Kipass Web collects, transmits, and sells no data. The vault is decrypted entirely in the browser (Argon2, AES/SHA/HMAC, ChaCha20/Salsa20) and stays in session memory — cleared on close. No third-party server: the only network traffic is what you configure yourself (a WebDAV source, or optional favicon fetching for a site).