It says the encryption is done client-side so a salt would be public.

edit: they may be salting with the username or email address.