Too Good To Go

Is Too Good To Go safe?

Yes. Too Good To Go is safer than most food apps because it does less: you reserve a bag of surplus food, pay, and collect it from the shop yourself. There are no couriers and no chat with strangers. We score it 62/100, a little above Wolt (60) and foodpanda (56). The two things to know are that it shares some data for advertising, and that a 2020 attack got into about 13,000 accounts.

The 2020 account attack

On 8 January 2020 Too Good To Go saw a wave of login attempts that turned into a large botnet attack. Attackers tried about 500,000 email and password pairs, which the company believes came from leaks at other websites, and got into about 13,000 profiles in 12 EU countries and Switzerland. Inside, they could see usernames, email addresses, phone numbers, countries, purchase history and the last four digits of payment cards.

Too Good To Go reported the breach to Denmark's Data Protection Agency two days later. It told the regulator that passwords were individually salted and hashed with bcrypt, that it logged out affected users and emailed them, and that it added automatic IP blocking and a yearly independent security test.

The regulator issued a reprimand in April 2021. It found that by not automatically blocking a known type of attack, the company had not met the security duty in Article 32 of the GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary. In choosing a reprimand, it noted that no sensitive data was involved, that the password storage protected users and that the company stopped the attack quickly.

We found no later breach. Too Good To Go has no paid bug bounty that we could find on HackerOne, Bugcrowd or Intigriti; its security.txt file asks researchers to email [email protected].

What the app knows and shares

Apple's label is short compared with delivery apps. Purchase history, a user ID and a device ID may be used to track you across other companies' apps. Coarse location, email and purchases are linked to you for the company's own marketing. Google Play adds that device IDs and app interactions are shared with other companies for advertising.

The privacy policy (version 2.1, June 2024) explains how. If you accept marketing cookies, Too Good To Go may share your data with advertising platforms to find new users and show you ads elsewhere. It says it does not sell data for money, but it shares data with third parties for targeted ads and gives US users a way to opt out of that. Its US section lists both city-level and precise location among the data used for marketing as well as for finding stores near you. For users in Europe and the UK, the Danish company is the main controller of their data.

The food itself

The risk here is in the bag, not the app. Stores sell food that is near or at its best-before or use-by date, and a Surprise Bag does not list its contents. That matters most for people with allergies. The policy notes that you may tell customer care about an allergy, but the store packs each bag from whatever it has left that day.

There is also a gap on age. The privacy policy says the app is meant for people aged 18 or over, while Apple rates it 4+, so nothing in the store listing stops a child from signing up.

How to use Too Good To Go safely

1. Use a password you use nowhere else. The 2020 attack worked only because people reused passwords leaked from other sites.
2. Decline marketing cookies, and on iPhone tap "Ask App Not to Track".
3. If you have an allergy, contact the store before you collect, and do not eat anything you cannot identify.
4. Put chilled food in the fridge as soon as you get home and eat it before its use-by date.
5. In the US, use the "Do Not Sell or Share" link or turn on Global Privacy Control in your browser.

How we scored it

Regulatory record (82) is the strongest factor: one Danish reprimand with no fine, and no consumer fine we could find. Privacy (52) is the weakest, because purchase history and device IDs can be used for advertising tracking. Security (62) reflects the 2020 account attack and the lack of a bug bounty, balanced by sound password storage. For comparison with a European delivery app, see Deliveroo.