Privacy Guide for Connected Toys

What connected toys can expose

App-connected toys potentially expose three things: that you own and use the device (account, telemetry), how you use it (patterns, durations, in some cases chat), and who you play with (partner pairing, cam sessions). None of this requires the toy itself - it is all app layer.

The documented incidents

Two incidents shape the baseline: a 2017 breach at Lovense's predecessor exposed customer emails and plaintext passwords, and a 2021 disclosure showed a Lovense API flaw that let third parties pull user emails through the camera feed of the companion ecosystem. Kiiroo's FeelConnect ecosystem had its own data-sharing reporting around the same era. Both vendors tightened policies afterwards - the lesson is not "never buy connected", it is "know which account you attach".

The practical rules

1. Dedicated email, unique password. If the toy account leaks, nothing else of yours is in it.
2. Local beats cloud. HereSphere drives a Handy directly over WiFi and Lovense toys via local bridges; the cloud account is only needed for long-distance features and store purchases.
3. Deny analytics and marketing consent in the app settings - they are opt-out, not opt-in, in most toy apps.
4. Keep firmware updated. The embarrassing years were fixed in updates; a stale firmware is the actual risk.
5. Prefer open bridges. Intiface Central (buttplug.io) is open source, local-only, and increasingly the path players use to reach toys.

Discretion beyond data

Shipping: the major brands (Lovense, Kiiroo, We-Vibe) ship in plain boxes; it is standard, not premium. Noise: vibe-class toys are quiet by design now, strokers are the loud end - check the noise notes in each stroker review. Storage: a lock box answers the shared-apartment question better than any privacy setting.

FAQ

• Can a toy be tracked when off? No radio means no exposure; Bluetooth toys are discoverable only when powered.
• Is Bluetooth toy traffic visible to others? Modern toys use encrypted pairing; a determined attacker still sees "a BLE device exists", not what it does.
• Do cam sites see my toy usage? They see the events that drive the toy (that is the feature); use a cam account with the same dedicated-email discipline.
• Which toys need no account at all? The Handy (local playback), Autoblow (standalone), Arcwave Ion (no electronics beyond motor) - the privacy column in each review documents the level.

[n] Sources: linked project and policy pages above.