Swiggy

Is Swiggy safe to use?

Swiggy is safe enough to order a meal or groceries in India, but it collects more than it needs and gives you few ways to say no. Card numbers are tokenised by payment providers, and the company pays researchers who find security bugs. Against that, Apple's privacy label lists your location and search history as data used to track you across other companies' apps, the privacy policy says you cannot opt out of advertising on the platform, and in 2022 a fault showed some customers the last four digits of other people's cards. We score it 52/100, a little below Zomato (54) and foodpanda (56).

What Swiggy collects and who gets it

Swiggy's Apple label lists five types of data under "Data Used to Track You": location, search history, identifiers, usage data and diagnostics. Google Play's data safety section goes further on sharing. It says precise location, SMS messages, your name, email, address and phone number, payment info and device IDs may be shared with other companies, the device IDs partly for advertising.

The privacy policy, last updated on 17 April 2026, is broader still. Swiggy may collect your installed apps, phone state, device motion data and advertising identifiers, and it says analytics companies "may use mobile device IDs to track your usage". It shares data with marketing partners and research firms, and reports on its user base with third parties. Restaurants you order from may use your details for their own marketing. A newer clause lets Swiggy pass order details, delivery information and preferences to outside AI providers to run AI features.

On advertising the policy is blunt: "You cannot opt out of advertising on the Platforms." You can only opt out of interest-based ads from outside networks such as Google and Meta, through their own tools. Data sits on Amazon Web Services and may be stored outside India.

Security: tokenised cards, two disclosed incidents

Swiggy's updated draft IPO prospectus, filed in 2024, listed two incidents, as teiss reported. In September 2022, during an infrastructure update, some customers could see the last four digits of other users' cards or parts of their UPI handles. Swiggy reported it to CERT-In, India's computer emergency team. In February 2023 a former employee got into Swiggy's test systems without permission; the company said the access was limited to testing and filed a police complaint. Neither incident is known to have exposed full card numbers or passwords.

The stronger side is outside testing. Swiggy runs its own paid bug bounty, with the Android and iOS apps and about 15 domains in scope, and says it pays the first researcher to report a bug based on how serious it is. Few delivery apps we have scored do that; foodpanda and Deliveroo have no paid programme we could find. The privacy policy says card details are kept in a vault and tokenised by PCI-compliant providers.

Deleting your data is not self-service

Swiggy offers no deletion button in its policy. To withdraw consent or have data deleted you email [email protected], and the policy says the request takes effect within five business days. After that Swiggy may still keep data it needs by law, and anonymised or aggregated data "for as long as necessary". The policy also treats continued use as acceptance of any change, although it promises to ask for consent where the law requires it.

Complaints and the competition case

We found no fine from a privacy or consumer regulator on Swiggy. Three things come close.

• Competition Commission of India. In April 2022 the CCI ordered an investigation of Swiggy and Zomato after a complaint by the National Restaurant Association of India. In 2024 its investigation unit reported that price parity clauses and preferential treatment of some restaurants broke the law, PTI reported, citing sources. We found no final order. The case is about restaurants, not customers, and is still open, so it takes only a few points off.
• Central Consumer Protection Authority. The CCPA opened its own probe into Swiggy and Zomato in October 2024 after complaints to the National Consumer Helpline, Storyboard18 reported in May 2025, citing Moneycontrol. It was looking at cancellation charges of up to 90% of the order value and slow refunds. We found no order yet, so it counts like the CCI case: an open inquiry. Because neither regulator has finished its review, we start Swiggy's regulatory record at 85, not 90, and the two open inquiries take it to 81.
• Consumer commissions. India's district consumer commissions hear single complaints, and Swiggy loses some. On 21 September 2026 a Delhi commission ordered Swiggy and a restaurant to pay ₹1 lakh jointly after a Dineout listing showed "cost for two" as ₹1,500 while the buffet cost ₹1,050 to ₹1,100 a head. It rejected Swiggy's argument that it was only an intermediary. We count these as lawsuits, not regulator orders.

In 2022 the Department of Consumer Affairs said its helpline had logged 3,631 complaints about Swiggy in 12 months, mostly about service and late or wrong deliveries, and asked for a better grievance system. In November 2025 Swiggy was among 26 platforms that told the Central Consumer Protection Authority a self-audit found no dark patterns in its app.

How to use Swiggy more safely

1. On iPhone, tap "Ask App Not to Track", and allow location only while using the app.
2. On Android, check whether the app has SMS access; Google Play lists SMS among data that may be shared.
3. Check the final bill against a Dineout listing before you pay; "cost for two" may not match the menu.
4. Never share a one-time password with anyone who calls about an order or refund. Use the in-app help instead.
5. If you leave, email [email protected] to ask for deletion rather than just removing the app.

How we scored it

Regulatory record (81) is Swiggy's strongest factor: no regulator fine, only open inquiries by the competition and consumer regulators. Privacy (36) is the weakest, because the label and the policy allow wide tracking and sharing and there is no in-app ad opt-out. Security (56) balances a paid bug bounty and tokenised cards against two disclosed incidents. For India's other big shopping app, see Flipkart (55).