Gojek

Is Gojek safe to use?

Mostly, yes. Gojek is the app most Indonesians use to book a motorbike, car, food delivery or parcel, and a ride booked in it leaves a record of the driver, plate, route and fare. On data, it is lighter than its rival Grab: Apple's label lists only diagnostics as used to track you, against nine data types for Grab, and we found no privacy fine and no confirmed breach. The catch is breadth. Gojek collects the list of apps on your phone, may run credit checks, and uses your location and contact details for marketing. It also publishes nothing on crashes or assaults during rides. We score it 55/100.

The app is published by PT GoTo Gojek Tokopedia Tbk, the Jakarta-listed group formed when Gojek and the marketplace Tokopedia merged in 2021. It has more than 100 million installs on Google Play and serves Indonesia and Singapore.

What Gojek collects

The Apple label is short where it counts most: only diagnostics may be used to track you across other companies' apps. But the "linked to you" list is long. For Gojek's own advertising it links contact info, identifiers and usage data to you. For analytics it links purchases, financial info, location, contact info, user content, search history and more. For the app to work it also holds your contacts and what Apple calls sensitive info.

Google Play's data safety section is more direct about sharing. It says Gojek may share your email address with other companies for advertising or marketing, and your name, user IDs and phone number for analytics and fraud prevention. It collects precise location for purposes that include advertising, and the list of apps installed on your phone for fraud prevention.

The privacy notice, effective 25 June 2026, fills in the rest. Gojek says it may "periodically collect, process, share and store" installed-apps data, upload your phonebook temporarily to match contacts, and use your data for know-your-customer checks and "credit scoring (if needed)". Identity data can include photos and biometrics. Data is processed inside and outside Indonesia by staff, vendors and affiliates. In its favour, the notice says plainly that Gojek "will not sell or lease" your data, and fingerprint or face unlock stays on your phone.

Security and the 2022 leak claim

We found no confirmed breach of Gojek user data. In August 2022 an account on BreachForums posted what it called a 2022 "Gojek customer database". Gojek's corporate affairs team said its information security staff had investigated, found no leak and called the claim a hoax. The listing was then deleted, so it was never verified either way.

Gojek runs a bug bounty on HackerOne that pays researchers, with a target of a first response within two business days. When we checked in October 2026, the programme was not accepting new reports. Google Play says data is encrypted in transit.

The more common threat is account takeover. In 2024 Gojek warned of a rising trend of fraudulent messages tied to account changes. Scammers pose as Gojek staff or drivers and ask for the one-time code sent by SMS, then change the PIN and drain GoPay.

Motorbike rides and safety data

GoRide puts you on the back of a motorbike in some of the busiest traffic in Asia, which carries more crash risk than a car. Gojek offers the usual ride tools, including driver and plate details and in-app chat, and its notice sets rules for in-car cameras in Singapore. What it does not publish is any count of crashes, assaults or harassment on its rides, of the kind Uber and Lyft have released in the US. That is why scams and harmful content scores 50. The App Store rates the app 4+, although it includes chat with strangers and a payment wallet.

Regulators and Gojek

We found no fine from a privacy or consumer protection regulator in Indonesia or Singapore. Indonesia's personal data protection law, Law No. 27 of 2022, is newer than most of Gojek's history, and we found no enforcement under it against the app.

The one fine we found is procedural. In March 2021 Indonesia's competition regulator KPPU fined Gojek's operator, PT Aplikasi Karya Anak Bangsa, Rp3.3 billion (about $230,000). Gojek had bought most of the ticketing platform Loket.com in August 2017 but only reported the deal in February 2019. Users were not the harmed party, so we treat it as context.

The bigger question is ownership. In November 2025 Indonesia's state secretary confirmed that a merger of GoTo and Grab was under discussion, with the state fund Danantara involved. Parliament members warned that a combined app would control about 90% of the market.

How to use Gojek more safely

1. Set a GoPay PIN and never share a one-time code, even with someone who says they are from Gojek.
2. Deny contacts access unless you use the feature that needs it.
3. Turn off marketing notifications and refuse tracking when iOS asks.
4. Check the plate and driver photo before you get on, and ask for a helmet on GoRide.
5. Report any SMS about a PIN, email or phone change you did not make through the Help page at once.
6. Delete your account in the app if you stop using it.

How we scored it

Regulatory record (84) is the strongest factor: no privacy fine, and the KPPU penalty concerned a late filing. Privacy (45) is the weakest: the tracking label is light, but Gojek shares email for marketing, collects installed apps and may run credit checks. Security (60) reflects no confirmed breach and a paid bug bounty that is closed for now. For the same kind of app in Latin America and China, compare DiDi.