Wearable Privacy Audit Corpus

8 devices audited · Auditor: Tomás Maria Vaz de Noronha · License: CC-BY-4.0 · Methodology: 3-pass forensic

What this is. The 8 wearables that have completed Ainode's 3-pass forensic audit (DNS analysis + 72-hour packet capture + 6-dimension classification) in our 2026-04 publication cycle. 4 passed Tier B/C disclosure scoring; 4 are Rejected for sending personal data to non-adequate countries without GDPR Article 46 safeguards.

Audited (Tier B / Tier C — disclosed flows, sold)

HeyCyan AI Glasses — Tier B · score 36/100
Contacts only manufacturer servers for firmware — zero telemetry when idle.
SHR K3 Smart Ring — Tier C · score 51/100
Health data shared with US servers — documented and disclosed to the user.
AuraBuds X6 Earbuds — Tier C · score 65/100
Firmware contacts servers outside the EU — operational traffic, no audio data transmitted.
Redmi Watch 5 Active — Tier B · score 32/100
Data sent to Xiaomi servers in Europe — adequate GDPR compliance.

Rejected (GDPR Article 44 violations — NOT sold)

AI Glasses 8MP — Rejected · score 59/100
REJECTED — Location data sent to servers in China; non-adequate country under GDPR Art. 44.
AI Glasses 1200W — Rejected · score 61/100
REJECTED — Location data sent to servers in China; non-adequate country under GDPR Art. 44.
Aurafit Titan — Rejected · score 73/100
REJECTED — Voice data sent to servers in China; critical privacy violation.
Nexa 2 Smartwatch — Rejected · score 81/100
REJECTED — Voice data sent to servers in China; critical privacy violation.

Where to go from here

3-pass methodology — how every audit is run
Aggregate dataset — Schema.org Dataset, CC-BY-4.0, full corpus download
23 head-to-head comparisons — Oura, Apple Watch, Galaxy, Fitbit, Whoop, etc.
Privacy glossary — GDPR Art. 44, non-adequate country, PCAP, Schrems II, etc.
RSS feed · MCP integration endpoint