CITT

    Scan results

    Deliveroo: Food & Shopping

    Android

    Order food, groceries, and everyday essentials delivered to your door from thousands of restaurants and supermarkets. Track orders live, enjoy fast delivery, and access exclusive member deals with Deliveroo Plus.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Hungry users comfortable with broad data sharing

    Not For: You limit financial data to one payment provider

    What It Means For You

    Orders, location, and behavior are shared with advertising and analytics companies including Facebook, Google Ads, AppsFlyer, Braze, and mParticle. Payment details pass through multiple processors: Adyen, Stripe, Braintree, Checkout.com, and PayPal. Users are profiled for targeted advertising across platforms based on their food ordering habits.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (18)

    Data Security

    6 total
    3 Critical
    2 High
    1 Medium

    Network Security

    1 total
    1 High

    Code Security

    6 total
    1 Critical
    3 High
    2 Medium

    Privacy

    5 total
    1 Critical
    3 High
    1 Medium

    Third-Party Services

    mParticle, Braze, AppsFlyer, Facebook SDK, Firebase, Google Ads, Datadog RUM, Promon SHIELD, OneTrust, Adyen, Stripe, Braintree, Checkout.com, Google Pay, PayPal, Rokt

    Security Strengths

    • ✓Payment tokenization (PCI DSS compliant)
    • ✓HTTPS + mTLS for all API communications
    • ✓Promon SHIELD runtime security SDK
    • ✓Modern Android security defaults (Target SDK 35)
    • ✓Multi-factor authentication support
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    location
    sensitive data
    ads
    social

    Package

    com.deliveroo.orderapp

    Version

    3.258.0 (versionCode: 53710642)

    Analysis Date

    Jan 23, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (3 critical, 2 high, 1 medium)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 5 findings (1 critical, 3 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    Deliveroo collects precise location, order history, device identifiers, in-app browsing behavior, and payment information. This data is used across order fulfillment, personalization, and targeted advertising.

    Third-Party Data Sharing

    Data is shared with a broad range of third-party services:

    • Analytics and advertising: mParticle, Braze, AppsFlyer, Facebook SDK, Google Ads, Firebase
    • Payment processing: Adyen, Stripe, Braintree, Checkout.com, Google Pay, PayPal
    • Performance monitoring: Datadog RUM
    • Security: Promon SHIELD
    • Consent management: OneTrust
    • Commerce: Rokt

    Understanding the Scores

    • Security: 35/100
    • Privacy: 40/100
    • Data Security: 30/100
    • Network Security: 75/100
    • Code Safety: 35/100
    • Data Collection: 45/100
    • Data Sharing: 40/100
    • User Control: 50/100

    Positive Security Features

    • No positive security practices were identified for this version.

    Areas for Improvement

    • Payment data flows through five separate processors, multiplying the number of parties that hold financial details.
    • Location and behavioral data is shared with multiple advertising platforms, with limited controls over how users are profiled across services.
    • Data collection extends well beyond order fulfillment, reaching commerce and advertising partners whose relationship to user orders is indirect.

    About This Analysis

    App Details

    • App: Deliveroo: Food & Shopping
    • Package: com.deliveroo.orderapp
    • Version: 3.258.0 (53710642)
    • Scan Date: 2026-01-23

    Right of Reply

    Developer not yet contacted