Ninja

Is Ninja safe?

Ninja is reasonably safe for ordering groceries, food and pharmacy items in Saudi Arabia and the Gulf: we found no breach, no fine and no regulator order against it, and you can delete your account inside the app. What pulls the score down is what happens to your data. Apple's privacy label lists your name, phone number, email, address and device identifiers as used to track you across other companies' apps and websites, and the only privacy text Ninja publishes is a short clause inside its terms. We score it 50/100, a little below HungerStation (54) and Jahez (55).

What Ninja is

Ninja launched on the App Store in May 2022 and now has about 1.33 million ratings in Saudi Arabia, more than Jahez and Keeta combined. In late October 2026 it was the top free Food & Drink app on the Saudi App Store and number 20 among all free apps. It started as a quick-commerce service, delivering groceries, household goods, beauty products and pharmacy items from its own stores, and added restaurant delivery in 2024. The App Store description promises deliveries in 30 minutes or less, round the clock, by "our very own riders".

The company was founded in 2022 by Ebrahim Al-Jassim, the founder of HungerStation, with Saud Al Qahtani and Canberk Donmez. In July 2025 it raised US$254 million at a US$1.5 billion valuation in a round led by Riyad Capital, and it serves Saudi Arabia, Kuwait, Bahrain and Qatar. The Saudi store accounts for nearly all its ratings: Kuwait, Bahrain and Qatar each have fewer than 16,000.

What the app tracks

Apple's label is one of the broadest among Gulf delivery apps. Under "Data Used to Track You" it lists contact info (name, email, phone number and physical address), identifiers (user ID and device ID) and usage data, including advertising data. Payment info, precise location, contact info, identifiers and usage data are also linked to you for Ninja's own marketing, analytics, personalisation and app functions.

Google Play's section is narrower but points the same way: app interactions and device IDs are shared with other companies for advertising or marketing.

The privacy policy says none of this. It says the app collects "the customer's name, email, mobile phone number, and address" and promises not to share them "with any third party" except for payments. When the label discloses more than the policy, we score the broader picture, which puts privacy at 35, close to HungerStation (32) and Blinkit (34).

The pharmacy section adds a gap. Ninja's FAQ says prescription medicines need an uploaded prescription that is approved before delivery. A prescription can show your diagnosis and doctor, yet the policy does not mention prescriptions, health data or who reviews them.

A privacy policy that is really the terms

The privacy policy links on the App Store and Google Play open Ninja's terms of use; the English page is titled "Terms and conditions & Privacy Policy". Data takes up one clause. There is no date, no retention period, no mention of Saudi Arabia's Personal Data Protection Law or of your rights under it, and no data protection contact beyond the support email. The clause says sharing is limited to the purposes "specified in Clause Six", which turns out to be the clause on payment methods. The Kuwait page carries the same text.

The FAQ does better than the policy in one place. You can delete your account in the app: My Account, then Edit Profile Information, then the Delete icon. But the same FAQ says account information "can't be updated at the moment" and suggests creating a new account instead. We score transparency and control at 42.

Security

We found no reported breach of Ninja customer data in English or Arabic sources. Login uses a one-time code sent by SMS, WhatsApp or a phone call, Google Play says data is encrypted in transit, and the website loads card fields from Checkout.com's payment frames, so card numbers go to the payment processor. Ninja has no public bug bounty on HackerOne, Bugcrowd or Intigriti that we could find, and no security.txt file. Its terms say the customer accepts "all risks caused by unauthorized access to registration data", including hacking, which says little about Ninja's own duties. We score security at 52.

Regulators and record

We found no fine, order or warning against Ninja from Saudi Arabia's data regulator, the Ministry of Commerce, the food and drug authority or the competition authority. As a young app that no regulator has examined, it sits at 85 for regulatory record, the same as HungerStation and Mrsool. In June 2026 English and Arabic business press reported that Ninja was weighing a bid for Delivery Hero's Gulf assets, including HungerStation. Any deal would need competition approval, but a merger review is not a finding about the app.

Ninja has said it plans to list on the Saudi Exchange. A prospectus would have to disclose fines and material risks, which would give a much fuller public record than exists today.

How to use Ninja more safely

1. On iPhone, tap "Ask App Not to Track" when Ninja asks, or turn tracking off in Settings, Privacy & Security, Tracking.
2. Allow location only while using the app, and type your address instead of sharing it in the background.
3. For prescription medicines, upload only the prescription the order needs, then delete the photo from your phone if you do not need it.
4. Never give a one-time login code to anyone who calls or messages about an order or refund; use in-app support.
5. If you stop using Ninja, delete the account in the app rather than just removing the app.

How we scored it

Regulatory record (85) is Ninja's strongest factor: no fines or orders since 2022, though no regulator has examined the app. Privacy (35) is the weakest, because Apple's label ties your contact details and device IDs to tracking while the policy discloses almost nothing. Transparency and control (42) gains from in-app deletion but loses for a policy that is a single clause of the terms.