What we found
Samsung Bespoke AI Fridge: FYour fridge has a privacy policy, a microphone, and a camera. It also keeps food cold.
SmartThings privacy notice confirms collection of "images recognized as food taken when you open and close the refrigerator door." Camera trained on ~1M food photos. Identifies 37 fresh food types, 50 packaged items. Images captured and transmitted even though "non-food areas are automatically blurred."
Family Hub RF28R7551SR: CYour Samsung fridge has three cameras inside that automatically take photos of your food every time you close the door.
The Family Hub contains three 2-megapixel cameras that automatically photograph fridge contents every time the door closes. SmartThings Privacy Notice confirms collection of "images recognized as food and taken when you open and close the refrigerator door." This automated surveillance happens by default in a kitchen appliance — consumers buying a refrigerator do not expect it to photograph their food and upload images to Samsung's cloud.
Thermomix TM6: CYour Thermomix tracks every recipe you cook, how long you cook it, and how often you use it each week.
The Cookidoo platform collects granular cooking telemetry: recipes started, count of recipes started, cooking duration, recipe IDs, cooked recipes, cooking modes used, and number of sessions per week. This data reveals dietary habits, meal timing, household routines, and lifestyle patterns. The 2025 Rezeptwelt data breach exposed 3.3 million users' cooking preferences, demonstrating that this intimate data is stored in ways that can be compromised. Recipe preferences reveal vegetarian, kosher, halal, and allergen-free dietary patterns — sensitive personal information about religious and health conditions.
Xiaomi Air Purifier 4: CAir purifier that maps your home via WiFi and sends data to Beijing.
The Xiaomi Home app (com.xiaomi.smarthome) manages all Xiaomi IoT devices from a single account — cameras, smart bands, door locks, smart plugs, air purifiers, and more. Air purifier environmental data combined with: Smart Band 8 biometric data (heart rate, sleep, location via spec-086), Mi 360 Camera video feeds (spec-088), and smart plug usage patterns (spec-020) creates an intimate portrait: who is in which room, what they're doing, their health status, and their daily routines. The app's 8 trackers (including ByteDance Pangle and Facebook Analytics) receive behavioral data from interactions with ALL devices, not just the purifier.
Purifier Hot+Cool HP07: CDyson runs a bug bounty program suggesting they take security seriously, but their purifiers communicate over an unencrypted protocol where the login credent...
Dyson operates a HackerOne bug bounty program for security vulnerabilities, yet no public CVEs have been assigned to any Dyson consumer product. The MQTT security weakness (static credentials derivable from device sticker, unencrypted protocol) remains unpatched and publicly documented by multiple security researchers.
Cosori Smart Air Fryer: CChinese-made air fryer that knows your WiFi password, location, and records audio.
The Cosori CS158-AF uses an Espressif ESP8285 Wi-Fi SoC operating on 2.4GHz only. The device has no GPS, no cellular radio, and no location-based functionality. It sits on a kitchen counter and cooks food. There is no technical justification for background location access — the device needs only a Wi-Fi connection to function.
Smart Front Load Washer with ThinQ: CTo control your washing machine, LG's app asks for permission to use your phone's camera, microphone, and contacts — and to track your location even when you...
Layer A (App): LG ThinQ app (com.lgeha.nuts v4.1.28110) requests 39 permissions including CAMERA, RECORD_AUDIO, READ_CONTACTS, WRITE_CONTACTS, ACCESS_BACKGROUND_LOCATION, and ACCESS_FINE_LOCATION. Layer B (Firmware): The LG Smart Washer (WM4000HWA) is a washing machine with a Wi-Fi module (BEJLGSWFAC71) for remote start/stop and cycle monitoring. A washing machine has no camera, no microphone, no reason to access contacts, and no reason to track location in the background. These permissions exist because LG uses one app (com.lgeha.nuts) for ALL products including smart TVs with cameras — so a washing machine inherits TV-grade surveillance permissions.
Dyson Smart Home Platform: BYour Dyson purifier knows the air quality in your bedroom.
Dyson's connected purifiers, humidifiers, and fans collect air quality readings, temperature, humidity, volatile organic compounds, and particulate matter — building a continuous environmental profile of your home. The Dyson Link app pairs this with location data, usage schedules, and device interaction patterns. Combined, Dyson knows: the air quality in each room, when you're home, what rooms you use, your sleeping patterns (bedroom purifier usage), and your neighbourhood's pollution levels. A 2021 Mozilla Privacy Not Included review flagged Dyson for data sharing with third-party analytics and advertising partners. An air purifier that maps your home environment and daily routine.