Last updated: 25 August 2026

StackyOps Vault ("the extension") is a companion for StackyOps, a self-hosted platform operated by your own
organization. This policy explains exactly what data the extension handles and where it goes.

## Summary
The extension collects no data for the developer (excelit-it) or any third party. Your data moves only
between your browser and the StackyOps server your organization operates and controls.

## What the extension handles
- Login credentials (usernames and passwords) that you fill, reveal, save, or generate on websites.
- The current tab's website address (host) — used only to find matching logins for the site you are on.
- A pairing token and your server URL — created by you in your StackyOps workspace to connect the
extension.
- Your extension settings (for example, whether auto-save is on).

## Where the data goes
- Credentials and the site host are sent only to the StackyOps server whose URL you enter when pairing.
They are never sent to excelit-it, to the browser vendor, or to any third party.
- Your pairing token and settings are stored locally in your browser (browser extension storage) and are
only ever transmitted to your own StackyOps server, as an authorization (Bearer) token, to authenticate
your requests.
- The extension makes network requests to no other destination than the StackyOps server you configure.

## What we do NOT do
- We do not collect, receive, store, sell, or share your personal data or credentials.
- We do not use analytics, tracking, advertising, or fingerprinting.
- We operate no servers that receive data through this extension.

## Permissions
The extension requests access to the websites you visit ("all sites") so it can, on those sites, read login
forms to autofill saved logins and offer to save new ones. It acts only while the extension is paired with
your StackyOps server and the feature is enabled. It never submits forms on your behalf and reads a page
only to fill or capture a login you choose.

## Your control
- You can disconnect the extension at any time, which removes the stored token and settings from your
browser.
- Your administrator can revoke your device token in StackyOps at any time, immediately ending the
extension's access.
- Reveals and changes to credentials are recorded in your organization's own StackyOps audit log, controlled
by your organization — not by us.

## Data retention
excelit-it retains none of your data, because it never receives any. Credentials and audit records are
retained by your organization's StackyOps server under your organization's own policies.

## Contact
Questions about this policy: info@excelit-it.com (excelit-it, Berlin, Germany).

A couple of notes:
- I dated it 25 August 2026 (today) — change if you prefer.
- If StackyOps is cloud-hosted by excelit-it for some customers (rather than always self-hosted), tell me —
one line would need adjusting, since in that case excelit-it does operate the server that receives the
data. As written, it assumes the customer runs their own StackyOps.