Wow, I can't believe this happens. Yeelight is made by Xiaomi, one of big tech companies in China (next to Huawei). This product is great, the app is great; easy to use and good functionality. Price a bit higher than other Chinese manufacturers but justified based on the high quality product and controlling app. BUT! Turns out the controlling app is a way this Chinese company uses to harvest access to U.S. email addresses. It does not just try to collect basic info like email address or location. IT ACTUALLY GETS YOUR EMAIL USERNAME AND PASSWORD.
To use the product you need to set up an account in their app. It sends you a verification code in email. The app shows you a button to "check email" and it shows (as I used a Gmail address) a screen that looks like a Google login screen and asks you to enter your username and password. THIS IS NOT A GOOGLE PAGE. It is inside the app. And, when I go to my Gmail app to look for the verification code there, none was sent.
The app collects your email and password, meaning it can have access at any time to your whole email account. Wow... just wow! I still was eager to test the product so what I ended up doing was backing out of it and then setting up an account by using a phone number. It did send me a verification code as SMS and was able to set up the account and test the product, which worked great. But there were all sorts of paths during the process where they were nudging to provide more information. BE CAREFUL, USE AT YOUR OWN RISK!