Roborock's privacy policy says the camera is just for scanning QR codes. In reality, the vacuum has an always-on camera that photographs your home's interior every time it cleans — and the privacy policy never mentions this.
critical
Roborock says your data is stored in different countries depending on where you live, but your home's floor plans and cleaning data are sent to Chinese companies Tencent and Xiaomi. Chinese law can force these companies to hand over your data to the government — and Roborock doesn't clearly explain which of your data ends up in China.
high
Roborock says camera images never leave your vacuum, but the device has built-in connections to Facebook, Google Analytics, and Xiaomi cloud servers. Even if camera images stay local, other data about your home and usage flows to these companies.
Roborock says the camera on your vacuum only identifies obstacles on the floor and processes images locally. But the app has camera AND microphone access, plus sends data to Facebook and Google analytics. Your vacuum has a camera rolling across your home — and the app is wired to share data with advertising companies.
critical
Roborock claims your home maps and camera footage stay on the device and are not sent to external servers. Their own privacy policy says the opposite: your maps, home environment data, and device logs are stored on Tencent Cloud in Beijing, China. In 2025, they quietly changed their policy to admit data is processed in China.
high
The app for your robot vacuum cleaner requests microphone access, precise GPS location, and has Facebook tracking built in. It also includes advertising tools that build a profile of you for targeted ads. None of this is needed to clean your floors.
Your Roborock maps your home with LiDAR — centimetre-accurate floor plans showing every room, every piece of furniture, every doorway. That map goes to the cloud. Roborock is headquartered in Beijing. China's National Intelligence Law means the Chinese government can legally compel Roborock to hand over any data it holds. Roborock has moved some servers to AWS and Europe — but the company's legal obligation to Beijing doesn't change based on where the server sits. A detailed floor plan of your home, held by a company legally answerable to Chinese intelligence.
high
Your robot vacuum knows the layout of your home, what's on your floors, when you're home and when you aren't, and your Wi-Fi network details. The app asks for your precise location. The vacuum builds a centimetre-accurate map. The camera catalogs your belongings. The cleaning schedule reveals your daily routine. Roborock shares data with third parties for "service improvement" and analytics. A device you bought to clean your floors builds a dossier: where you live, what you own, when your house is empty. That dossier is shared with unnamed third parties for purposes described as "improvement."
medium
The camera on your robot vacuum can identify your shoes, your pet, your cables, your socks. Roborock says the images stay on the device. Maybe they do. But no independent firmware audit has verified that claim, and verifying what a camera does with its images requires access Roborock doesn't provide. The same researchers who caught Ecovacs uploading home photos pointed out that "processed on-device" is a policy promise, not a hardware limitation. A firmware update could change it. You'd never know. A camera that can recognise your belongings can recognise much more — and you have no way to verify what it does with what it sees.