Keystone has cut its shipping data retention period by 50%, moving from 180 days to 90 days with immediate effect. The hardware wallet maker announced the change in an X post on Friday and told buyers who want their data erased to contact support immediately after receiving an order.

The reduction follows Keystone's admission that its widely promoted 180-day auto-deletion function had stopped working, leaving personal data on 25,964 buyer records exposed to potential breach. Competitor OneKey went a step further by capping auto-retention at 30 days. The episode also highlights a structural feature of the hardware wallet business: devices are physical goods, so vendors must collect and hold names, contact details, and delivery addresses for every order — a category of personal data software-only products never need to keep.

Keystone: “We accept responsibility for this failure”

The change came after Keystone acknowledged that the automated function for deleting user data after a 180-day window had stopped working properly, and that no alert flagged the failure.

According to Cryptopolitan, Keystone identified 25,964 buyer records containing personal data such as names, contact details, shipping addresses, and purchase histories. The discovery emerged from a review of 51,083 buyer records. Some of the records carrying personal data went as far back as 2024, well past the 180-day auto-deletion limit the company had promised. Another 12,873 unpaid checkout records were also found to contain sensitive data.

“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company said.

Three documents, three versions of the rule

The promise Keystone broke existed in three entirely different versions, depending on which part of the website a customer read. The first appeared on the company's Privacy Promise page, which states that “all shipping information is automatically deleted 180 days after your order is placed.”

Keystone's privacy policy, last altered in May 2021, reads instead: “Keystone erases all order information of each customer who has not made an order within the last 180 days.”

A third version appears in the company's help center, which says records of the customer's city and country will not be deleted on request and that Shopify carries out the final deletion. In practice, the deletion terms a customer was promised varied by trigger, timing, scope, and who performed the erasure, depending on which page they read.

OneKey goes to 30 days

Keystone's lapse handed its rival OneKey an opportunity to forge ahead. Yishi Wang, the founder of OneKey, announced on October 27 — in the aftermath of Keystone's troubles — that the company would set a 30-day limit before user data is wiped from its database. Wang reiterated that the move was simply a precaution.

The reasoning behind the move is not complicated: the longer a vendor keeps records, the more likely such records are to be lost in a breach.

SafePal made a similar move after about 40,000 of its customers were left exposed through an order-tracking flaw, cutting retention down to 90 days. Taken together, the steps by both companies show that the weaknesses extend beyond any single wallet maker.

A stolen key forces 18,835 devices to be destroyed

The retention failure is one part of a larger episode. Keystone noticed unauthorized access to its site on October 20 and confirmed it on October 23. An intruder had stolen buyer data, and the company later discovered that the thief had also taken the WebAuth key — a code burned into each device at the factory to prove it is genuine.

Because the key cannot be rewritten, Keystone decided to scrap all 18,835 unsold units carrying it. The company has paused shipments through its website and shifted to preorders while it awaits replacement devices. Any device delivered before October 20 is safe, so long as it passes authentication.

Recovery phrases, private keys, and payment details were not exposed, the company said. Keystone filed deletion requests with Shopify on October 24; a mandatory 10-day wait means the overdue records should be gone by November 3. That deadline, along with the restart of Keystone's paused direct shipments, is the nearest checkpoint for buyers tracking whether the cleanup completes as scheduled.