← IoT Privacy Database

Rachio Smart Sprinkler Controller

Rachio, Inc. · Smart Water / Utility

Staff Reviewed — a person at DeSpy reviewed this rating.

3.9Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesC

Rachio schedules yard irrigation using your home's location for local weather, and its watering logs and schedule adjustments can hint at when a household is present, away or on vacation. The controller requires a cloud account and mostly depends on Rachio's servers and third-party weather APIs to function. Its data practices have not been independently scrutinized, so the picture rests on Rachio's own policy rather than outside verification.

Why this rating

Policy is docked for tying operation to precise home location and for schedule/usage logs that can reveal occupancy beyond the strict need of irrigation (sensitive-collection), plus vague retention, unilateral changes and arbitration typical of the category. Evidence: an independent Tenable reverse-engineering study of the Rachio 3 found no vulnerabilities and praised the device's hardening (encrypted firmware/filesystem, no debug shell, authenticated services) - a favorable but security-only review, so the privacy behavior of the cloud service remains lightly studied.

What it is

Manufacturer
Rachio, Inc.
Category
Smart Water / Utility
Model years
2019-present
Market status
Current
Companion app
Rachio

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. Reversing the Rachio Smart Sprinkler Controller
    Major breach · Tenable · 2019-01

    A Tenable researcher reverse-engineered the Rachio 3 and found no vulnerabilities, noting the device implements strong security practices (encrypted firmware/filesystem, no debug shell, service authentication, encrypted communications).

    Why it matters here: An independent security review of this exact device - favorable, contradicting any claim that Rachio is entirely unstudied.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database