Petcube Camera
Petcube · Camera / Doorbell
Staff Reviewed · 2026-09-28 — a person at DeSpy reviewed this rating. Reviewer's note: Verified
Index
Interactive Wi-Fi pet camera with two-way audio and cloud-recorded video (short clips, 256-bit AES at rest, TLS in transit); cloud/account-dependent with no meaningful offline mode. Petcube's privacy policy explicitly refuses to sell/rent personal data and grants marketing opt-out plus GDPR erasure, but records audio/video, has the companion app collect geotag/city-level location, and shares cookie data with third-party advertising partners for targeted ads. IOActive (advisory dated April 2015, publicly released May 2018) disclosed serious security negligence in the original device — SSH private keys shared across all users, no isolation, server-side command execution, shared TLS certificate — now over a decade old, remediated, with no known exploitation. Mozilla's *Privacy Not Included review of the current Play 2/Bites 2 line is otherwise clean (no known incidents in last 2 years, meets minimum security standards).
Why this rating
The written explanation of this rating is withheld while a person re-reviews it.
What it is
- Microphone
- Camera
- Requires a cloud account
- Manufacturer
- Petcube
- Category
- Camera / Doorbell
- Model years
- 2014–present
- Market status
- Current
- Companion app
- Petcube app (iOS/Android)
The evidence 2
Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.
-
Effective 2021-09-17. States 'We will not rent or sell your information to third parties outside Petcube, except as noted in this Policy'; grants marketing opt-out and GDPR right to erasure. However shares cookie data with third-party advertising partners for targeted ads, records/stores audio-video, collects geotags/city-level location, retains post-deletion data for a 'commercially reasonable time for backup, archival, and/or audit,' and provides JAMS arbitration.
Why it matters here: Primary source for the policy-axis deductions (sensitive-collection, broker-disclosure, policy-vagueness, forced-arbitration) and for the non-deductions (no sale, opt-out, erasure). Verified directly against the live policy.
-
Independent review: shares only aggregated/de-identified data (Mozilla: 'This doesn't worry us much at all'), records audio/video, location tracked only in the app (device: no), users can request deletion; meets Minimum Security Standards (encryption in transit and at rest, strong passwords, security updates, vulnerability management) with 'No known incidents in the last 2 years.'
Why it matters here: Independent, relatively clean assessment supporting the high (studied) evidence score and confirming recent absence of incidents; note it covers the current Play 2/Bites 2 line.
Are you the maker? Respond to this finding
Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.