Keystone admits 180-day deletion failed as OneKey undercuts it with 30 days

Effective immediately, shipping data retention has been reduced by 50% by Keystone. It went from 180 days to 90 days on Friday. 

The company admitted that its popular 180-day auto-deletion wasn’t working and had left personal data on 25,964 of its buyer records open to a breach. Its competitor, OneKey, went a step further by putting a 30-day cap on auto-retention.  

Keystone: “We accept responsibility for this failure” 

The change was made with immediate effect. The company made the announcement in an X post on Friday. Keystone told buyers who would like their data scrapped to reach out to support immediately after they receive an order.  

The change came after an admission by Keystone that its automated function for deleting user data after a 180-day window stopped  working properly, and no alert flagged it. 

According to Cryptopolitan, Keystone noticed 25,964 buyer records containing personal data like names, contact details, shipping addresses, and purchase histories. This was discovered after a review of 51,083 buyer records. 

Some of the buyer records that carried personal data went as far back as 2024, well past the 180-day auto-deletion limits the company promised. Another 12,873 unpaid checkout records were revealed to carry sensitive data. 

The company went on to say, “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”

Three documents, three versions of the rule 

The promise broken by Keystone had three completely different versions. Depending on what part of the website you read, you were given a different promise. The first version was on its Privacy Promise page, and it states that “all shipping information is automatically deleted 180 days after your order is placed.” 

But if you looked at Keystone’s privacy policy, which was last altered in May 2021, it reads ”Keystone erases all order information of each customer who has not made an order within the last 180 days.”

The third version appears in the company’s help center, and it says “records of the customer’s city and country will not be deleted on request and that Shopify carries out the final deletion.” 

OneKey goes to 30 days 

Keystone’s lapse provided its rival, OneKey, with an opportunity to forge ahead. Yishi Wang, the founder of OneKey, announced that the company would set a 30-day limit before user data is wiped from its database. 

This was announced on October 27 in the aftermath of Keystone’s issues. The founder reiterated that the move was simply a precaution.

The idea behind the move is not rocket science; the longer a vendor keeps records, the more likely such records would be lost in a breach. 

SafePal also made a similar move after about 40,000 of its customers were left exposed via an order-tracking flaw. The company cut retention down to 90 days. 

The move by both companies shows that there are weaknesses that go beyond any single wallet maker. 

A stolen key forces 18,835 devices to be destroyed

The failure at Keystone is one part of a larger episode. Keystone noticed unauthorized access to its site on October 20, confirming it on October 23. An intruder had stolen buyer data, and the company later found out that the thief also stole the WebAuth key. The key is a code burned into each device at the factory to prove it is genuine.

Keystone has made the decision to scrap all 18,835 unsold units carrying the key. This is because the key cannot be rewritten. Keystone has decided to put a pause on website shipments. Also, the company has opted for preorders pending when devices will be replaced. Any device delivered before October 20 is safe, so long as it passes authentication. 

Recovery phrases, private keys, and payment details were not exposed, the company said. It filed deletion requests with Shopify on October 24; a mandatory 10-day wait means the overdue records should be gone by November 3.