Zomato

Is Zomato safe to use?

Zomato is safe enough for ordering food in India, and its security testing is better than most delivery apps'. The privacy picture is weaker. The policy lets Zomato pull in data about you from data brokers and enrichment firms and use it for advertising, and Google Play says your name, email and phone number may be shared for marketing. Its one known breach, in 2017, exposed about 17 million email addresses and salted password hashes. We score it 54/100, just above Swiggy (52), its main rival.

Zomato, Eternal and the other apps

Zomato's listed parent changed its name to Eternal Limited, and the privacy policy is now issued by "Eternal Limited (Formerly known as Zomato Limited)". The app on the App Store is still published by Zomato Media Pvt. Ltd. Eternal also runs Blinkit for quick grocery delivery, District for events and dining out, and Hyperpure for restaurant supplies. The policy allows your data to move between these businesses for a shared login and cross-app features, so an account on one is not walled off from the others.

What the app collects

Apple's label for Zomato is unusual. Only identifiers are listed under "Data Used to Track You", fewer than most delivery apps show. The list of data linked to you is long: health and fitness, financial info, location, contact info, user content, search history, identifiers, usage data and diagnostics.

Google Play describes more sharing. It says your name, email address and phone number may be shared with other companies for advertising or marketing, device IDs for analytics and ads, and your location to run the app.

The privacy policy, updated on 25 July 2025, explains where else data comes from. Zomato may get information about you from business partners, marketing and advertising partners, "data enrichment services, data brokers", analytics firms and other users who upload their contacts. It reserves the right to combine all of it with what it collects directly, to "identify potential new customers" and tailor ads. Third-party ad networks, Google's among them, can use their own tracking inside the app. Opting out of tailored ads stops personalisation, not the ads.

Two other clauses stand out. Zomato records support calls and chats between users, restaurants, riders and staff, and keeps them as long as "reasonably necessary". And it may read which other apps are on your phone, which it says helps with UPI payment links.

Because the policy discloses much more than the Apple tracking section, we score privacy on the policy.

Security: one old breach, strong outside testing

On 18 May 2017 Zomato said about 17 million user records had been stolen. They held email addresses and passwords hashed with several iterations and an individual salt, so they could not easily be turned back into plain text. Zomato said payment data sat in a separate PCI DSS vault and was not taken. It reset the affected passwords, logged users out, and said an employee's development account had been compromised. The breach is now more than nine years old, so it weighs only lightly. We found no confirmed breach of Zomato customers since.

Since then Zomato has leaned on outside testing. Eternal's programme on HackerOne pays bounties, covers Zomato, Blinkit, Hyperpure and District, and lists 1,310 resolved reports. Card data goes to PCI-compliant payment providers.

Reviews, complaints and the CCI case

Zomato is partly a review site, with photos, followers and lists, so fake reviews and spam are part of the picture. Most problems customers report are about service. In 2022 the Department of Consumer Affairs said its helpline had logged 2,828 complaints about Zomato in 12 months, a quarter of them about poor service, and asked for a better grievance system. Consumer commissions sometimes rule against it: on 11 May 2026 a Delhi commission ordered Zomato to pay ₹8,250.61 after it cancelled two of a Zomato Gold member's birthday orders and charged cancellation fees. Zomato did not appear. We treat such awards as lawsuits, not regulator orders.

The regulator case is about restaurants. The Competition Commission of India opened an investigation into Zomato and Swiggy in April 2022, and in 2024 its investigation unit reported that price parity clauses and preferential treatment of some restaurants broke competition law. We found no final order, so it counts as an open inquiry about business partners. India's Central Consumer Protection Authority opened a probe of its own in October 2024 into cancellation charges of up to 90% of the order value and slow refunds on Zomato and Swiggy, Storyboard18 reported, citing Moneycontrol. We found no order from it yet either. Because neither regulator has finished its review, we start Zomato's regulatory record at 85, not 90, and the two open inquiries take it to 81. Eternal's many GST tax demands are tax matters and do not affect the score. In November 2025 Zomato told the Central Consumer Protection Authority that a self-audit found no dark patterns in its app.

How to use Zomato more safely

1. On iPhone, tap "Ask App Not to Track", and give location access only while the app is open.
2. Do not upload your contact book; the policy uses it to find friends and recommendations.
3. Use a unique password, since the 2017 breach showed emails and password hashes can leak.
4. Treat calls or messages about refunds as suspect and use the in-app help instead.
5. If you leave, ask for deletion through "Contact Us" rather than just removing the app.

How we scored it

Regulatory record (81) is the strongest factor: no privacy or consumer fine, though open inquiries by the competition and consumer regulators take a few points off. Privacy (38) is the weakest, because the policy allows broker data and ad-network tracking even though the Apple tracking section is short. Security (62) reflects a paid, active bug bounty against an old breach. For a similar app in Southeast Asia, see foodpanda (56).