Glovo

Is Glovo safe to use?

Glovo is fine for getting a meal or groceries delivered, but it gives you less protection than most of its rivals. Apple's label lists your location, contact details, purchases and device IDs as data used to track you across other companies' apps. In April 2021 an attacker got in through an old admin panel, and we found no paid bug bounty today. It was also fined €105.7 million by the EU in a cartel case that split European markets, and €7.6 million in Italy over riders' data. We score it 46/100, below foodpanda (56), its sister app under Delivery Hero, and Just Eat (58).

What Glovo tracks

Glovo's Apple label is among the heavier ones for a delivery app. Purchases, location, contact info, identifiers and usage data all appear under "Data Used to Track You", and the same five types are linked to you for third-party advertising. Google Play's data safety section adds detail: approximate and precise location, payment information, purchase history, search history and your name, email, phone number and address may be shared with other companies, for purposes that include advertising, analytics and fraud checks. It also says the app may share the list of other apps installed on your phone, for fraud prevention.

Glovo's privacy policy (we read the copy archived on 23 October 2026, as its document site blocks automated visitors) sets out the GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary rights to access, correct and erase your data and to object to profiling. You can turn off personalised ads in the app under Manage privacy, or by email. Data is kept for as long as you have an account and then for the legal period for claims. The policy also says that using the app after it changes counts as consent to the new version, which is a weak way to ask.

The 2021 breach

On 4 May 2021 Glovo told Reuters that an attacker had entered one of its systems through an old administrator platform on 29 April and had been removed as soon as the intrusion was detected. It said no card data was accessed, because it does not store card details. Forbes, citing the security firm Hold Security, reported that the attacker was selling logins to customer and courier accounts, including the ability to change their passwords. Glovo did not say how many accounts were affected.

That is the main reason our security score is low. Glovo's security.txt file now points researchers to Delivery Hero's disclosure page. Its own HackerOne programme paid no bounties and has been closed in favour of Delivery Hero's.

The EU cartel fine and the rider cases

On 2 June 2025 the European Commission fined Delivery Hero and Glovo €329 million in total, of which €105,732,000 fell on Glovo. Between July 2018, when Delivery Hero bought into Glovo, and July 2022, when it took control, the two agreed not to poach each other's staff, exchanged sensitive business information and divided European markets between them. It was the Commission's first cartel finding in a labour market. Both companies admitted it and got a 10% settlement reduction.

In Italy the data protection authority, the Garante, fined Glovo's local company Foodinho €2.6 million in June 2021 for how its algorithms rated and booked riders, using data such as location every 15 seconds and how quickly riders accepted orders. In November 2024 it fined Foodinho €5 million more over the data of more than 35,000 riders. It found that riders had been located even outside working hours until August 2023, that blocked riders were not told they could contest the decision, and it banned the facial recognition Foodinho used to check riders' identity.

These cases are serious. The Commission said cartels like this reduce choice for consumers, and splitting markets between rivals takes that choice away from the people ordering food, so we count the EU fine in full. The Italian fines protect riders rather than customers, so we count them at half weight. Together they put the regulatory score at 44, one of the lower records among the delivery apps we score.

How to use Glovo more safely

1. On iPhone, tap "Ask App Not to Track" when the app asks; it covers the cross-app tracking on Apple's label.
2. Give the app location access only while you use it, and type in your address instead if you prefer.
3. Use a unique password, since account logins were sold after the 2021 breach.
4. Treat any message about a refund or voucher as suspect until you see it in the app.
5. Remove saved cards you no longer use, and ask for deletion if you stop using Glovo.

How we scored it

Privacy (35) is the weakest factor, because both store labels describe sharing location, contact and order data for advertising. Security (46) reflects the 2021 intrusion and the lack of a paid bug bounty. Scams and harmful content (60) is the strongest, since there is little user content. Regulatory record (44) is low because the €105.7 million EU cartel fine for splitting markets counts in full. For a delivery app with a cleaner record, see Wolt (60).