Yandex Go

Is Yandex Go safe?

As a way to order a car or a meal, it works. As a place to leave a record of where you go, it is a poor choice for anyone who would worry about Russia's state seeing that record. Yandex Go scores 40/100, about the same as DiDi and below Uber. Privacy is the weakest part of the score.

The app is huge in its home market, with about 7.8 million ratings on the Russian App Store and more than 100 million Google Play downloads. It also serves Kazakhstan, Uzbekistan, Kyrgyzstan, Georgia, Armenia, Serbia, Moldova and Türkiye. The App Store lists the seller as Mikromobilnost doo, a Belgrade company. Each country has its own local Yandex company as data controller.

Who can see your rides

Meduza reported in August 2023 that a Russian government order signed by Prime Minister Mikhail Mishustin would give the FSB, Russia's security service, round-the-clock access to Yandex Go's ride data from 1 September 2023. Before that, Russian companies had to hand over data only on formal request. According to Meduza, Yandex as a whole received more than 15,000 such requests in the first half of 2019 and met 84% of them. Russian users of Yandex Go fall under Yandex's general privacy policy. It says Yandex gives data to law enforcement, government bodies and courts when the law obliges it to.

For users outside Russia the question is where the data goes. The international privacy notice says affiliates supply "servers, data storage, and other infrastructure facilities". It links to a list of companies that may process your data, published on 7 November 2025. That list includes Yandex.Taxi, Yandex.Food, Yandex.Delivery and Yandex.Cloud, all registered in Moscow, as well as companies in Dubai and Belgrade. The notice says not every listed company handles every user's data. It also says law enforcement may get data under the law of the country where "our entity providing a service to you is incorporated".

Yandex has denied that foreign users' data reaches the FSB. In 2023 it said its apps in EU countries were run by a Dutch company that follows the GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary. Regulators have not always accepted that answer, as the next sections show.

What the app collects

Apple's privacy label is as broad as any ride app's we have scored. Seven data types may be used to track you across other companies' apps and websites: purchases, financial info, location, contact info, search history, identifiers and usage data. Contacts, user content, diagnostics and other data are also linked to you. The listing says the app may use your location even when it is not open.

Google Play adds voice recordings, photos and videos, in-app messages and files. Device IDs are shared with other companies for analytics and advertising. The notice confirms that advertising and device identifiers go to ad and analytics firms, and that ads are targeted with consent. It also lists a selfie for some night-time cash rides by new users, and audio and video recording in the car when a driver presses the conflict button. Both people are told before recording starts.

The 2022 Yandex Food leak

On 1 March 2022 Yandex said the names, phone numbers, emails, delivery addresses and six months of order totals of Yandex Food customers had leaked online. Food delivery is one of the services inside Yandex Go. Yandex first blamed an employee. In December 2022 its security chief said attackers had entered through outside hosting that still ran virtual servers inherited from FoodFox, Yandex Food's predecessor. Bellingcat used the leaked orders to identify members of Russia's security services and military. A Moscow magistrate fined Yandex.Food 60,000 rubles in April 2022. Roskomnadzor then took a second case to court over couriers' data from the same leak, and Habr reported a second 60,000-ruble fine that August.

Yandex runs its own paid bug bounty. Taxi and Food are named as key services, where remote code execution pays up to 1,200,000 rubles. Yandex ID, the account system the app uses, offers one-time-password login through the Yandex Key app. Those are real strengths, but they do not change what the state may access.

Regulators outside Russia

Two EU countries have already shut the app out. On 21 March 2022 Latvia's Road Transport Administration cancelled the registration of Yandex Taxi B.V. and ordered Yandex Go blocked, after finding that the app exchanged data with servers in Russia, so that data on rides and payments in Latvia was possibly processed and stored there. Estonia followed: its government approved a ban at the end of March, and from 11 April 2022 Yandex could no longer offer ride-hailing there, app stores had to stop offering Yandex Go and internet providers had to block it. Ministers said the app required personal data that would be held in Russia, where the FSB could reach it. Yandex called the Estonian ban unreasonable, said its Dutch company followed the GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary, and said it would contest it.

In September 2024 Georgia's Personal Data Protection Service fined Ridetech Georgia, the company behind Yandex Go and the Yandex Pro driver app there, ₾4,000 (about $1,500). It found that both apps sent users' IP addresses to servers in Russia during a connection check. It ordered the transfers to stop and noted that it had already refused the company permission to transfer data to Russia. Ridetech said it would appeal.

In October 2026 Moldova's government opened a review of whether Yandex Go sends citizens' data to Russia, after an RFE/RL investigation. The Netherlands went further against the group's European arm. In May 2026 the Dutch data protection authority fined MLU B.V. €100 million for sending Yango customer and driver data from Norway and Finland to Russia. Yango is a separate app, so that fine is context here, and MLU is appealing.

How to use Yandex Go more carefully

1. Assume a trip log could be read by Russian authorities. Do not use the app for trips you would not want on record.
2. Refuse tracking when the iPhone prompt appears.
3. Avoid saving home and work addresses in the app, since each saved place adds to the record.
4. Use a local competitor such as Bolt or inDrive where one runs.
5. Turn on one-time-password login in Yandex ID if your account uses it.

How we scored it

Privacy (25) is the weakest factor because of the broad tracking label and the FSB's access to ride data. Security (48) is the strongest, level with scams and harmful content, and balances the 2022 leak against a paid bug bounty and one-time-password login. Regulatory record (45) rests on the 2022 blocks in Latvia and Estonia, Georgia's fine and transfer order, and the 2022 Yandex Food fine, with Moldova's open review and the Dutch Yango fine as context.