You opened Grubhub because you wanted pad thai, not a seminar on cross-context behavioral advertising. The Privacy Policy is where the company says what happens to your order history, delivery address, and in-app browsing after you tap checkout.
The page opens with a blunt bargain: use the platform, and you agree to collection and disclosure "as described in this Privacy Policy." That includes sharing identifiers, commercial information, and internet usage information with ad partners for behavioral advertising, alongside the restaurant and driver data needed to get food to your door.
This piece summarizes public Grubhub language Clerica monitors. It is not a review of food safety, driver pay, or Grubhub's security program unless those topics appear in the policy itself.
What Grubhub collects when you order
Grubhub Holdings Inc. and its affiliates state that when you create an account, place an order, join a mailing list, or interact with the platform, they collect identifiers (contact details, credentials), commercial information (order history, purchasing tendencies, rewards progress), and internet usage information (browsing and search history on the platform, collected via cookies, pixels, SDKs, and similar tools).
On geolocation, the policy explains approximate location via IP and, when enabled, more precise signals, including use of the Google Maps API for routing-related features.
Grubhub also addresses payment information, inferences about restaurant preferences, audio and video from customer care (including chat transcripts through Zendesk), age for restricted purchases such as alcohol, and education-related identifiers for campus dining programs.
Browse the live policy on Clerica's Grubhub tracker.
Who gets your data
The sharing sections are where delivery economics meet ad tech. Grubhub states that identifiers, commercial information, and internet usage information may be shared with ad networks and other advertising partners for cross-context behavioral advertising:
"We may share this information with ad networks and other advertising partners for the purpose of cross-context behavioral advertising."
Merchants, delivery partners, payment processors, and service providers receive data to fulfill orders. Campus programs may share identifiers with on-campus food providers. Group orders can expose information to other participants you invite.
Grubhub also carves out categories it says are not sold or shared for that kind of advertising:
"We do not sell payment information to third parties or share it with third parties for cross-context behavioral advertising."
And on SMS marketing opt-in:
"Please note that we do not share text messaging originator opt-in data and consent with third parties for marketing or promotional purposes."
Those limits matter, but they sit beside broad sharing language for other buckets.
Corporate transactions (mergers, acquisitions, asset sales) may include transfers of personal information as part of the deal.
A Friday night scenario (anonymized)
Alex orders sushi for three roommates on a shared cart. The policy's group order language means names, items, and delivery details may flow to Grubhub, the restaurant, and the delivery partner to complete the meal.
After the food arrives, Alex scrolls restaurant promos inside the app. Internet usage information and inferences about cuisine preferences feed personalization—and, per the policy, may be shared with advertising partners unless Alex exercises choices described in Section 2.
Alex's approximate location was already in play when they set the address. None of that required a second consent screen labeled "ads." It required the original account relationship.
What you cannot opt out of
You can tune some marketing and advertising choices (see Section 2 and 2.1 of the live policy). You cannot use Grubhub's core marketplace without accepting baseline collection needed to create an account, process payments, route deliveries, and prevent fraud.
The policy frames continued use as agreement to processing described on the page. There is no version of "order anonymously" inside a named account with saved addresses and order history.
Retention language repeats across categories: data may be kept while your account is active, plus additional time Grubhub deems necessary for legal obligations and defense of claims. Closing the app does not, by itself, erase backend records described in the policy.
The clauses that should worry you
Retention tied to litigation, not just dinner: Grubhub repeats that identifiers may be kept while your account is open and afterward for legal obligations and claims. That is a different risk than "they know my last order."
Customer care becomes training data: the policy notes Zendesk records chats and that transcripts may go to other service providers. A complaint about a missing entree can still live in a vendor pipeline.
Campus dining bridges: education identifiers can flow to on-campus food providers so they can message you about meal plans. That is a narrower audience than "the internet," but it is still a second copy of your student identity outside the registrar.
What you can do before you click "Agree"
- Read Section 2.1 on opting out of certain "sales" or cross-context behavioral advertising where Grubhub provides that path, and follow in-app or web controls linked from the policy.
- Limit location permissions at the OS level if you only need manual address entry.
- Add grubhub.com to a Clerica watchlist so future edits to sharing or retention language arrive as diffs, not surprises during a support chat.
FAQ
Does Grubhub sell my payment card number for ads?
The policy states payment information is not sold and is not shared with third parties for cross-context behavioral advertising. Card data still flows to processors to complete orders.
What happens on group orders?
Information may be shared with other participants and with merchants or partners as needed to fulfill the order, as described in the policy's order and disclosure sections.
Can I delete my account and expect instant erasure?
The policy describes retention while an account is open and additional periods for legal obligations and claims. Deletion requests are governed by the rights and processes in Section 2.
Does Grubhub share SMS marketing opt-in lists?
The policy states text-message originator opt-in data and consent are not shared with third parties for marketing or promotional purposes.
Where do California or other state privacy rights appear?
Grubhub's policy includes opt-out and notice mechanisms in Section 2 and supplemental state disclosures linked from the document. Check the live page for the list applicable to you.
Why monitor if I still need delivery?
Because paragraphs about ad sharing and retention change without a push notification. Monitoring does not block ads; it shows you the edit.
The line between convenience and captivity is thin.
If you care about keeping your knowledge private, join us.
Clerica monitors publicly available privacy policies and terms for services you choose to follow. Grubhub and its marks are trademarks of their respective owners. Clerica is not affiliated with or endorsed by Grubhub. Clerica is not a law firm and does not provide legal advice.