Last updated: August 13, 2026
SkilledGuard is a zero-knowledge password manager browser extension. This page explains, in plain language, what data we collect, why, where it is stored, and what we never do with it. If anything here is unclear, email us at support@skilleddesk.com.
Your Master Password never leaves your device, in any form. All of your vault data — logins, notes, cards, TOTP secrets — is encrypted and decrypted locally in the extension, using a key derived from your Master Password. Our server only ever sees encrypted data. We cannot read your passwords, and we cannot decrypt your vault, even if we wanted to or were compelled to.
| Data | Why we collect it |
|---|---|
| Email address | Used as your account identifier and for account recovery communication. |
| Auth hash | A one-way value derived from your Master Password (never the password itself) used to verify it's you when you log in. It cannot be used to reconstruct your Master Password or decrypt your vault. |
| Encrypted vault items | Your saved logins, notes, and other items — stored as opaque encrypted blobs we cannot read. |
| Wrapped encryption keys & salts | Cryptographic material needed to let your own device re-derive your vault key. Useless without your Master Password. |
We do not collect browsing history, the content of pages you visit, or analytics/telemetry about how you use the extension. The extension does not include any third-party analytics, advertising, or tracking SDKs.
All account and vault data is stored on our own backend server, in a MariaDB database that we operate. We do not use third-party cloud storage or third-party sync services. Your decrypted Master Key exists only in your browser's memory while the vault is unlocked, and is cleared when you lock or log out — it is never written to disk or sent anywhere.
SkilledGuard can check whether your saved passwords have appeared in known data breaches, using the Have I Been Pwned (HIBP) "Pwned Passwords" service. This is done using k-anonymity: your device computes a SHA-1 hash of the password locally and sends only the first 5 characters of that hash to our backend (which forwards it to HIBP). The remaining part of the hash — and your actual password — never leave your device. The match against the breach corpus is completed locally on your device using HIBP's response. Your full password and your email address are never transmitted to HIBP.
Your data is retained for as long as your account exists. You can request deletion of your account and all associated data at any time by contacting support@skilleddesk.com.
If this policy changes, we will update the "Last updated" date above. Continued use of the extension after a change constitutes acceptance of the updated policy.
Questions or concerns about your privacy or data can be sent to support@skilleddesk.com.