Ranking
Safest Ride-Hailing and Delivery Apps 2026
Every ride-hailing, food delivery and quick grocery app we cover, from Uber, Lyft, Bolt and DiDi to DoorDash, Deliveroo, talabat, Swiggy and Meituan. Each score weighs how much the app collects and shares for advertising, its breaches and account security, the controls it gives you, safety on trips and scams on the platform, and its record with privacy and consumer regulators.
Updated · Scores update with each page
The ranking
Wolt
Wolt is one of the safer delivery apps we cover. We found no breach of its own systems and it runs a paid bug bounty, but its Google Play listing shares purchase history and email for advertising, and regulators in Hungary, Georgia and Denmark have acted against it.
Score 60, grade CBolt
Bolt, the Estonian ride-hailing app, collects less for advertising than its American rivals, and we found no breach of rider data or large fine. It offers pickup codes, trip sharing and an emergency button, but it publishes no figures on assaults or other incidents, so riders cannot check how safe its trips are.
Score 59, grade CJust Eat
Just Eat, Lieferando, Thuisbezorgd and Takeaway.com share one owner, one privacy policy and a fair safety record. The group pays a bug bounty and we found no fines, but Apple's labels list order and location data as used to track you, and the UK's CMA is examining Just Eat's star ratings.
Score 58, grade Cfoodpanda
foodpanda is a fair choice for ordering food in Asia, but not a private one. Apple's label lists precise location, search history and device IDs as used to track you, it runs no public bug bounty we could find, and Singapore's consumer watchdog made it refund subscribers over a "free delivery" ad.
Score 56, grade CYogiyo
Yogiyo, Korea's third delivery app, is a reasonable choice with a clear policy and a lighter tracking label than Baemin or Coupang Eats. Its weak point is the delivery chain. In August 2026 a hack at a delivery subcontractor exposed customers' addresses and the door codes they had typed for riders.
Score 56, grade CDeliveroo
Deliveroo is reasonably safe for your account and card, but not private. Its Apple label lists purchase history, contact details and location as data used to track you, and Italy's privacy regulator fined it €2.5 million in 2021 for how it monitored its riders.
Score 55, grade CFREENOW
FREENOW is a reasonable way to book a taxi in Europe, with no privacy fines or breaches we could find and a privacy notice that sets clear deletion periods. Its Apple label is one of the broadest among ride apps, though, and since Lyft bought it in 2025 your data is also shared with Lyft in the US.
Score 55, grade CGojek
Gojek, Indonesia's ride, food and payments super app, has a lighter tracking label than Grab and no privacy fine. It still collects a wide set of data, including the list of apps on your phone, and publishes no rider safety figures.
Score 55, grade CJahez
Jahez, the Saudi-listed delivery app, has no breach or privacy fine on record and a light tracking label. Its weak point is paperwork. The policies its store pages link to describe other apps, and the current one sits on the group's investor website.
Score 55, grade CBaemin
Baemin (Baedal Minjok) is a fair choice for food delivery in Korea, with clearer privacy controls than most delivery apps. The weak points are ad tracking, a 2026 leak of a customer's address by a planted call-centre worker, and a pending competition case that could bring a large fine.
Score 54, grade DHungerStation
HungerStation, Saudi Arabia's oldest big delivery app, has a clean record with regulators and a detailed privacy policy written for Saudi law. Its weak point is tracking. Apple's label lists nine kinds of data, including your location and payment details, as used to track you across other companies' apps.
Score 54, grade DinDrive
inDrive, the ride app where passengers offer their own fare, has a clean regulatory record on privacy and a paid bug bounty. Its Google Play listing declares far more data sharing than its Apple label, and it publishes almost no figures on how safe its rides are.
Score 54, grade DZomato
Zomato is a fair choice for ordering food in India, with stronger security testing than most delivery apps. Privacy is the weak point: the policy allows data from brokers and enrichment firms to be combined with yours for advertising, and deleting your account means contacting support.
Score 54, grade DBlinkit
Blinkit is a reasonable way to get groceries delivered fast in India, with paid security testing shared with Zomato. Privacy is the weak point. Apple's label lists your precise location, address and searches for third-party advertising, and the policy lets Blinkit read which other apps you have installed.
Score 53, grade DKeeta
Keeta, Meituan's delivery app for Hong Kong, the Gulf and Brazil, has no breach or fine on record and a clear, dated privacy policy. Brazil's consumer secretariat has a pending sanction case over its fees, and Apple's label lists your contact details and device identifiers as used to track you.
Score 53, grade DMrsool
Mrsool, Saudi Arabia's "order anything" app, has a clean record and a clear Saudi-law privacy policy with fixed retention periods. The risks come from its model. Freelance couriers bid on your order, chat with you and often handle cash, and Apple's label lists your contact details as used to track you.
Score 53, grade DDiDi Rider
DiDi Rider, DiDi's app for Mexico, Latin America, Australia and New Zealand, carries none of the Chinese data fine, but it shares device IDs for advertising, records in-app calls and messages, and was fined in New South Wales for weak driver checks.
Score 52, grade DLyft
Lyft has a cleaner data record than Uber, with no large breach we could find, and good in-ride tools such as PIN checks and recording. Its privacy label lists more data used to track you than most ride apps, and its only safety report dates from 2021.
Score 52, grade DSwiggy
Swiggy is a reasonable way to order food and groceries in India, but a poor choice for privacy. Apple's label lists your location and searches as used to track you, the policy says you cannot opt out of ads on the platform, and deleting your data means emailing support.
Score 52, grade Dtalabat
talabat works for ordering food and groceries in the Gulf, but it is not a private app and its record with consumer regulators is weak. Apple's label lists your location and contact details as used to track you, its privacy policy is undated and out of date, and Qatar suspended it for a week in 2025.
Score 51, grade DNinja
Ninja, the top Food & Drink app on the Saudi App Store, has no breach, fine or regulator order and lets you delete your account in the app. Its weak points are tracking and paperwork. Apple's label lists your contact details and device IDs as used to track you, and the only privacy text is one clause in the terms.
Score 50, grade DUber Eats
Uber Eats is fine for ordering food, but it is not a private app. Apple's label lists purchases, contact details and searches as used to track you, Google Play says the same data is shared for advertising, and the FTC and 21 states are suing Uber over its Uber One subscription.
Score 50, grade DCareem
Careem, the Dubai-based everything app for rides, food, groceries and payments, has a clean regulatory record. A 2018 breach hit 14 million riders, and it shares contact, location and device data for advertising on and off the app.
Score 49, grade DInstacart
Instacart is reasonably safe for your card and account, but weak on privacy and honesty about costs. It shares contact and order data for advertising, and in 2025 it agreed to pay $60 million in refunds to settle FTC charges over "free delivery" claims and subscription sign-ups.
Score 49, grade DZepto
Zepto works for fast grocery delivery in India, but it is one of the weaker delivery apps for privacy. Its Apple label lists almost nothing, while Google Play and the policy describe sharing your contact details and searches for ads and reading SMS messages. India's consumer authority fined it in 2025 for hidden fees.
Score 49, grade D99
99, DiDi's ride and delivery app in Brazil, has strong safety tools such as automatic trip audio recording, but its privacy policy allows transfers to group companies in China, and consumer regulators in São Paulo and Rio have fined it twice.
Score 48, grade DiFood
iFood, Brazil's dominant food delivery app, confirmed in June 2026 that names and CPF numbers of about 1.2 million customers leaked in December 2025, without telling users first. Consumer authorities have fined it five times since 2020, and a federal fee case and a state prosecutor's suit are open.
Score 48, grade DCoupang Eats
Coupang Eats, Korea's second-largest delivery app, works well but sits on the Coupang account and privacy policy behind the country's biggest data breach. It shares app activity with ad partners, was fined in 2024 for leaking couriers' data, and faces two pending competition cases.
Score 47, grade DGrab
Grab is a mainstream, regulated ride and delivery app across Southeast Asia, but it collects a lot for advertising. Singapore's privacy regulator fined it three times for exposing user data, and competition authorities fined it over higher fares after it bought Uber's regional business.
Score 47, grade DGlovo
Glovo works for ordering food and groceries, but it is weaker than most rivals on privacy and security. Apple's label lists location, contact details and purchases as used to track you, attackers got in through an old admin panel in 2021, and it has been fined over riders and a cartel.
Score 46, grade DMaxim
Maxim, a cheap ride and delivery app that is big in Indonesia and Central Asia, has no privacy fine on record, but its store labels understate its own privacy policy, which names no company and lets it move data to any country.
Score 46, grade DUber
Almost every Uber trip ends without a safety report, and the app's trip-sharing and PIN tools help. Its data record is weak, though, from paying hackers to hide a 2016 breach to a €290 million Dutch GDPR fine in 2024, and thousands of passengers have sued over sexual assaults by drivers.
Score 46, grade DEle.me (Taobao Shangou, 淘宝闪购)
Ele.me, renamed Taobao Shangou in December 2025, is Alibaba's delivery app in China. Paying through it is routine, but China fined it RMB 558 million in April 2026 after 6,329 shops on it had no valid food licence, and it can query telecom operators for scores built from your behaviour.
Score 44, grade DMeituan (美团)
Meituan is China's main app for food delivery, hotels and local services. Ordering is routine, but its record is heavy, with market-regulator fines of RMB 3.44 billion in 2021 and about RMB 746 million in 2026 over unlicensed "ghost" food shops, plus collection of your installed-app list and Wi-Fi data.
Score 43, grade DDoorDash
Ordering on DoorDash is low-risk for your money, but not for your data. The company has disclosed three breaches since 2019, its app shares location and purchases for advertising, and regulators in California and New York penalised it over data sales and Dashers' tips.
Score 42, grade DYango
Yango is the Yandex group's ride and delivery app for Africa, the Gulf, Latin America and South Asia. Rides work, but its tracking label is among the broadest we have seen, and a European regulator found that user data reached Yandex companies in Russia without real protection.
Score 42, grade DDiDi
DiDi is China's best-known ride-hailing app and works for most trips, but its maker paid the largest privacy fine of any ride app we score. China's internet regulator found it had illegally collected or processed 64.7 billion pieces of personal data over seven years.
Score 41, grade DGrubhub
Grubhub works for ordering food, but its record on data and honesty with customers is weak. It disclosed breaches in February 2025 and January 2026, its app tracks location and purchases for advertising, and the FTC and Illinois took $25 million over hidden fees, locked accounts and restaurants listed without consent.
Score 40, grade DYandex Go
Yandex Go works as a ride and delivery app and runs a real bug bounty, but your trips sit within reach of Russia's security service. Its App Store label is among the broadest we have seen, and Estonia and Latvia blocked it in 2022 over data held in Russia.
Score 40, grade D
Which apps are on this list
The rule is what the app does. An app is here when its main job is to book you a ride with a driver or to bring food, groceries or other orders to your door. That covers ride apps such as Uber, Lyft, Bolt, FREENOW, inDrive, DiDi and Yandex Go; delivery apps such as DoorDash, Uber Eats, Deliveroo, Wolt, Just Eat and talabat; quick grocery apps such as Instacart, Blinkit and Zepto; and super apps that do both, such as Grab, Gojek, Careem and Meituan.
E-scooter and bike rental apps such as Lime and Voi are left out, because you ride them yourself. So are Too Good To Go, where you collect the food, and maps, booking and travel apps from the same group.
How the order is built
Each app is scored on five factors. Privacy and security count for 30% each: what the app collects and shares with advertisers, and how well it protects accounts, cards and stored data. Transparency and control count for 15%. Scams and harmful content count for 15%, and for these apps that covers safety on trips, such as assault reports and driver checks, as well as fraud. The regulatory record counts for 10%. Full rubrics are on how we score apps.
The list is those scores sorted from the highest down. When we update a page, its place here moves too, so this text does not quote scores.
What the apps near the top have in common
No app in this group scores high. They all need your location, address, phone number and card to work, and most also use your orders for advertising. The apps near the top keep that tracking narrower and have no breach or large fine against them. Bolt's Apple label lists only identifiers as used to track you, and Wolt and Just Eat pay outside researchers to find security bugs.
Why some score lower
Three things pull an app down: a breach, a large fine and data that reaches a government with broad access to it. Grubhub disclosed breaches in February 2025 and January 2026, and DoorDash has disclosed three since 2019. China fined DiDi RMB 8.026 billion in 2022 for illegal data collection, and the Chinese delivery apps Meituan and Ele.me were fined over unlicensed food shops. Yandex Go and Yango lose points because user data reaches Yandex companies in Russia.
What the score does not tell you
The score rates the app, not the driver who picks you up or the restaurant that cooks your food. Few ride apps publish figures on assaults or other incidents. The latest US safety report from Uber that we could confirm covers 2019 and 2020, Lyft's only one covers 2017 to 2019, and Bolt and inDrive publish almost nothing, so nobody can compare how safe their trips really are. Before a late-night ride, share your trip with a friend, sit in the back, and keep your phone with you rather than in a bag in the boot.
Questions
Is Uber or Lyft safer?
On trips, the two are close. Both offer PIN checks and trip sharing, and Lyft's Ride Recording can capture audio and video during a trip. On data, Lyft has the cleaner record, with no large breach we could find, while Uber hid a 2016 breach of about 57 million people and was fined €290 million in the Netherlands in 2024. Lyft's privacy label lists more tracking data, though.
How do I make sure I get into the right car?
Match the plate, the car model and the driver's photo in the app before you open the door, and ask the driver to say your name rather than offering it yourself. Use the PIN or pickup code where the app has one, as Uber, Lyft and Bolt do. If anything does not match, cancel and report it in the app.
Do delivery apps sell my data?
Most share it for advertising. Apple's labels for Deliveroo, Uber Eats and Glovo list purchases or location as used to track you across other companies' apps, and Wolt's Google Play listing says it shares purchase history and email. California and New York penalised DoorDash, in part over the sale of customer data. Check the app's privacy settings for an advertising opt-out.
Are Chinese and Russian ride apps safe to use?
The trips work, but your data goes further. China's internet regulator found DiDi had illegally collected or processed 64.7 billion pieces of personal data over seven years, and 99, DiDi's app in Brazil, allows transfers to group companies in China. Regulators in Georgia and the Netherlands fined the Yandex group, which runs Yandex Go and Yango, for sending user data to Russia.
Can I trust the price a delivery app shows me?
Check the total at checkout, not the menu price. In 2025 Instacart agreed to pay $60 million in refunds to settle FTC charges over "free delivery" claims and subscription sign-ups, and the FTC and Illinois took $25 million from Grubhub over hidden fees. Look for service fees, small-order fees and paid memberships you did not mean to start.
Why do some delivery apps share my data with other apps?
Because many belong to groups that share one privacy policy. Zomato's policy lets its owner, Eternal, share your data with Blinkit and its other apps, Just Eat shares one policy with Lieferando and Takeaway.com, and Baemin sends delivery addresses, including building door codes, to Delivery Hero SE in Germany and the US. Read whose policy you are agreeing to before you sign up.