It sends commands over Bluetooth Low Energy. Commands are sent to the handle with UUID d44bc439-abfd-45a2-b575-925416129600, with a format of a single byte containing the length of the rest of the packet, some bytes of ASCII containing the command, and then any arguments to the command. This is padded out to 16 bytes and then AES encrypted in ECB mode with a key of:
'\x32\x67\x2f\x79\x74\xad\x43\x45\x1d\x9c\x6c\x89\x4a\x0e\x87\x64'
Commands are:
LIGHT - one byte argument controls the brightness
IMAG - one byte controls which static image is displayed
DELE - one byte gives the number of uploaded images to be deleted, and the following bytes give the set of images to be deleted
SPEED - one byte that I think sets the transition speed between DIY images in playback mode
ANIM - one byte that chooses which animation is displayed
PLAY - one byte that contains the number of DIY images to play, and then the images to play in the order that they'll be played with one byte per image
CHEC - triggers a not