breach of its customer data. Your privacy is a different matter. The app's Apple label lists your purchase history, name, email, phone number and rough location among data used to track you across other companies' apps, and the privacy policy allows marketing by phone and WhatsApp as well as email. Its one big fine, €2.5 million in Italy, was about how it watched its riders rather than its customers. We score it 55/100, below its sister app Wolt (60) and above DoorDash (42), which now owns both.

Now part of DoorDash

DoorDash completed its takeover of Deliveroo plc on 2 October 2025, according to its quarterly filing. Deliveroo keeps its own app, brand and Deliveroo Plus subscription, and Roofoods Ltd in London is still the publisher. The privacy policy, last published on 5 October 2026, adds that DoorDash, Inc. can also be a controller of your data "where necessary to provide our services".

For customers the takeover has not yet changed much that we can see. When DoorDash disclosed a breach in November 2025 after an employee fell for a social engineering scam, it said Deliveroo and Wolt customers were not affected.

What the app tracks

Deliveroo's Apple label is among the longer ones for a delivery app. Under "Data Used to Track You" it lists purchase history, coarse location, name, email, phone number, other user content, user and device IDs, product interaction and diagnostics. For third-party advertising it links purchases, contact details, identifiers and usage data to you. Precise location is collected for analytics, personalisation and running the app, but is not on the tracking list.

Google Play says much the same: name, email, user IDs, purchase history and approximate location may be shared with other companies for advertising or marketing, and photos may be shared for fraud prevention.

The privacy policy is short and easier to read than most. It says Deliveroo may send you marketing by post, email, SMS, MMS, WhatsApp, push notifications and phone, show you ads online, and transfer data outside the UK and EEA, "such as to India". It sets no fixed retention period; data is kept as long as "reasonably necessary".

The Italian rider case

On 22 July 2021 Italy's data protection authority, the Garante, ordered Deliveroo Italy to pay €2.5 million. Its inspectors found the company located about 8,000 riders' phones every 12 seconds while they were working, kept all their routes for six months and gave them a "generic and misleading" description of that tracking. It also faulted Deliveroo for not explaining how its system booked and ranked riders, for missing an impact assessment and for weak security measures.

The case matters, but it is about Deliveroo's workers, not the people ordering food. We count a fine in full when the app's own users were harmed. Here the riders were, so it counts at half weight. Deliveroo's other run-ins in Italy are about riders too: in February 2026 Milan prosecutors placed DoorDash's Italian operations under temporary judicial administration while they investigate rider pay, according to DoorDash's filing. We mention it as context only.

Security and scams

We could not find a disclosed breach of Deliveroo's customer database. Deliveroo's security.txt file points researchers to a vulnerability report form; we found no public paid bug bounty on HackerOne or Bugcrowd, unlike Wolt and DoorDash, which both pay.

The Garante's finding of weak security measures for rider data is a few years old and concerns the rider systems, but it lowers our confidence that the same company protected everything else well.

For customers the practical risk is phishing, as with every delivery app: a message that pretends to come from the company, mentions an order or a refund, and asks for a login code or card details. Any genuine refund shows up in the app or on your card statement, so check there first.

How to use Deliveroo more safely

1. On iPhone, tap "Ask App Not to Track" when the app asks; it stops the cross-app tracking Apple's label describes.
2. Object to the marketing channels you do not want, especially phone and WhatsApp.
3. Treat any message about a refund or voucher as suspect until you see it in the app.
4. Use a unique password, and remove saved cards you no longer use.
5. If you stop using Deliveroo, ask for deletion: the policy keeps data for as long as it is "reasonably necessary", which is not a fixed limit.

How we scored it

Privacy (38) is the weakest factor, because Apple's label lists contact details, purchases and location among data used to track you. Regulatory record (76) is the strongest: Deliveroo's only significant fine concerned riders, which we count at half weight. Security (60) reflects a clean breach record but no paid bug bounty and an old finding of weak security for rider data. For a ride and delivery app with a lighter label, see Bolt (59).