InkVault browser extension privacy policy
InkVault Password Manager (the extension) is developed by Evgeny Inkov. This policy describes what happens with your data when you use the extension.
attributes
- project
- InkVault
- extension
- InkVault Password Manager
- browsers
- Chrome, Edge, Brave, Vivaldi, Firefox
- updated
- 2026-10-25
What the developer collects
Nothing. The extension has no analytics, telemetry, crash reports or advertising, and it does not connect to any server run by the developer.
Where your data is
Your logins are kept in your vault. The vault is encrypted on your device with a key derived from your master password (Argon2id, XChaCha20-Poly1305) and is synced through the XMPP server that you choose. The server stores only ciphertext. The master password never leaves your device and is not stored anywhere.
What is stored in the browser
The vault account (salt and wrapped keys, without secrets), the encrypted copy of the vault, the sign-in token of your XMPP account, the device id, the server address and the extension settings. The decrypted vault exists only in memory while the vault is open and is removed when it is locked.
Web pages
The extension reads the login fields of a page only when you ask it to fill them: with the Fill button, the keyboard shortcut or the context menu. It fills one username and password and does not store or send anything from the page.
Clipboard
A copied password is removed from the clipboard after 30 seconds.
Third parties
Your data is sent only to your XMPP server, encrypted, over TLS. It is not sold or shared with anyone.
When Firefox installs the extension, it asks for consent to share authentication information: this means the logins, sent end-to-end encrypted, and the XMPP sign-in data, both only to your XMPP server. The developer receives none of them.
At the first sign-in the extension uses SCRAM, and the server receives only a proof derived from the XMPP password. The password itself is sent over TLS only if the server does not support SCRAM.
If you leave the server address empty, the extension requests https://<your JID domain>/.well-known/host-meta to find it. The request contains no data from the vault.
Deleting data
"Delete vault" removes the vault from the server and from the browser. Removing the extension deletes all data it stored in the browser.