My wife and I decided to buy a robot vacuum cleaner to improve the comfort of our home. After asking my work colleagues on one of our informal slack channels about their experience, we’ve spend a couple of hours reading reviews on digitec.ch of Roomba and Roborock vacuum cleaners. The Roborock S5 Max had lots of positive reviews and an entry-level price, so we ordered one. We’ve unpacked it on the 27th of December, and after setting it up, I had to install the Roborock Android app on my phone.

The Privacy Policy

As I like to read the Terms and Conditions and the Privacy Policies before agreeing with them, I spent around 1 hour doing so. And I found some interesting stuff. Note that the following quotes are from the Roborock Privacy Policy which was available inside their Android app on the 27th of December 2020. By the time you read this, things may have changed.

“Your personal information will be retained for as long as necessary to fulfill the purpose for which it was collected, or as required or permitted by applicable laws. […] Roborock will continue to retain any data which will be further processed solely for achieving purposes in the public interest, scientific or historical research purposes, or statistical purposes, even if the further processing of such data has nothing to do with the purpose for which it was collected.”

My problem is that they didn’t mention anonymity here… Basically, they collect data for purpose X and then can use it indefinitely for any purpose, as the categories they mention are vague. Of course, being a Romanian citizen, I am also a European Union citizen and can ask for data deletion, by sending an email to privacy at roborock-eu dot com. Long live the GDPR!

“If you are a European Union user under the GDPR, your personal information will be stored on the server in Germany.” ✌️

Another advantage of the EU.

“Our Privacy Policy does not apply to products or services offered by any third party. […] we strongly recommend that you read the third party’s privacy policy, just as you have taken time to read ours.”

Initially after reading this, I had the impression they were breaching GDPR, because they didn’t mention which 3rd party providers they use. So I sent an email to dpo at roborock dot com and asked them to clarify. They replied within 12 hours, mentioning:

“[…] the third party mentioned in the privacy policy refers to the services provided by other companies that can be used in Roborock app, such as Amazon’s Alexa speakers. Because when you choose the service provided by a third party, you will learn about its data processing through the app, and the data will only be transmitted to the third party after you explicitly agree. Third-party services do not belong to the basic services provided by the app, and the supported services may increase with the upgrade of functions. Therefore, the privacy policy does not disclose the list of all third-party services supported. However, you can learn about the specific situation of the third party through the pop-up prompt in the app before using the related service.”

That’s pretty good customer service. It was a nice surprise.

The Password Policy

After accepting the T&C and Privacy Policy, I had to create an account and choose a password. Here, I had a really bad surprise: they ask for 6-12 chars passwords. Yes. 2020, almost 2021. Maximum 12 characters. The Roborock company ensuring that your password can be cracked without burning too much fuel.

roborock-password-policy

Obviously, I accepted all of this because I want to use my little robot 🤓🤖. But still a bad experience.

The robot experience

As I write this article, we have used the robot twice: first to create a map while vacuuming our home, and the second day just vacuuming. For 34 square metres, it first took 40 minutes (while creating the map) and the second time it took 30 minutes. We can watch the cleaning history in the app, what trajectory the robot took in each session. All in all, it was really easy to setup. The robot is pretty smart, gentle on the furniture when bumping into it and quite organized when moving in the home.

Later update (2021-10-24)

This blog post does not suggest that your privacy is respected by Roborock. I do not know how my data is being used. Also, it is worth pondering whether these gimmicks are truly necessary or not (because Want is the Acid consuming our planet). I haven’t used my Roborock in the past 4 months and I don’t necessarily miss it.