Lubb Vault browser extension: privacy policy

Last updated 8 October 2026

This policy covers the Lubb Vault extension for Chrome and Edge. Lubb Vault is published by Cloud Telecoms (trading as Lubb), "we" below. It fills, saves and creates passwords from your Lubb Team Vault, the password vault that comes with a Lubb Team account. Our company privacy policy covers our other services.

What the extension handles, and where it goes

• Your vault items (logins, passwords, passkeys, cards, identities and notes). They are encrypted on your device with a key made from your master password before they leave it, and are stored encrypted on our server, vault.team.lubb.co.za. We cannot read them, because we never have your master password or that key.
• Your sign-in details. Your work email address and sign-in tokens are used to sign you in with your Lubb Team account (single sign-on at auth.team.lubb.co.za) and to keep you signed in.
• The web page you are on. The extension reads the forms on the page, on your device, to find where to fill in your details and to offer to save a new login. The page address is compared with your saved logins on your device. Page content and your browsing history are not sent anywhere.
• Website icons. To show icons next to your saved logins, the extension asks our server for each website's icon. Our server therefore sees those website names, never the passwords. You can turn icons off in the extension's settings.
• Your device. The device type, a device name and a random device ID are sent to our server, so you can see where you are signed in.

Optional features that contact other services

These contact another service only when you use them:

• Check whether a password has been exposed: sends the first 5 characters of a fingerprint (SHA-1 hash) of the password to Have I Been Pwned (api.pwnedpasswords.com). The password itself is never sent.
• Email alias generator: if you add an API key for an email forwarding service (addy.io, DuckDuckGo, Fastmail, Firefox Relay, ForwardEmail or SimpleLogin), the extension asks that service to create an alias for you.
• Import from LastPass: connects to LastPass, and to your LastPass sign-in provider if you use one, to fetch your data for the import.

What we do not do

• We do not sell or rent your data, and we do not use it for advertising or to assess credit.
• The extension sends no analytics or tracking data to anyone. Our server keeps the usual security logs (sign-ins, devices and IP addresses).
• We share data only as described above, or when the law requires us to.

Keeping and deleting your data

Your vault stays on our server until you delete items or your Lubb Team account is closed. Removing the extension deletes the copy on that computer. To have your vault account deleted, email helpdesk@lubb.co.za.

Security

Vault items are end-to-end encrypted, and everything between the extension and our servers travels over HTTPS.

Open source

Lubb Vault is built from the open-source Bitwarden browser extension (GPL-3.0). It is not made, affiliated with or endorsed by Bitwarden Inc. The source is available at vault.team.lubb.co.za/lubb-brand/source.

Changes and contact

We will update this page if the extension starts handling data differently, and change the date at the top. Questions: helpdesk@lubb.co.za.