A Chicago woman is suing a tech company she accuses of collecting intimate information about how its customers use their sex toys.

The woman, identified only as NP in her lawsuit, is suing the maker of We-Vibe, a personal vibrator that can be controlled by a smartphone, accusing the company of secretly amassing “highly sensitive, personally identifiable information” about how and when she used the device.

The woman claims that the device maker violated numerous laws by collecting information about her and other users’ preferred vibration settings, the dates and times the device is used, “and incredibly”, the email addresses of We-Vibe owners who had registered their devices. The data collected, she claims, allows the We-Vibe maker to link information about use and preferences to a specific customer.

According to the lawsuit, the company making We-Vibe, Standard Innovation, obtained all this data without the permission of its users, in violation of several US consumer protection and privacy laws. Moreover, the suit says the company actively “concealed” its data collection policies from users.

The suit seeks unspecified damage and the deletion of users’ data from Standard Innovation’s company servers in Canada. NP is seeking class-action status for what is likely a class of “tens of thousands” of other We-Vibe users, the lawsuit states.

We-Vibe hit the market in 2008 and in 2014 began offering users the option of pairing the device with a smartphone app. The app gives We-Vibe owners access to a wider selection of vibration modes, such as “pulse”, crest”, “bounce” and “cha cha cha”. NP purchased a We-Vibe Rave vibrator in May of this year for $130 and used We-Connect, the app, several times, her suit said.

The app also contains chat and video features, and allows a smartphone user to remote-control the vibrator, lending itself to long-distance users. “Turn on your lover when you connect and play together from anywhere in the world,” read one We-Vibe suggestion. The extra functionality gives Standard Innovation the ability to charge a higher price, the lawsuit claims.

A spokesman for Standard Innovation, Denny Alexander, declined to comment, saying the company had yet to be served with a lawsuit. “There has been no claim that our customers’ data has been compromised,” he said. “Over the course of the last few weeks, we have taken steps to further enhance the data security and privacy measures for our product offering … We are updating the We-Connect app later this month, and the update will include new in-app communication regarding our privacy and data practices and a new feature for consumers to control how their data may be used.”

We-Vibe’s data collection came under scrutiny several weeks ago at Def Con, an annual hacking conference. Two hackers revealed that Standard Innovation collects data on the temperature and vibration settings in real time, as users operate the device. They also identified a security flaw that could, in theory, allow a hacker to take over the device. (The company has since patched the security flaw.)

In response to the revelations at Def Con, Standard Innovation said it had updated its terms and conditions to reflect, in “plain language”, the kind of data it collects. Alexander told the publication CNET that most users do not register their devices, meaning any data the company’s servers collect from those devices is anonymous. Standard Innovation anonymized the rest of the information it had collected after the Def Con presentation, he added.

“We do collect certain limited data to help us improve our products and for diagnostic purposes,” the company said in a statement. “As a matter of practice, we use this data in an aggregate, non-identifiable form.”

The company also defended its practice of collecting information on the temperature of peoples’ vibrators and on users’ preferred intensity setting. Having data on temperature, the spokesman told CNET, allowed the company to ensure that key components of the device were functioning properly. As for intensity setting, “It is to understand how people use the products.” If users always prefer the highest setting, “then perhaps we don’t have a powerful enough device”.

“Of all the privacy violations our firm has prosecuted, this is among the most personal and invasive we have ever encountered,” said Eve-Lynn Rapp, an attorney with the law firm Edelson PC, which is representing NP. “While this particular example shocks the conscience more than most, it should also put consumers on notice that the ‘internet of things’, while providing convenience and assistance in their daily lives, is also ripe for unauthorized data collection.”