Legal

Privacy Policy

Effective 12 November 2026

SKH Vault is a password manager. This policy explains what we store, what we can and can’t see, and the choices you have. It covers the SKH Vault website, the installable web app and the SKH Vault browser extension.

1. What is encrypted on your device

The secret parts of every vault item are encrypted in your browser or the extension before they are sent to us, using AES-256-GCM with a key derived from your password (Argon2id). This includes usernames, passwords, notes, two-factor (TOTP) secrets, payment card details and identity details. We store only the encrypted result and cannot read it.

Turn on a vault password for the strongest protection. If you don’t set a separate vault password, your vault key is derived from your account password, which our server receives when you sign in. With a vault password (Settings → Vault password), the key comes from a password and an emergency key that never leave your device, so no one at SKH Vault could decrypt your vault. We can’t reset a vault password or recover your vault if you lose it and your emergency key.

2. What we store

To run the service we store:

Account details: your name, email address, and your sign-in password as a one-way hash (bcrypt). We never store the password itself.
Vault organisation: each item’s name, its website address and the folder it’s in. These are not encrypted, so we can list, search and match logins to websites. Don’t put secrets in item names.
Encryption data: a random salt and a check value used to confirm the right password was entered. Neither can be used to decrypt your vault.
Security data: if you turn on two-factor sign-in, its secret (encrypted at rest), and sign-in tokens for the browser extension, which expire.
Technical data: your IP address and browser details in short-lived server logs and rate-limit counters, used to keep the service secure.

We do not use analytics, advertising or tracking tools, and we don’t build profiles about you.

3. The browser extension

What it reads: on the pages you visit, the extension looks for visible sign-in fields (username, email and password) so it can offer your saved logins. It does not read or collect page content, browsing history or other form fields.
Filling: it fills a login only when you choose it, and only on the exact website it was saved for.
Saving: after you sign in to a site, it can offer to save that login. The username and password are held temporarily in the browser’s memory until you save or dismiss the offer (at most 10 minutes), and are encrypted before being sent to us if you save.
On your device: it keeps your sign-in token and settings in the extension’s storage. While unlocked, your vault key is kept in memory for the browser session; if you choose “Keep me signed in for 30 days”, a non-exportable copy of the key is stored in the extension’s storage on that device until it expires or you sign out.
Connections: the extension only talks to the SKH Vault server. It does not send data to anyone else.

The use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell or transfer this data, use it for anything other than providing the password manager, or use it to determine creditworthiness or for lending.

We never sell your data. We share only what’s needed with providers that help us run the service:

Hosting: our servers and database are run by our hosting provider.
Email: our email provider delivers account emails (email confirmation, password reset, security codes and notices). We don’t send marketing email.
Website icons: to show a site’s logo next to your logins, our server looks up the website’s domain name (for example example.com) with the logo service logo.dev. Only the domain name is sent, never your account or vault data.

We may disclose information if required by law, and only what the law requires. Encrypted vault data is useless to anyone without your key.

5. Cookies and local storage

We use only essential cookies: one to keep you signed in and one to protect forms from cross-site attacks. The web app also stores some data in your browser: your preferences, an optional offline copy of your encrypted vault, and the keys needed to unlock it on that device. Signing out clears them.

6. Keeping and deleting your data

We keep your data while your account exists. You can delete your account at any time under Profile → Delete account; this permanently removes your account, vault items and folders. Copies in our backups are deleted when those backups expire, within 30 days. Server logs are kept only for a short period for security and troubleshooting.

7. Security

Besides end-to-end encryption of your secrets, we use HTTPS everywhere, strict security headers, optional two-factor sign-in, rate limiting and short-lived extension tokens. Changing your password signs out your other sessions. No system is perfectly secure; if you find a vulnerability, please tell us at the address below.

8. Your rights

You can view and correct your account details in your Profile, export your vault in Settings, and delete your account at any time. Depending on where you live, you may also have rights to access, correct, delete, restrict or object to how we process your personal data, and to complain to your data protection authority. Contact us to make a request.

9. Children

SKH Vault is not intended for children under 13, and we don’t knowingly collect their data.

10. Changes to this policy

If we change this policy, we’ll update the date at the top. For significant changes we’ll let you know by email or in the app.

11. Contact

Questions or requests about privacy: support@skhvault.app. You can also reach us through the support page.