Following the recent data breaches and supply chain attacks across the hardware wallet industry, we’re taking additional steps to strengthen OneKey’s existing security practices and further protect our customers’ privacy. First, to be clear: OneKey has NOT experienced a security breach. We’re taking these measures proactively, before something happens. We’ve always had internal data security policies in place, including routine deletion of customer order records and personal information. Given what’s been happening across the industry, we’ve decided to go further. We’re tightening these policies and conducting another thorough review of our systems to make sure nothing has been overlooked. Here’s what we’re doing: 1. Reviewing and verifying the deletion of historical order data. We’ve already confirmed through Shopify’s API that the relevant historical order records have been deleted, including customer names, email addresses, physical shipping addresses, and other personal information. We’re now going through our other systems and integrations again to make sure our existing data deletion policies have been properly enforced, with nothing left behind. 2. Limiting customer data retention to a maximum of 30 days. For OneKey and every system under our control, we’ll do everything we can to ensure that personal information associated with an order is permanently deleted within 30 days. We’ll find alternative ways to handle returns, warranty claims, and device verification without keeping sensitive customer information longer than necessary. 3. Further reducing the risk of historical customer data being exposed. The historical order records we’ve deleted are no longer accessible through Shopify’s order API. We’re continuing to review how and where customer information is stored and accessed, with the goal of ensuring that even if an ecommerce platform is compromised, there is no unnecessary historical customer data left for an attacker to obtain. One important limitation: Shipping carriers such as FedEx and UPS have their own data retention policies, which are outside our control. We cannot guarantee that these providers follow the same 30-day policy. Our commitment is to minimize and remove personal information everywhere we have the ability to do so. For customers who explicitly opt in to our communications, we may separately retain a privacy-protected email address, without linking it to their identity, shipping address, or order history. It will only be used for product updates, security patches, and other important notifications. We’re also working toward moving our ecommerce operations to infrastructure we fully control, with the long-term goal of eliminating our dependence on Shopify and similar third-party platforms. There are still challenges to overcome, especially around platform security, data lifecycle management, access controls, and fraud prevention. We want to get these things right before making that transition. We believe one of the best ways to protect customer privacy is to collect as little data as possible, keep it for as little time as possible, and delete it as soon as it’s no longer needed. Security work is never finished. We’ll stay cautious, keep reviewing our practices, and do everything we can to protect our customers’ privacy and security.

What used to be breaches happening over 3-4 months happened in a single day yesterday/today It’s how it feels at least And, unfortunately, we can prob expect this kind of pace to continue. AI allows finding critical vulnerabilities in widely used software/services much faster