Dott

Is the Dott app safe?

Dott is a reasonable choice among shared scooter apps, with one clear trade-off. It has no reported data breach, keeps rider data in the European Union and publishes a security page that describes outside penetration testing. But it is more open to advertising than its listing suggests: Google Play says it shares location, contact details and device IDs with other companies for marketing, and Apple's label shows identifiers used to track you. Italy fined it €525,000 in August 2026 over free rides that were hard to claim in Rome. We score it 57/100, between Lime (62) and Bird (54).

The app is listed by Dott B.V., its privacy statement is that of emTransit B.V. of Amsterdam, and it is rated 4+. Since the merger with TIER, agreed in January 2024, it is the only app for both fleets. The App Store listing says Dott runs in more than 400 cities across Europe and the Middle East.

What Dott collects and shares

Apple's label lists identifiers as data used to track you across other companies' apps. Linked to you are purchases, financial info, location, contact info, user content, identifiers, usage data and diagnostics.

Google Play goes further. It says Dott shares your name, email address, user IDs, phone number, purchase history, device IDs and both approximate and precise location with other companies, and for most of these it lists "advertising or marketing" among the purposes. The privacy policy confirms that Dott works with social media platforms and ad networks to measure its campaigns and personalise ads.

Two parts of the policy deserve a closer look. Ride telemetry includes braking, swerving, collisions, speed, route and "weight fluctuations", which Dott uses to verify how a vehicle was used and passes to insurers when there is a claim. And Dott shares data with cities, local authorities and public transport operators to meet licensing conditions, including passing on fines that a city issues. On the other side, the policy says Dott stores personal data in the EU and uses EU model clauses for the rare transfers outside it.

The policy was last updated on 5 December 2024 and still calls the company "TIER-Dott". It promises the usual GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary rights, including access, portability and deletion, and says you can ask for a manual review of automated decisions.

Security

We found no reported breach of Dott or TIER rider data. Dott's security page says it has renewed its PCI-DSS certification for card payments, has an internal information security committee, and hires outside experts to test its rider apps and back-end systems. Researchers can report flaws to [email protected] under its vulnerability disclosure policy. We found no paid bug bounty on HackerOne or Bugcrowd, and Google Play says data is encrypted in transit.

The Rome fine

Dott, Lime and Bird each won a Rome permit in 2023 by promising cheap or free rides to holders of the city's annual Metrebus transit pass. Dott offered 90 rides a month for €0.01. To claim them, riders filled in a web form and uploaded proof of the pass and an ID document, which Dott checked automatically against the transit operator's servers and then by hand.

On 4 August 2026 AGCM found that this set-up could not cope with demand. From September 2024 until about May 2026, waiting times for activation grew and support relied on standard replies, by Dott's own account, which cut the time people had to use their free rides. The authority called it an aggressive, unfair commercial practice and set the fine at €700,000, then cut it to €525,000 because Dott had taken steps to fix the problem. Dott could appeal to the regional administrative court of Lazio within 60 days. Lime was fined €1.4 million and Bird €750,000 in parallel cases.

How to ride Dott more safely

1. Refuse tracking when iOS asks, and allow location only while using the app.
2. Turn off marketing messages in the app if you do not want Dott to use your contact details for ads.
3. Check the brakes, lights and tyres before you set off, and end the ride if anything feels wrong.
4. Wear a helmet and ride one person per vehicle.
5. If you rode TIER before the merger, delete the old TIER app and ask [email protected] to delete data you no longer need kept.

How we scored it

Regulatory record (82) is the strongest factor: one small consumer fine in Italy and no privacy fine. Security (62) reflects a clean breach record and outside testing but no bug bounty. Privacy (45) is the weakest, because Google Play shows location, contact details and device IDs shared for advertising, beyond the single tracking category on Apple's label. For a Swedish rival with a similar fleet, see Voi.