Effective Date: October 28, 2026
Hidden Spectrum, LLC (“Hidden Spectrum,” “we,” “us,” or “our”) develops Dextr. This Privacy Policy explains how information is handled when you use Dextr, including optional connections to external AI applications through the Model Context Protocol (“MCP”).
1. Your Contacts and Other User Content
Dextr’s core contact-management features store and process your contacts and associated content on your devices, with synchronization and backups through your own Apple and iCloud services where enabled. We do not receive your contact database merely because you use Dextr, and we do not send your contacts or other user content to our analytics, attribution, or subscription-management providers.
Optional MCP connections are different. If you enable a connection to an external application or assistant, that application can access information through Dextr’s available tools within the access you authorize. Information it retrieves may be sent to its provider or other connected services. It may therefore leave your device and iCloud account. Section 12 explains these connections in more detail.
2. App, Device, Attribution, and Subscription Information
We collect limited information about the app, device, and purchases to operate Dextr and understand its performance and use. This may include:
- App interactions and feature-use events.
- Device type, operating system, app version, and language.
- Diagnostics and performance information.
- Permission status, including whether notifications or location access are enabled.
- Campaign, referrer, attribution, and deep-link information associated with Dextr or creator links.
- Subscription and purchase details, including product and transaction identifiers, price, currency, purchase date, and storefront region.
We use PostHog for analytics and diagnostics, Dub for campaign and creator-link attribution, and RevenueCat for subscription services. We do not use Apple’s IDFA for advertising tracking.
3. How We Use Information
We use the information described in Section 2 to run and improve Dextr, assess feature use and performance, investigate bugs and reliability problems, measure installs and campaign attribution, route deep links, and process or validate subscriptions and purchases.
When you enable an MCP connection, Dextr also processes connection requests, tool inputs, and tool results to provide the access and functionality you authorize. These operations may retrieve or change information in your Dextr library and supported synchronized records. The connected application separately processes information under its own policies, as explained in Section 12.
4. When Information Is Shared
We do not sell or rent your personal information. We disclose the limited app, device, attribution, and subscription information described above to service providers that support Dextr, including PostHog, Dub, and RevenueCat, for their respective functions.
If you choose an MCP connection, Dextr makes information available to the external application you connect through the tools and access you authorize. That application may transmit information to its AI provider or other services used to carry out your request. This is a separate disclosure from Dextr’s use of analytics, attribution, and subscription service providers.
We may also disclose information we hold when required by law or legal process, or when necessary to protect Dextr, our users, or others. We remain responsible for our own handling of information and for obligations applicable to service providers acting on our behalf.
5. Consent and Permissions
Dextr uses Apple’s system permissions for access to device information and features, such as contacts, notifications, and location. You can grant or deny those permissions through the applicable system controls. We do not request App Tracking Transparency permission for IDFA because we do not use IDFA for advertising tracking.
Opening a Dextr, creator, or campaign link may involve processing link and attribution information to route the link and measure performance.
MCP access is optional and requires you to enable or configure a connection. Granting Dextr permission to access your contacts does not, by itself, authorize an external AI application to access them. Accepting the EULA or acknowledging this Privacy Policy does not replace any separate consent required by law.
Before enabling a connection, review the application, the information and tools it can access, and the provider’s policies. A connection may provide continuing access to available tools; do not assume that every read or action will require a separate confirmation. Any access must remain within the authorization and permissions you have provided.
6. Your Choices and Privacy Requests
You can manage device permissions in iOS, iPadOS, or macOS settings, as applicable. App Store subscriptions are managed through your Apple account.
To stop using an MCP connection, remove or disable the Dextr connection in each external application you connected. Quitting Dextr stops its local MCP service while the app is closed. Removing one application’s connection does not remove connections configured in other applications or automatically invalidate copies of a connection key.
Disconnecting does not erase information already received by an external application or provider, remove conversation history or provider logs, or undo actions already performed. Use that provider’s controls or contact it directly to request deletion or exercise rights concerning the copies it holds. Requests to Hidden Spectrum remain available for information we hold or for which we are legally responsible.
Depending on applicable law, you may have rights to access, correct, delete, obtain a copy of, or restrict certain uses of your personal information, and to withdraw consent or appeal a decision about a privacy request. Contact support@dextr.app to submit a request or ask about available rights. We will handle requests as required by applicable law; withdrawing consent does not affect processing that was lawful before withdrawal.
7. Data Security and Connection Keys
We use reasonable technical and organizational protections, including appropriate access controls and encryption for information transmitted to our service providers. No system can guarantee complete security.
Dextr’s local MCP service on supported Macs uses a connection key to authenticate access. Dextr stores its connection settings in the macOS Keychain. Setting up an external application may also create a copy of the key in connection or plugin configuration used by that application. Treat the key as a secret: an application or person with a valid key and local access may be able to invoke Dextr’s available tools.
A local connection between Dextr and an AI application does not ensure that the application keeps retrieved information local. Its provider may process that information in the cloud. Incorrect AI results, compromised applications, or malicious instructions in external content can also cause unintended disclosures or changes. Review the access you grant and contact support@dextr.app if you believe a connection key has been exposed.
8. Retention and Deletion
We and our service providers keep the information we handle for as long as reasonably needed to provide and improve Dextr, assess performance and attribution, administer subscriptions, meet legal requirements, resolve disputes, and enforce agreements.
Your Dextr library remains subject to the storage, synchronization, and backup controls of your devices and Apple account. Changes or deletions may synchronize to connected devices and accounts. We do not maintain an independent server-side copy of your contact database for restoration through the local MCP feature.
Information obtained by an external application through MCP may remain in its conversations, logs, caches, or backups after you disconnect, delete information in Dextr, or uninstall Dextr. The recipient’s retention and deletion policies determine how long those copies remain, subject to applicable law. We cannot guarantee deletion of copies held by independent providers, and this does not limit our own legal obligations.
9. International Processing
We and our service providers may process information outside your country. Where required, we use appropriate safeguards for transfers for which we are responsible.
An external application or AI provider you connect may also process or store information retrieved through MCP in other countries. Review that provider’s information about processing locations and transfer safeguards. Our use of safeguards for our service providers does not represent a guarantee about an independent provider you choose.
10. Changes to This Policy
We may update this Privacy Policy as Dextr’s features and practices change. We will publish the revised policy on our website or in the app and update its date. For material changes, we will provide any additional notice, choices, or consent required by law. An update to this policy alone does not authorize a new MCP connection or expand access you have granted.
11. Contact Us
For questions about this policy, MCP-related privacy concerns, or privacy requests, contact Hidden Spectrum, LLC at support@dextr.app or through https://dextr.app/support.
12. Optional MCP and External AI Connections
How the connection works
On supported Macs, Dextr can provide a local MCP service that a connected AI application uses to query or act on your library. The local service operates on your Mac. The external application may then include information it retrieves in prompts, conversations, or other requests sent to its AI provider. Hidden Spectrum does not receive your contact library merely because that local connection is enabled.
Information that may be accessed
Depending on the available tools and your authorized access, the connected application may retrieve contact details and associated library information, such as notes, journals, tags, relationships, reminders, events, places, and interaction records. Requests and responses may also contain search terms, identifiers, instructions, tool arguments, results, and technical connection information. Access may cover more than a single contact or item mentioned in your prompt.
Actions and information about other people
Available tools may allow the application to create, edit, organize, or delete records as well as read them. Changes can affect synchronized contacts, devices, and accounts. Review important actions and maintain independent backups. Information you share may identify other people or include confidential details; share only information you have authority to disclose and obtain any required permissions.
Provider use, retention, and AI training
The external application, its AI provider, and any other services you authorize may receive and use retrieved information under their own agreements and privacy policies. Depending on the provider, product, account, and settings, this may include storing conversation or tool history, security or abuse review, human review, onward disclosure, and use for model improvement or training. Do not assume that a provider excludes your information from training merely because you access it through Dextr.
Review the provider’s privacy, retention, and training controls before connecting, and select the settings appropriate for the information involved. Hidden Spectrum does not set or control an independent provider’s policies and cannot guarantee how it handles information once received. Our own processing and any processing for which we are legally responsible remain subject to this policy and applicable law.
Connection choices do not waive your rights
Your decision to connect an external application does not waive privacy rights, authorize access beyond the permissions you grant, or relieve Hidden Spectrum of duties that applicable law places on us. Contractual terms about MCP risks and liability appear in Dextr’s EULA; they do not replace the privacy disclosures or permissions described here.