Keyhold keeps no data of its own and has no server. The extension reads login forms on the page you are on and sends the username, password and page address only to the Keyhold app on the same computer (127.0.0.1), to fill and save logins. Nothing is sent anywhere else, sold or shared. On a two-step login it keeps the username from the first page in browser memory for up to 10 minutes; the pairing token is stored in the browser. Full policy: https://galusz.github.io/keyhold/privacy.html