Before you connect: privacy questions for app-controlled toys

Decide what you want the connection to do

I would decide what I want the connection to do before choosing the toy. Adjusting a setting from a phone and giving another person control are different requests. A feature can sound convenient while asking for more setup than you want.

My starting point is simple: who can connect, how do you stop that connection, and what still works when the app is closed? The answers should shape the shortlist. They should not be guessed from a Bluetooth logo.

The examples below use Lovense's current published instructions because Lush 3 and Lush Mini are in our catalog. They are not a ranking of app privacy, and one manufacturer's process does not describe every connected product. App features and policies can change; the specific documents matter more than a reassuring label.

1. Does this method need an account?

Ask about the feature you want, not just whether “the app” needs an account. Lovense's Live Control guide describes separate accounts for partners, adding a partner and setting permissions for that partner. Its Control Link documentation describes another route: a shareable URL through which someone can control a toy without downloading the app. [1, 2]

Those are different arrangements. The no-download description for a recipient does not mean that the person creating the link needs no account, or that no information is processed. I would be wary of compressing several connection methods into a single yes-or-no answer.

For my shortlist, I would first choose between direct controls, local phone control and sharing control with another person. Then I would check the requirements for that exact method. There is no need to enable every available feature to justify owning the product.

2. Which permissions support the features you intend to use?

I would review permissions at setup and again when enabling something new. A request connected with finding a device is a different question from camera or microphone access for a communication feature. Lovense's FAQ says permissions can be refused or changed, with consequences for the relevant functions. [3]

Avoid assuming that every Android phone or app version presents the same location requirement. Platform versions and connection methods differ, and the available manufacturer material does not establish one universal permission checklist.

App-store privacy disclosures provide useful questions to pursue. The current Apple listing identifies categories including contact information, identifiers and usage data linked to a user; the Google Play listing describes collection and sharing categories and deletion requests. These are developer disclosures, not an independent security assessment. I would read them alongside the actual privacy policy rather than treating either store's summary as a guarantee. [4, 5]

3. Who has access, and how did they get it?

A partner invitation and a shareable control link deserve separate attention. I would treat a control URL as an access credential: sharing it is part of granting control, not merely sending a product link. Avoid putting one in a public post or assuming that a familiar messaging channel prevents forwarding. [2]

The current app listings also describe social features, including Control Roulette and Group Play. I would not rely on a broad assurance that only people already known to you can ever interact through the app. Check the feature you are entering and who it makes available. [4, 5]

My preference is to make shared control deliberate and specific. Agree who is participating, what is being shared and how either person will end it. A product feature is not permission to surprise someone with control they did not agree to.

4. How do you stop now—and revoke access afterward?

This is the distinction I would learn before sharing a link. Lovense's Control Link guide says ending a single-use link deactivates it. For an unlimited link, End stops the current session, but the link can become active again after thirty seconds. Delete is the documented action for permanently removing that link. [2]

Stopping the current interaction and removing continuing access are therefore not the same thing. Nor would I assume that removing a contact deletes a previously shared link. Check and manage each route separately.

The Lush 3 and Lush Mini manuals document holding the power button for three seconds to turn the device off. That gives a model-specific physical stop control; it does not establish that account permissions or shared links have been revoked. [6, 7]

I would keep these steps easy to find. Learn the physical control, know which app action stops a session, and know which action removes the ongoing invitation. This is about making a choice understandable, not predicting that something will go wrong.

5. What information remains after you disconnect or delete?

Disconnecting a toy, removing an app and requesting account deletion are separate actions. Lovense's privacy policy describes categories including device identifiers, connection logs, session metadata and some communications, together with service-provider sharing. It also describes retention that varies with the data category and account circumstances. [8]

There is a material inconsistency in the manufacturer's documents: a privacy FAQ describes a seven-day server-retention period, while the main policy describes longer or conditional retention, exceptions and residual backups. I would not promise that all data disappears after seven days. The policy also notes that other recipients may retain information shared with them. [8, 9]

Encryption claims need equally careful wording. The policy describes encryption in transit and at rest for account-identifiable data; that is not a statement that every feature is end-to-end encrypted. This article has not independently tested those protections. [8]

Lovense documents an account-deletion route through its website account/profile controls. Treat deletion as a request subject to the policy's stated limits, not an instant erasure of every copy. [3, 8]

6. What works without the app?

For a specific model, look for documented physical controls and operating modes. The Lush Mini manual describes a physical button for cycling settings, and both cited Lush manuals describe power controls. Those details do not establish that every app feature works offline, that setup never needs an account or that no data is collected. [6, 7]

If the connection itself adds little to what you want, a directly controlled product may be a more appealing choice. Magic Wand Micro is an example with two physical buttons, three steady speeds and four patterns in its official specifications. Its handheld wand format is a different product proposition from a wearable egg, so it is an alternative preference to consider, not an equivalent substitute. [10]

I would finish with six answers written in plain language: the account needed for my chosen method; the permissions it uses; who can connect; how I stop and revoke access; what deletion does; and which controls remain on the device. If those answers do not suit what you want from the experience, choosing a different control arrangement is a complete decision.