Bondu
Filed here are the firms whose record of you did not begin with a sign-up. What holds the file together is the device rather than an account, so there may be nothing to log into and no delete button. The right to ask does not depend on having an account.
Reported incidents
50,000 children's chats with its AI plush toy left open online
2026-02-03Affected Parent web console for the AI toy
Security researchers Joseph Thacker and Joel Margolis found that the web console for Bondu's AI plush toy let anyone signed in with a Gmail account read children's conversations with the toy. They saw more than 50,000 chat transcripts, with children's names, dates of birth, family details and chat summaries. Wired first reported the finding. Bondu took the console offline within minutes of being told and relaunched it with authentication. Its chief executive said the fix was done within hours and the company saw no evidence of other access.
People affected typically ask Bondu to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.