Zepto

Is Zepto safe to use?

Zepto is fine for getting groceries in ten or twenty minutes, but it asks for more trust than it earns. Its Apple privacy label lists almost nothing, while Google Play and Zepto's own privacy notice describe sharing your name, phone number and searches for advertising, reading SMS messages on your phone and checking which other apps you use. In December 2025 India's Central Consumer Protection Authority (CCPA) fined it for hiding fees until checkout and pre-selecting a paid membership. We found no breach, but also no bug bounty. We score it 49/100, below its rival Blinkit (53).

What the CCPA found

The CCPA inspected Zepto in January 2025 and issued its order in December, Inc42 reported, citing Mint. It found two of the deceptive designs banned by India's 2023 dark patterns guidelines:

• Drip pricing. Zepto showed a lower price while you shopped and added mandatory charges, such as a handling fee, only at the final checkout step.
• Basket sneaking. Zepto Pass, a paid add-on, was pre-selected without the user's clear consent.

The fine was ₹7 lakh, about US$8,000, and Zepto had 15 days to show that it had fixed the checkout. In a 2026 update to its draft IPO prospectus, Zepto said it paid the penalty but has challenged the order before the National Consumer Disputes Redressal Commission (NCDRC), where the case is pending. The government later told the Rajya Sabha that Zepto had withdrawn the practices. Weeks before the order, Zepto had been among 26 platforms that sent the government letters declaring themselves free of dark patterns.

The fine is small, but it is about how the app treats paying customers, so it lowers both the regulatory record and our transparency score.

Labels that disagree

Apple's label for Zepto is unusually short: one data type, advertising data, used to track you and not linked to your identity. Nothing about your address, phone number or location appears.

Google Play tells a different story. It says Zepto may share your name, email address and phone number, partly for advertising and marketing; your search history and app interactions, also for advertising; device IDs; precise location; purchase history; photos; and your list of installed apps, which it says is for fraud prevention.

The privacy notice, last updated on 17 June 2025, goes further. Zepto says it collects SMS messages stored on your device, for registration, one-time passwords and security. It collects the "list of third-party applications being used by You". It may ask for ID documents such as a PAN card, passport or voter ID, and for income details. It can share personal information with "marketing or advertising partners" and research partners, and with group companies or third parties "located in India or any other country". Data sits on Amazon Web Services servers that may be outside India.

We score privacy on the notice and Google Play, not on the Apple label, which understates both.

Security: no outside testing we could find

We found no confirmed breach of Zepto customer data. But Zepto does not appear to run a public bug bounty: the "zepto" name on HackerOne is an individual researcher's profile, not a company programme, and we found no vulnerability disclosure page or security.txt file on Zepto's websites. Blinkit and Swiggy both pay researchers. Google Play says data is encrypted in transit. The notice promises "reasonable security measures" and says Zepto is not liable for losses from "unauthorised third-party access".

Who should be careful

Zepto's notice has no minimum age. Under-18s may use it if a parent or guardian accepts the terms for them. The App Store rates it 13+, citing infrequent alcohol, tobacco or drug references, and Google Play 3+. A teenager with a parent's saved card or UPI app can order on their own.

In October 2024 the CCPA also reportedly sent Zepto, Blinkit and other quick commerce apps notices, according to Inc42, after complaints about products listed without the manufacturing or expiry dates the Legal Metrology Act requires. We found no order on that yet.

How to use Zepto more safely

1. On Android, open the app's permissions and turn off SMS access; let your phone fill in login codes instead.
2. Untick Zepto Pass and other add-ons at checkout unless you want them, and compare the final total with the shelf prices you saw.
3. On iPhone, tap "Ask App Not to Track"; on both systems, allow location only while using the app.
4. Do not upload ID documents unless a feature you need asks for them.
5. To leave, erase your data in the app under Settings, then Profile.

How we scored it

Regulatory record (80) is Zepto's strongest factor: one small consumer fine, under appeal. Privacy (32) is the weakest, because the notice allows SMS reading, installed-app lists and sharing with ad partners abroad, and the Apple label hides it. Transparency and control (46) is pulled down by the dark patterns finding and that label. For a delivery app with a much fuller set of controls, see Baemin.