IronVault's full privacy policy is at https://vault.ironmesh.cloud/privacy.html

In short: IronVault is zero-knowledge. Your logins, notes and passkeys are encrypted on your device before they are sent to the IronVault server, which stores only ciphertext and never sees your master password. The extension talks only to vault.ironmesh.cloud (or a self-hosted IronVault server you sign in to). It sends your account email to sign you in and your encrypted vault to sync it; nothing else, no analytics and no advertising. Password breach checks use the Have I Been Pwned range API, which receives only the first 5 characters of a SHA-1 hash. Contact: privacy@ironmesh.cloud