eufy Security is designed as a home security system. eufy records videos and stores them locally when your device detects motion. If you subscribe to our cloud storage service, your videos are stored securely in the cloud and can be deleted at any time. Your videos will be permanently deleted from our servers depending on the storage period of your plan.
To provide users with push notifications to their mobile devices, some of our security solutions generate small preview images (thumbnails) for videos that are hosted in a secure feed on an AWS-based cloud server. These thumbnails use server-side encryption, are set to delete automatically, and are compatible with Apple Push Notification Service and Firebase Cloud Messaging standards. Users can access or share these thumbnails only after they are securely logged into their eufy Security account.
Although our eufy Security app allows users to choose between text-based or thumbnail-based push notifications, it is not made clear that selecting thumbnail-based notifications will require preview images to be hosted briefly in the cloud.
This lack of communication was an oversight on our part and we sincerely apologize for our mistake.
This is how we plan to improve our communication on the matter:
– We are revising the language of the eufy Security app push notifications option to clearly detail that push notifications with thumbnails require preview images that will be cached in the cloud.
We will be more explicit about using the cloud for push notifications in our consumer marketing materials.
For a video that can be shared via a URL link and opened by an external player, please receive our response as follows:
Today, around 1% of our total users access their accounts via our web portal. As per our design, before accessing any information, users are required to log into their accounts. URL links can only be obtained and shared by the users themselves and will only be valid temporarily. It will be a personal activity if you get your URL and share it with other people. However, we would like to assure everyone that we have improved on this point – even after users get the URL link by logging into their account, it cannot be played via a third party player or shared with others to play. Furthermore, we’ve closed the browser’s developer mode port, to avoid a similar process as Paul Moore demonstrated in his video.
Regarding our explanations above, we also recommend that you test these details on your own, then you can know the real truth.
eufy Security is committed to the privacy and protection of our users’ data and appreciates the security research community reaching out to us to bring this to our attention.