Yogiyo

Is Yogiyo safe?

Yogiyo is a reasonable choice for ordering food in Korea, and on paper it collects less than its two bigger rivals. Its Apple label lists only identifiers as used to track you, its privacy policy is dated and detailed, and you can delete your account inside the app. The weak spot is the chain of delivery companies behind each order: in August 2026 a hack at a subcontractor exposed customers' addresses and the door codes they had left for riders. We score Yogiyo 56/100, a little above Baemin (54) and well above Coupang Eats (47).

Yogiyo has about 862,000 ratings on the Korean App Store. Delivery Hero launched it in 2012 and had to sell it when it bought Baemin, under a condition the Korea Fair Trade Commission (KFTC) set in December 2020. It is now run by Wesang Co., Ltd.

The 2026 subcontractor leak

Yogiyo uses outside delivery companies for its own Yogi Delivery service, and those companies can pass work on again. On 14 August 2026 someone got unauthorised access to the system of Fly, a subcontractor of the delivery firm Barogo. Yogiyo said it learned the details from Barogo on the evening of 24 August and told affected customers on 26 August. The exposed data included delivery addresses, relay phone numbers and the requests customers type for riders, which for many people contain the front-door code of their building.

Yogiyo stopped Barogo from passing its data to Fly, reported the incident to the Personal Information Protection Commission (PIPC) and told customers who had written a door code in a rider note to change it. It also warned about people posing as riders. Neither Yogiyo nor the reports we found gave the number of customers affected, and we found no PIPC decision yet.

The leak did not touch Yogiyo's own servers. But the policy lists five delivery firms, some with their own subcontractors, and restaurants can pass your phone number, address and notes to their own delivery agencies and order-management systems. Each link is another place your address can leak. We found no bug bounty for Yogiyo on HackerOne.

What Yogiyo collects

Apple's label lists identifiers as used to track you, and purchases, contact details and identifiers as linked to you. Location, search and browsing history, user content and usage data are collected but not linked to you. Google Play is broader: it lists device IDs, app interactions and in-app messages as shared with other companies, partly for advertising, and your address as collected partly for marketing.

The privacy policy, in force since 29 May 2026, explains where data goes. Behavioural data and your ad ID go to Moloco, an ad company, for targeted ads. Google Analytics, AppsFlyer and Braze collect app use, device details and purchase and visit history through their software kits. Braze, in the US, also gets your phone number, nickname, age, gender and a masked email to send push messages and analyse behaviour. Yogiyo keeps a phone number, device details, address and ad ID for five years for fraud checks. The policy says you can refuse targeted ads through your browser or phone settings; it describes no in-app switch.

Fines and orders

In June 2020 the KFTC fined Delivery Hero Korea, then Yogiyo's operator, ₩468 million and ordered it to stop a "lowest price guarantee" that barred restaurants from selling more cheaply by phone or on other apps and punished those that did. The restaurants were the harmed party, so it counts at half weight for us. In August 2021 the KFTC had both Yogiyo and Baemin correct unfair clauses in their customer and restaurant terms, without a fine.

An older case is now past our ten-year window. In 2016 the KFTC found that Yogiyo had put restaurants with paid contracts at the top of lists sorted by rating or reviews, and fined six delivery apps a total of ₩17.5 million. Yogiyo changed its sorting during the investigation.

How to use Yogiyo more safely

1. Leave the door code out of the rider note. Use the in-app chat when the rider is on the way, or meet them at the door.
2. If you wrote a door code in a Yogiyo order before September 2026, change it.
3. Use the relay number option so restaurants and riders do not see your real phone number.
4. On iPhone, tap "Ask App Not to Track"; on Android, delete the advertising ID to cut off targeted ads.
5. If you stop using Yogiyo, close the account under My Yogiyo instead of just deleting the app.

How we scored it

Regulatory record (83) is Yogiyo's strongest factor: one small competition fine that harmed restaurants rather than customers, and no privacy fine. Privacy and security (48 each) are the weakest, for ad sharing with Moloco and Braze and for the 2026 subcontractor leak. Transparency and control (66) reflects a dated policy with every past version online and in-app deletion.