Ele.me (Taobao Shangou, 淘宝闪购)

Is Ele.me safe?

Ele.me, which has been called Taobao Shangou (淘宝闪购) since December 2025, is safe enough for paying and getting food delivered in China. Its weak spot is the food itself. In April 2026 China's market regulator found that thousands of shops on the app had no valid food licence and fined the operator RMB 558 million, one of the largest penalties in the "ghost takeaway" cases. The app also tracks you for advertising and keeps all data in mainland China. We score it 44/100, about level with Meituan (43) and Taobao (42).

The app belongs to Shanghai Rajax Information Technology, which Alibaba bought in 2018. It has about 12.2 million ratings on China's App Store and ranked second in Food & Drink there in October 2026. It is only available in mainland China.

The ghost-kitchen fine

On 17 April 2026 the State Administration for Market Regulation (SAMR) fined seven platforms a combined RMB 3.597 billion. Its decision on Shanghai Rajax, as quoted by Ifeng Tech, found that 5,908 food sellers on the app had no valid food-business licence, 124 had cancelled licences, 103 had expired ones and 194 were using someone else's. That makes 6,329 sellers the platform had failed to check.

SAMR also found that Ele.me had signed up two order-forwarding services and given them API access to order data. Shops used them to pass your order to another kitchen without telling you, which SAMR said violated consumers' right to know. After removing overlaps, 3,754 more shops were involved. The penalty was RMB 23.1 million in confiscated income plus RMB 535.4 million in fines, RMB 558.4 million in all, and a six-month ban on adding new cake shops. The company's legal representative and food-safety director were fined personally.

It did not end there. On 28 August 2026 Shanghai's market regulator fined the operator RMB 6.55 million because 51 more restaurants, trading since July 2025, had never been checked. Business media also reported a RMB 200,000 fine from Beijing in December 2024 for the same failing.

What the app collects

Apple's China label lists your device ID as used to track you across other companies' apps. Purchase history, search history and device ID are linked to you and used for Ele.me's own ads and personalisation; name, phone number and payment details are linked to you for ordering. Precise location is listed as not linked to you.

The basic-function policy, updated on 28 October 2026, describes more. It collects device identifiers, Wi-Fi lists, SSID and BSSID, and information about the app's own running processes. When you log in from a new place or act unusually, it adds GPS, nearby Wi-Fi and Bluetooth data, motion sensors and "risk app" information. The clause that stands out lets Taobao Shangou and its Alibaba affiliates send your encrypted phone number or device number to telecom operators, to look up model scores built from your online behaviour, device, calling patterns and location. The policy calls this sensitive data but says it is needed to personalise services.

There are limits. The policy says the app runs no cross-platform ad targeting based on personal data and does not hand your data to ad partners for that. Data collected in China is stored in China, and the policy says it is not sent abroad without your separate consent.

Account and payment security

We found no reported breach of Ele.me user accounts. Payments go through outside payment services such as Alipay and WeChat Pay, embedded in the app. The policy describes TLS for data in transit, access controls and encryption, and Alibaba runs a security response centre for outside researchers. There is no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for chats with shops or riders.

The weak point is how far order data travels. SAMR's finding that Ele.me gave forwarding services API access to orders means your name, phone number and address could reach kitchens you never chose.

How to order more safely

1. Open the shop page and check its food-business licence and address before you order, especially for cakes and other made-to-order food.
2. Be wary of shops with no photos of a kitchen, very low prices or dozens of branches under one name.
3. Switch off personalised recommendations under My, Settings, Security centre, and review permissions on the same screen.
4. Refuse calls offering a "refund" that ask you to share your screen or move money. Use in-app customer service or 10105757.
5. Use the official App Store app, not look-alike mini-programs.

How we scored it

Privacy (34) is the weakest factor because of tracking and the telecom-score clause. The regulatory record (42) sits in the band for large fines: one very large SAMR penalty plus two smaller ones for the same failure. Transparency and control (56) is the strongest, with deletion, data download and a personalisation switch in the app. Security (50) has no account breach on record, but order data reached forwarding services.