Yango

Is Yango safe?

Yango will get you a car, and it has some useful safety tools. The bigger question is where your trips end up. In 2026 the Dutch data protection authority fined the company behind Yango's European service €100 million for sending riders' and drivers' data to Yandex companies in Russia without real protection. Yango's current privacy notice still names those Moscow companies as possible processors. We score Yango 42/100, about level with Yandex Go (40) and DiDi (41), and below Uber (46) and inDrive (54).

Yango is the brand the Yandex group uses for ride-hailing and delivery outside the former Soviet Union. The privacy notice lists about 30 countries, from the UAE, Oman and Pakistan to Peru, Bolivia, Ghana, Côte d'Ivoire, Senegal, Zambia and Angola. It has more than 50 million Google Play downloads. Its largest App Store rating counts are in Côte d'Ivoire (about 183,000), Ghana and Peru.

What the Dutch regulator found

Ridetech International B.V., an Amsterdam company, ran Yango for riders and Yango Pro for drivers in Finland and Norway. The Autoriteit Persoonsgegevens (AP) opened an investigation in December 2023, with the Finnish and Norwegian regulators. Its decision, dated 1 April 2026 and published on 8 May, found that from 23 May 2022 Ridetech passed data to Yandex.Taxi LLC and Yandex LLC in Russia.

Until 27 November 2023 all the data was stored in Russian data centres, encrypted, with the encryption keys also in Russia. After that it was processed at Amazon Web Services in Frankfurt, but pseudonymised and encrypted copies still went to Russia. The AP did not accept that this protected anyone: it found the two Moscow companies must run SORM, the Russian system for state access to data, and that people inside the group could reverse the encryption.

The data included riders' phone numbers, emails, exact locations, trip details, chats, call recordings and payment details, and drivers' licence scans, home addresses and social security numbers. Ridetech was dissolved in October 2025, so the AP fined its parent MLU B.V. €100 million and banned further transfers of Finnish and Norwegian users' data to Russia. It based the fine on the group's turnover, about €12 billion in 2024. MLU told Security.NL the data was stored only in the EU in a form no third party could read, that the app stopped running in both countries in 2025, and that it would appeal. Under Dutch law an objection suspends the fine.

Finland's regulator had already ordered an urgent ban on the transfers on 4 August 2023, to run from 1 September, but suspended it on 30 August.

Where your data goes outside Europe

The AP case covered two European countries, not the Yango markets most users live in. For them, the notice of 6 July 2026 says your data is shared with "affiliates and third parties who provide us with servers, data storage, and other infrastructure facilities" and with affiliates who provide authentication tools. Its list of processing companies, dated 5 June 2026, includes Yandex.Taxi LLC, Yandex LLC, Yandex.Food, Yandex.Lavka and Yandex.Delivery, all in Moscow, along with Dubai, Dutch and Serbian group firms. The notice says law enforcement can get data under the law of the country where the operating company is incorporated. It does not say which countries your data reaches; you have to ask.

What the app collects

Apple's label is as broad as any ride app's we have scored. Seven data types may be used to track you across other companies' apps and websites: purchases, financial info, location, contact info, search history, identifiers and usage data. Contacts, user content, diagnostics and other data are also linked to you. Google Play adds optional voice recordings, photos and videos, files and in-app messages, and says device IDs are shared with other companies for analytics and advertising.

The notice says targeted ads use your advertising ID only with consent, and that a profile photo is used to confirm identity on night-time cash rides by new users. Audio and video recording in the car starts only when a driver presses the conflict button, and both people are told first.

Safety on the ride

Yango's drivers are independent and work under local transport rules, which vary a lot between Lusaka, Lima and Dubai. The app lets you share a trip with a trusted contact, shows the driver's location live, and keeps records of each order. We found no published figures on assaults or crashes. We also found no reported data breach of Yango itself.

How to use Yango more carefully

1. Refuse the tracking prompt on iPhone and reset your advertising ID on Android.
2. Save as few home and work addresses as you can, since the notice names group companies in Moscow among possible processors.
3. Share each night trip with a friend from inside the app.
4. If a local rival with a clearer data story runs in your city, such as Bolt or inDrive, consider using it for sensitive trips.
5. To learn where your data is processed, write to the data protection officer at [email protected] and ask for the list of countries.

How we scored it

Privacy (28) is the weakest factor: a broad tracking label plus Moscow processors that a European regulator found unsafe. Security (50) and transparency and control (50) are the strongest, with no known breach and a notice that names a controller per country. Regulatory record (42) rests on the €100 million fine and transfer ban, which MLU is contesting.