OneKey data retention now deletes personal order records within 30 days. The wallet maker is cutting how long it keeps checkout data after recent industry breaches. It says its own systems were not hit. It already wiped older Shopify order files. That is the stake for Bitcoin wallet security. Names, emails, and shipping details can outlive the sale. Attackers still chase those files.
OneKey Data Retention Cap Clears Shopify Order Records
In an October 27 post on X, Yishi, who calls himself “janitor @OneKeyHQ,” set out the new privacy steps. He said OneKey already wiped customer records on a set cycle. Fresh breaches and supply chain hits pushed another review, per Yishi’s October 27 post.
A first check through Shopify’s order API showed older orders were gone. Those files held names, emails, shipping addresses, and other personal details. The wiped records no longer show up in Shopify’s order API. That cuts the history available through that feed.
OneKey is also checking other systems and third-party tools. It wants to confirm older wipe rules were followed. Under the new rule, order data stays for up to 30 days. OneKey says it will wipe that data in the window on systems it runs.
OneKey Plans Less Need for Third-Party Platforms
Even with the new cap, OneKey said some customer data sits outside its control. Shippers such as FedEx and UPS keep their own hold times. So OneKey cannot promise those firms will wipe shipping records in 30 days.
People who opt into mail may still keep a masked email on file. OneKey said those addresses would not link to names, shipping details, or order histories. The list would support product notes, security fixes, and other key alerts.
The firm plans to move its shop onto servers it runs, so it needs Shopify less. Yishi still named site security, data handling, access rules, and fraud checks as open issues. He gave no date for the move. The near-term goal remains cutting needless storage of private customer data.
Keystone Breach Raises Hardware Wallet Retention Stakes
OneKey’s note follows a breach at Keystone, another wallet maker. Keystone said on October 24 that a website break-in exposed buyer shipping data. Staff spotted the issue on October 20. They confirmed the leak on October 23 after checking Shopify API activity, per Keystone’s October 24 disclosure.
Leaked data included names, contact details, shipping addresses, and buy records. Keystone said card data, private keys, seed phrases, and wallet passwords were not exposed. The firm had said shipping files would be wiped within 180 days of purchase. Some buyers still said old order details showed up. For readers tracking crypto hacks, the case shows why long hold times stay risky even when seed phrases stay offline.
Leave feedback about this