Follow the Smart-Glasses App
On 7 October 2026, Australia’s OAIC opened an investigation into Shenzhen Qingcheng Future Technology, maker of the HeyCyan app, after unanswered preliminary inquiries. Its questions concerned recording, access and storage. The investigation is not a breach finding, fine or general product ban.
HeyCyan enables features in lower-cost glasses, including Kmart’s Anko models. OAIC distinguishes software providers from retailers and companies supplying both hardware and software. A frame’s brand alone is not a service map.
The Commissioner’s commentary says a hardware-only retailer may lack device-related Privacy Act duties when it neither collects nor holds personal information, but customers and shareholders may still expect due diligence. OAIC has also urged retailers to consider continued sale.
A demonstration is not a deployment decision
Consider a hypothetical buyer evaluating glasses for a workplace. A successful shop demonstration establishes that the demonstrated feature worked in that setting. It does not establish which organisation would handle the buyer’s future recordings, or whether the same configuration will be used after purchase.
The useful disagreement is between the sales answer, “it works”, and the buyer’s unanswered question, “under whose control?”. BlackTree’s example keeps both statements: accept the observation for what it shows, but leave the deployment decision open until the missing answer has an accountable source.
Connect the policy to evidence
OAIC’s APP 1 guideline requires covered entities to take reasonable compliance steps, handle privacy inquiries and complaints, and maintain a clear, current policy. It recommends governance, access controls, audit trails and continuing review.
Use that guidance to connect a stated purpose to the actual app and service, an access role and its logs, storage and backup locations, and retention or deletion arrangements. Record which supplier evidence answers each question and which parts remain unknown. These are evidence requests, not findings about HeyCyan or universal duties for every shop.
BlackTree’s separate December analysis explains an additional privacy-policy disclosure rule for certain software-assisted decisions, starting 10 December 2026. That rule is not the HeyCyan investigation.
Leave a decision another person can understand
For this buyer, unanswered questions should qualify approval, not invite assumptions or breach claims. Record the demonstration’s limits, the unresolved dependency, its owner and the next review.
