Ibotta

Is Ibotta safe?

Ibotta is one of the more established money-back apps: a listed company with audited security, a bug bounty that has run since 2017 and a delete button inside the app. What it asks in return is a detailed picture of your shopping. Purchase history and location are used to track you across other companies' apps, and if you link store loyalty accounts, Ibotta stores the logins and pulls in everything you buy there. We score it 54/100, above Fetch at 48.

You add offers before you shop, then prove the purchase by uploading a receipt, linking a loyalty card or buying through the app. Ibotta's 2025 annual report counts 18.2 million redeemers across its network, but only about 1.6 million used Ibotta's own app or website. Most use Ibotta-powered offers inside retailer apps such as Walmart, Dollar General and Instacart, where Ibotta runs the program without its name on it.

What Ibotta knows about your shopping

The privacy policy, effective 9 September 2026, is longer and more specific than most. Beyond receipts, Ibotta may collect:

• usernames, passwords and account numbers for the loyalty and retailer programs you link, with the items, prices, stores and times from those accounts;
• your payment method, including whether you paid with SNAP benefits through an EBT card;
• precise location when the app is open or running in the background, if you allow it;
• data from ad networks, social networks, retailers and "consumer data brokers and resellers", combined with what it holds.

Apple's label is just as plain. Purchase history, precise and coarse location, email address, name, device ID, product interaction and advertising data are all used to track you. The policy says some disclosures may count as a sale and that ad partners can use your data to create identifiers such as Unified ID 2.0 for their own advertising. Ibotta also warns that receipts for over-the-counterOver-the-counterA medicine you can buy without a prescription, in a pharmacy or shop, with directions on the pack for safe use without a doctor.More in the glossary medicines count as consumer health data.

There is a real opt-out. Ibotta honours Global Privacy Control signals as a request not to sell or target, and anyone can ask for access or deletion regardless of state.

How secure is Ibotta?

Better than most rewards apps we have scored. Ibotta's Bugcrowd programme started in February 2017 and lists all Ibotta domains as in scope, including the browser extension and loyalty-card linking. The 2025 10-K says Ibotta has annual SOC 2 assessments and penetration tests and has had no cybersecurity incident that materially affected the business. We found no reported breach.

Account protection is ordinary. You sign in with an email and password, and Ibotta asks you to verify your phone by text before you can withdraw money; there is no authenticator-app option. The bigger exposure is the loyalty passwords it stores for you. If you reuse a password across your supermarket account and your email, Ibotta now holds a copy of it.

Payout rules and locked accounts

Most complaints about cash-back apps are about money not arriving. Ibotta's help pages set the rules out clearly: new users need $20, one redeemed offer, seven days after that first redemption and a verified phone number before the first withdrawal. Accounts can be locked for review when too many people sign in from one device or too many receipts are rejected. Deleting your account erases pending cash back, so withdraw first.

Scam and harmful-content risk is low. There is no feed or chat, and Apple rates the app 18+ because some offers are for alcohol, which matches the 18+ age rule in Ibotta's terms.

How to use Ibotta more safely

1. Upload receipts for single offers instead of linking loyalty accounts, unless you are comfortable sharing your full history with that store.
2. If you do link an account, give it a unique password that you use nowhere else.
3. Choose "Ask App Not to Track" and set location to "While Using" or off.
4. Opt out of sale and targeted advertising in Ibotta's privacy centre, or turn on Global Privacy Control in your browser.
5. Withdraw your balance before deleting the account.

How we scored it

Privacy (30) is the weakest factor, pulled down by cross-app tracking of purchases and location, stored loyalty logins and sale disclosures. Security (60) gains from the long-running bug bounty and audits, and transparency and control (55) from in-app deletion and Global Privacy Control. Regulatory record (88) is the highest, with no regulator action found in more than a decade. For a receipt app that also reads email, see Fetch.