Privacy Policy

What we collect, why we collect it, and how you stay in control.

Last updated: June 18, 2026

SoloKeys operates this store and website — including all related information, content, features, tools, products, and services — to provide you with a curated shopping experience (the "Services"). SoloKeys is powered by Shopify, which enables us to provide those Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services or otherwise communicate with us.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand how your information is collected, used, and disclosed as described here.

1. Our Open Source Commitment & Data Minimization

Your credentials stay on your hardware. That's the whole point.

SoloKeys is built on a principle of digital sovereignty. Our products are designed so that your authentication credentials are stored exclusively on your physical device — not on SoloKeys servers, not in the cloud, and not with any third party. No credential data ever leaves your Solo 2.

Our hardware designs and firmware are fully open source and publicly auditable at github.com/solokeys. Open source transparency is a core part of our privacy commitment — you don't have to take our word for it. You can inspect exactly what our firmware does.

The personal information described in this Privacy Policy relates solely to your use of our website, your purchase transactions, and your communications with us — not to any data processed by your security key during authentication.

2. Personal Information We Collect

Only what's needed to sell you hardware and support you afterward.

When we use the term "personal information," we mean information that identifies or can reasonably be linked to you. This does not include anonymized or de-identified information. Depending on how you interact with the Services, we may collect:

3. Where We Collect It From

Three main sources.

• Directly from you — when you create an account, visit or use the Services, make a purchase, contact support, or otherwise provide us with your personal information.
• Automatically through the Services — from your device when you visit our website, through cookies and similar technologies that track browsing and interaction data.
• From service providers and partners — such as Shopify (our platform provider), payment processors, and shipping carriers, who collect or process information on our behalf as described in Section 6.

4. How We Use Your Information

Primarily: to ship you hardware and support you when something goes wrong.

Fulfilling Your Order

We use your personal information to process payments, fulfill orders, arrange shipping, facilitate returns and exchanges under our Returns & Refunds Policy (including our 6-month hardware warranty), send order notifications, and manage your account.

Improving the Services

We may use aggregated or de-identified data to analyze how customers use our website and to improve the shopping experience. We do not use your authentication device data for any analytics purpose — that data stays on your hardware.

Marketing & Advertising

We may use your contact information to send marketing emails about new products, promotions, or updates. You can opt out at any time using the unsubscribe link in any marketing email. If you opt out, you will still receive transactional emails related to your orders and account.

We may also show you targeted advertisements on other websites based on your browsing activity on our site, subject to your opt-out rights described in Section 10.

Security & Fraud Prevention

We use personal information to authenticate accounts, provide a secure payment experience, and detect, investigate, or take action regarding fraudulent, illegal, or malicious activity. We strongly recommend you do not share your account credentials with others — and for added account security, consider protecting your SoloKeys account with a hardware security key.

Legal Compliance

We may use your personal information to comply with applicable law, respond to valid legal process or requests from law enforcement or government agencies, enforce our Terms of Service, or investigate potential violations of our policies.

5. How We Disclose Your Information

We don't sell your data. We share it only where necessary to operate.

We may disclose your personal information in the following circumstances:

• Service providers: Shopify and other vendors who perform services on our behalf, including payment processing, IT management, data analytics, customer support, cloud storage, order fulfillment, and shipping.
• Business and marketing partners: To provide marketing services and, where applicable, to show you targeted advertising. Our business partners will use your information in accordance with their own privacy notices. You may have the right to opt out — see Section 10.
• With your consent: When you direct or request us to share your information, such as to ship products or through use of social media integrations.
• Affiliates and corporate group: Within our corporate structure where necessary for operational purposes.
• Business transactions: In connection with a merger, acquisition, or bankruptcy, subject to appropriate confidentiality obligations.
• Legal obligations: To comply with applicable law, respond to subpoenas or search warrants, enforce our Terms of Service, or protect the rights of SoloKeys or our users.

6. Our Relationship with Shopify

Our store runs on Shopify. Here's what that means for your data.

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit through the Services will be transmitted to and shared with Shopify, and may be processed by third parties located in countries other than where you reside.

To help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information and for responding to your requests to exercise your rights over that use.

To learn more about how Shopify uses your personal information and to exercise your rights, please visit:

7. Third-Party Websites & Links

We link to GitHub, the FIDO Alliance, and others. We don't control their privacy practices.

The Services may contain links to third-party websites or platforms — including our open source repositories on GitHub, FIDO Alliance documentation, and partner sites. If you follow links to sites not affiliated or controlled by SoloKeys, you should review their privacy and security policies independently.

We are not responsible for the privacy or security practices of any third-party site, nor for the accuracy or reliability of their content. Our inclusion of a link does not imply endorsement of the linked site or its operators.

8. Children's Data

Our Services are not for children.

The Services are not intended to be used by children under the age of majority in their jurisdiction (18 in most places). We do not knowingly collect personal information from children. If you are the parent or guardian of a child who has provided us with their personal information, please contact us at [email protected] and we will delete it.

As of the effective date of this Privacy Policy, we do not knowingly "sell" or "share" (as those terms are defined in applicable law) the personal information of individuals under 16 years of age.

9. Security & Retention

We take security seriously — and we're honest about its limits.

Security

We implement commercially reasonable technical and organizational measures to protect your personal information. However, no security measures are perfect or impenetrable. We cannot guarantee the security of information in transit to or from our Services, and we recommend you do not use unsecured channels to communicate sensitive information.

Retention

How long we retain your personal information depends on why we collected it. We retain order and transaction records as needed to fulfill our legal obligations (including our 6-month warranty), comply with accounting and tax requirements, resolve disputes, and enforce our policies. When information is no longer needed for these purposes, we delete or anonymize it.

10. Your Rights & Choices

Depending on where you live, you have meaningful control over your data.

The rights below may not all apply depending on your jurisdiction, and some may apply only in certain circumstances. We will not discriminate against you for exercising any of these rights.

Global Privacy Control (GPC)

If you visit our website with the Global Privacy Control opt-out preference signal enabled, we will treat this as an opt-out request for the browser and device you are using, to the extent required by applicable law. We do not currently recognize other "Do Not Track" signals. To learn more about GPC, visit globalprivacycontrol.org.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before processing your request. You may also designate an authorized agent to act on your behalf, subject to identity verification requirements.

For rights related to data processed by Shopify on its own behalf, please visit the Shopify Privacy Portal.

11. EU / EEA & UK Rights

Additional rights for customers in Europe.

If you reside in the UK or European Economic Area, in addition to the rights in Section 10, you have the following rights under the GDPR and applicable national law (subject to exceptions and limitations):

• Objection to Processing: You may have the right to ask us to stop processing your personal information for certain purposes, including direct marketing.
• Restriction of Processing: You may have the right to request that we restrict how we process your personal information in certain circumstances.
• Withdrawal of Consent: Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Data Controller

For the purpose of applicable data protection laws, SoloKeys is the data controller of your personal information collected through our website and store. Contact details are in Section 15.

Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA data protection authorities is available at edpb.europa.eu.

12. International Transfers

We are a US-based company that serves customers globally.

Your personal information may be transferred to, stored in, or processed in the United States or other countries outside of where you reside. When we transfer personal information out of the European Economic Area or the United Kingdom, we rely on recognized transfer mechanisms — such as the European Commission's Standard Contractual Clauses or equivalent UK instruments — unless the transfer is to a country that has been determined to provide an adequate level of protection.

For transfers processed by Shopify on its own behalf, please refer to Shopify's data transfer practices at shopify.com/legal/privacy.

13. Complaints

We'd rather resolve your concern directly. Here's how.

If you have a complaint about how we handle your personal information, please contact us first using the details in Section 15. We will respond promptly and work to resolve your concern.

Depending on where you live, you may also have the right to escalate a complaint to your local data protection authority or to appeal our decision by contacting us directly.

14. Changes to This Privacy Policy

We'll keep this policy current and tell you when it changes.

We may update this Privacy Policy from time to time to reflect changes to our practices, applicable law, or for other operational or regulatory reasons. When we do, we will update the "Last updated" date at the top of this page and post the revised Policy on our website.

For material changes, we will provide notice as required by applicable law — which may include an email notification where we have your contact information.

15. Contact Us

Questions about privacy? Real people read every message.

If you have questions about this Privacy Policy, want to exercise any of your rights, or have a complaint about how we handle your personal information, please contact us: