Smart Life

Is Smart Life safe?

It is usable for plugs, bulbs and sensors if you accept a company that collects a lot and shows ads. Smart Life is the app behind thousands of cheap white-label devices built on Tuya's platform, and it has more than 50 million installs on Google Play. Tuya's cloud carries ISO 27001, ISO 27701 and SOC 2 Type II reports, and its privacy policy is unusually specific about retention. Against that, the app tracks usage for advertising, takes your Wi-Fi password during setup, and had two serious flaws in 2025 that could hand an attacker control of linked devices.

We score Smart Life 58/100, level with Kasa Smart and a little below Xiaomi Home at 60.

Who is behind Smart Life?

The App Store lists Volcano Technology Limited of Hong Kong as the seller. The policy names it as the provider and Tuya GmbH in Düsseldorf as the controller for Europe and the UK. Tuya is a Chinese IoT company that says around 5,800 customers use its platform. Many of those customers are device makers who print their own brand on the box but send buyers to Smart Life or to a rebranded copy of it.

That model matters for privacy. The policy says Smart Life shares data with the "providers of Smart Devices" you add, so a bulb from an unknown brand brings that brand into the picture too. Firmware quality also varies widely between makers, even though they share Tuya's cloud.

In September 2021, Senators Marco Rubio, Rick Scott and Tom Cotton asked Treasury Secretary Janet Yellen to add Tuya to a list of Chinese military-industrial companies. They argued that Chinese law could force Tuya to share Americans' data. Tuya called the claims without merit and said it keeps user data in each region, including the US. We found no regulator finding against Tuya.

What data does Smart Life collect?

Apple's label says usage data may be used to track you across other companies' apps. It links location, contact details, user content, identifiers, usage data and diagnostics to you. The listing also says the app contains advertising.

The privacy policy, effective 20 September 2026, fills in the detail. During pairing, the app collects your Wi-Fi network name, router MAC address and Wi-Fi password, plus device MAC and IP addresses. Precise location runs automations and geofencing, which uses Google Maps. Health devices send weight, heart rate, blood pressure or sleep data with your consent. With consent, ad identifiers (IDFA or GAID), IP address, rough location and in-app activity go to ad networks such as Google for personalised ads. The new AI assistant can send what you type to outside large language models "such as ChatGPT".

Tuya says it had seven data centres in June 2025: mainland China, Frankfurt, Eemshaven in the Netherlands, Oregon, Virginia, Singapore and Mumbai. Tuya's list assigns many European countries, among them France, Spain and the Netherlands, to Frankfurt.

How secure is Smart Life?

The platform has the paperwork. Tuya lists ISO 27001, ISO 27701, CSA STAR and SOC 2 Type II reports and runs a bug bounty through its own security response centre, though it publishes no reward amounts. The policy says confidential data is encrypted in storage, and that camera images captured on motion are saved, encrypted, on the device unless you buy cloud storage.

The app's recent record is weaker. CVE-2025-56557 (CVSS 9.1) let attackers control Matter devices through Smart Life version 5.6.1 without the right permissions. CVE-2025-56400 (CVSS 8.8), in the Tuya SDK used by Smart Life and Tuya Smart, skipped a check during Alexa account linking: a victim who clicked a crafted link could connect an attacker's Alexa to their account, giving control of cameras, doorbells, locks or alarms. Tuya's July 2026 advisory says its SDK and apps are fixed from version 6.5.0; we found no Tuya advisory for the Matter flaw. A 2026 report of a crash bug (CVE-2026-3465) is disputed by Tuya.

How to use Smart Life more safely

1. Keep the app updated, since the 2025 flaws were in the app and its SDK.
2. Never open an Alexa or Google account-linking link you did not start yourself.
3. Put Tuya devices on a guest or IoT Wi-Fi network, because the app hands your Wi-Fi password to each device.
4. Withdraw consent to personalised ads under Me, Settings, Privacy Settings, and deny tracking on iPhone.
5. Prefer devices that keep camera video on a microSD card, and do not buy cameras from brands that list no support or firmware updates.
6. Delete your account under Me, Settings, Account and Security when you stop using the devices; Tuya deletes accounts unused for two years anyway.

How we scored it

The regulatory record (86) is Smart Life's strongest factor: no regulator has fined or ordered Tuya over the app. Privacy (45) is the weakest, because the app tracks usage for ads, collects your Wi-Fi password and shares data with every device maker. Security (52) reflects two high-severity app flaws in 2025 against Tuya's certifications and bug bounty, and transparency and control (62) benefits from a clear policy with real retention periods.