CITT

    Scan results

    Wolt Delivery: Food and more

    Android

    Food delivery app connecting users with restaurants and local shops for convenient order placement and delivery service.

    CITT SCORE
    30
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Food delivery users comfortable with broad data sharing

    Not For: You want control over how your data is used

    What It Means For You

    User activity, location, and purchase history are shared with multiple analytics and advertising companies including Facebook and AppsFlyer. Payment data passes through several third-party processors. Users have limited ability to opt out of data collection.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (28)

    Data Security

    5 total
    2 Critical
    2 High
    1 Medium

    Network Security

    5 total
    1 High
    3 Medium
    1 Low

    Code Security

    7 total
    1 Critical
    1 High
    3 Medium
    2 Low

    Privacy

    9 total
    1 Critical
    3 High
    5 Medium

    Third-Party Risk

    2 total
    1 High
    1 Medium

    Third-Party Services

    Firebase Analytics, AppsFlyer, Facebook SDK, Sentry, Iterable, Instabug, DoorDash Telemetry, Stripe, Adyen, Braintree/PayPal, Klarna, VGS, Hyperswitch, Ravelin, Riskified, Google Maps, Firebase Crashlytics, HCaptcha

    Security Strengths

    • ✓HTTPS strictly enforced with cleartext traffic disabled
    • ✓Proper SSL/TLS validation without bypass implementations
    • ✓No SQL injection vulnerabilities (Room ORM with parameterized queries)
    • ✓No command injection vectors
    • ✓Tapjacking protection enabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    food delivery
    location
    financial
    payment processing
    sensitive data
    tracking
    analytics
    third party heavy

    Package

    com.wolt.android

    Version

    25.54.0 (Build 132026540)

    Analysis Date

    Jan 19, 2026

    Classes Analyzed

    69,089

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (2 critical, 2 high, 1 medium)

    Network Security - 5 findings (1 high, 3 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 9 findings (1 critical, 3 high, 5 medium)

    Privacy Concerns

    What Data is Collected

    The app collects precise location, order history, in-app browsing behavior, device identifiers, and payment information. This data is used for order fulfillment, personalized recommendations, fraud detection, and behavioral advertising.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Firebase Analytics - Usage analytics and behavioral tracking
    • AppsFlyer - Marketing attribution and behavioral profiling
    • Facebook SDK - Advertising and social tracking
    • Sentry - Error and crash reporting
    • Iterable - Marketing communications and messaging
    • Instabug - In-app feedback and diagnostics
    • DoorDash Telemetry - Usage telemetry
    • Stripe, Adyen, Braintree/PayPal, Klarna - Payment processing
    • VGS, Hyperswitch - Payment data handling
    • Ravelin, Riskified - Fraud detection and risk scoring
    • Google Maps - Location and mapping
    • Firebase Crashlytics - Crash diagnostics
    • HCaptcha - Bot and fraud detection

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy25/100
    Data Security30/100
    Network Security65/100
    Code Safety60/100
    Data Collection30/100
    Data Sharing35/100
    User Control20/100

    Positive Security Features

    • No notable positive security features were identified in this version of the app.

    Areas for Improvement

    • Behavioral and location data is distributed across a large number of advertising and analytics companies, with little visibility into how user profiles are built and monetized.
    • Payment information is handled by multiple third-party processors, expanding the number of parties with access to financial data.
    • The app offers minimal controls for limiting data collection or opting out of tracking, leaving users with very little ability to manage their own data.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed behaviors and data practices at the time of the scan.

    App Details

    • Package: com.wolt.android
    • Version: 25.54.0 (Build 132026540)
    • Scan Date: 2026-01-19

    Right of Reply

    Developer not yet contacted