You can find the original thread here ; It's one of the more responsible IoT apps - no sensitive data was sent out.The personal information disclosure is incorrect as data is shared with 3rd parties.The worst someone could do is control your toothbrush from within close proximity due to lack of authentication on the brush itself. Slapping together a quick and dirty Frida script, it's observed that at run time, the Salesforce SDK explicitly checks if the toothbrush app had been granted fine location permissions (granting access to user's GPS coordinates). After modifying the manifest and hooking into a method to request FINE_LOCATION on toothbrush pairing (simulate behaviour on older device), so far no location data has been sent by the app.