Klook

Is Klook safe?

Klook is a reasonable place to book a day tour, a theme-park ticket or a rail pass. We found no fine or regulator order against it in twelve years of trading. The concerns are about data. Apple's privacy label shows that the app tracks what you buy across other companies' apps and websites and links your precise location to you. In 2018 malicious code on Klook's website may have captured card details from customers for six months. We score Klook 56/100.

What the app tracks

Klook's label is broader than most booking apps'. Three types of data are listed as used to track you across other companies' apps and websites: purchases, identifiers and usage data. Agoda and GetYourGuide list identifiers only. Linked to your identity are payment info, name, email, phone and address, photos or videos, search history and both precise and coarse location. Location is used not only to make the app work but also for Klook's own advertising and personalisation.

The privacy policy, dated 29 July 2026, confirms the picture. Klook shares advertising identifiers, device information and IP addresses with ad partners, and it says that counts as "selling" and "sharing" under California law. It runs targeted ads through social media platforms using data it holds about you. Data may be stored outside your home country in places with "different data protection standards", but the policy does not name them. Klook told US investors that its data centres are mainly in Singapore.

Some collection comes with the product. A rail pass or airport transfer can require passport details. Klook also collects children's names and dates of birth when parents book for them, which the policy limits to what the booking needs.

The 2018 card-skimming attack

In late June 2018 Klook told customers that some personal data, possibly including card details, might have been taken from bookings made on its website between 11 December 2017 and 13 June 2018. The cause was a line of malicious code inside JavaScript supplied by SOCIAPlus, a third-party analytics firm. Klook estimated that about 8% of users were affected. It said bookings made in the iOS and Android apps were not. It removed all of the vendor's code, brought in the forensic firm Kroll and notified regulators.

That kind of attack, often called web skimming, reads card numbers as they are typed, so it gets around a site's own encryption. It is the biggest mark against Klook's security. Since then the company says it has gained ISO 27001 certification and tokenises card data so it never stores card numbers itself. We found no public bug bounty on HackerOne or Bugcrowd, and no later breach.

Who runs Klook

Klook started in Hong Kong in 2014 and sells mostly in Asia: its prospectus says 86.6% of the value booked in 2024 came from users in the Asia-Pacific region. It filed to list on the New York Stock Exchange in November 2025. On 16 October 2026 it withdrew the filing, saying it did not intend to go ahead with the offering for now.

That prospectus is the most detailed public account of the company. It says Klook was not party to any material pending legal proceedings. It also explains that the mainland China business runs through a Beijing company Klook controls by contract rather than owns. That is a common structure for foreign-listed firms in China, and it means the China arm sits under Chinese data laws. For a traveller booking a tour in Tokyo or Bangkok, the relevant fact is the Hong Kong publisher and the Singapore data centres.

Scams and refunds

Klook has little user content beyond reviews, about 13 million of them according to the company. We found no police or consumer-agency warning about scams run through Klook itself, unlike the hotel-chat phishing that troubles Booking.com. The realistic risks are look-alike websites using Klook's name, and messages claiming a booking failed that ask you to pay again through a link. Real Klook bookings are paid inside the app or on klook.com. Refunds depend on each listing's own cancellation rule, and many cheap tickets cannot be refunded.

How to use Klook more safely

1. Book in the app or by typing klook.com yourself, not through links in ads or messages.
2. Set location access for Klook to "While Using" or "Never", and turn off precise location.
3. Tap "Ask App Not to Track" on an iPhone when the app asks.
4. Read the cancellation rule on the listing before you pay; non-refundable tickets are common.
5. Pay by credit card, which gives you a chargeback route if an operator fails to show up.

How we scored it

The regulatory record (86) is the strongest factor: no fine or order, though no large regulator has examined the app in public either. Privacy (42) is the weakest, because the label lists purchases as tracking data and links precise location to you for advertising. Security (55) still carries the 2018 skimming attack. Agoda scores 52, as does Trip.com.