The developer of Silo collects nothing. There is no account to create, no analytics library, no crash reporter, no advertising SDK, and no network request Silo makes to any server the developer controls. The extension has no backend at all.
The only data Silo handles is what you type into it directly: site titles, URLs, usernames, passwords, and notes for the entries you save.
Everything you save is encrypted with AES-256-GCM using a key derived
from your master password (PBKDF2, 300,000 iterations) before it ever
touches disk. The encrypted vault is stored using the browser's own
chrome.storage API:
chrome.storage.local) by default — on your
device only.chrome.storage.sync) only if you
explicitly turn that on.Your master password itself is never stored anywhere, in any form. It is re-derived each time you unlock the vault and kept only in memory while the browser is open.
Turning on sync in Silo does not send your data to us — it hands the
already-encrypted vault to Chrome's own built-in sync, tied to whichever
Google account is signed into your browser. That data is subject to
Google's own privacy policy and encryption practices for Chrome Sync,
not this one. Silo has no visibility into it either way: it only reads
and writes the encrypted blob through the standard
chrome.storage.sync API.
| Permission | Used for |
|---|---|
storage |
Saving your encrypted vault and preferences via chrome.storage.local
and, only if you opt in, chrome.storage.sync. |
alarms |
Running the auto-lock timer that locks your vault after a period of inactivity you configure. |
| Host access (all sites) |
Detecting login forms so Silo can offer to autofill saved entries or save new ones. This runs locally in the page; form contents are only read when you interact with Silo's own icon or save prompt, and are only ever sent to Silo's own background script — never off-device. |
Vault entries are encrypted with AES-256-GCM; the key is derived from your master password via PBKDF2 with 300,000 iterations and a random salt per vault. A wrong password fails to decrypt rather than being checked against a stored hash. An optional PIN, if you enable one, wraps your master password with its own PBKDF2-derived key — it is a convenience layer, not a replacement for the master password, and is documented as such in the extension itself.
Your data stays on your device (and, if enabled, in your Google account's Chrome Sync) for as long as you keep it there. Uninstalling Silo removes its local storage. Deleting the vault from within Silo removes it immediately and permanently, including from Chrome Sync if that was enabled. Backup files you've exported are files on your disk — Silo has no way to reach or delete those, so remove them yourself when you no longer need them.
Silo is not directed at children and does not knowingly collect any information from anyone, of any age — it does not collect information at all.
If this policy changes, the "last updated" date at the top of this page will change with it. Material changes will also be reflected in the extension's Chrome Web Store listing.
Questions about this policy
contact@laveryjonez.uk
Developer
Unkn0wngb