App-controlled devices: the privacy questions nobody asks
App-controlled products are the only category here where the thing you buy keeps talking to its manufacturer after you have paid for it. That makes privacy a product feature, and it deserves the same scrutiny as motor strength or battery life.
This category also has a documented history of getting it wrong.
What these devices actually transmit
A connected product typically involves three links, and each is a separate question:
- Device to phone — usually Bluetooth Low Energy. Short range, but not automatically encrypted or authenticated.
- Phone to manufacturer’s servers — where account data, and sometimes usage data, goes.
- Server to a partner’s phone — for long-distance control, routed through the manufacturer.
The second link is the one that matters most, and it is the one least visible to you.
The precedent worth knowing
In 2017 the maker of a well-known connected couples’ product settled a class action in the United States over collecting usage data — including temperature and intensity settings, tied to identifiable accounts — without adequately informing customers. The settlement ran to several million dollars.
Separately, security researchers have repeatedly demonstrated weaknesses in Bluetooth pairing across this product category, including devices that could be discovered and connected to by anyone in range because pairing required no authentication.
We raise this not to single out a brand — the settling company changed its practices — but because it establishes the baseline. This is a category where the failure mode is documented rather than hypothetical, and where “they wouldn’t do that” is not a safe assumption.
What we check on any connected device
- Does it work without the app? Physical buttons that give full function offline are the single best feature here. A product that is inert without a working app has the lifespan of that app, not of its hardware.
- Is an account mandatory? Requiring registration to use a device you own is a choice the manufacturer made, not a technical necessity.
- What does the app request? Location permission is common and almost never genuinely needed — on Android it has historically been required for Bluetooth scanning, which manufacturers rarely explain. Contacts, camera and microphone access deserve a hard look.
- Where is the data held, and for how long? Check the privacy policy for retention periods and whether data is shared with third parties.
- Can you delete your account and data? And is there an actual mechanism, or just an email address?
- Is there a deletion path that survives the company? Small manufacturers get acquired. Your data goes with them.
Practical steps that reduce your exposure
- Use a dedicated email address for the account. It costs nothing and keeps this out of your main identity graph.
- Decline optional analytics during setup. It is almost always opt-out rather than opt-in.
- Turn Bluetooth off when not in use. This closes the discovery window entirely.
- Do not name the device after yourself. Bluetooth device names are broadcast and visible to anyone scanning nearby.
- Check app permissions after updates, not just at install. Permissions get added.
- Prefer local Bluetooth control over cloud control where the app offers both. Long-distance features route through servers; same-room control need not.
The question to ask before buying
What happens to this product when the company stops supporting the app?
Phones update, operating systems drop old Bluetooth APIs, small companies get acquired or fold. A device with physical controls degrades gracefully into a normal product. A device without them becomes a paperweight, often well inside the warranty period.
That is the real cost difference between two products with identical spec sheets, and it never appears on the box.
Where this sits in our scoring
App dependence and offline function are assessed under ergonomics and controls. Where a connected device cannot be operated without an account, we say so prominently, because it changes what you are actually buying.
We do not audit application security or perform penetration testing — we are testers of physical products and will not claim competence we do not have. What we can tell you is what the app demands, whether the hardware works without it, and what the manufacturer commits to in writing.
Nothing here is legal or security advice. Privacy policies and app behaviour change; check current terms before you buy.
