Privacy Policy
This policy explains what DeX Agent (the iPhone app and the service behind it at api.dexailabs.com) collects, why, who it is shared with, and the choices you have. We wrote it to be read, not skimmed; it is short because we collect little.
1. What we collect and why
| Information | Why we have it | How we get it |
|---|---|---|
| Email address and password | To create and sign in to your account. The password is stored only as a one-way bcrypt hash. | You enter it at sign-up |
| Display name, phone number, profile photo (optional) | To personalize the app and, if you choose, deliver verification codes by SMS. | You enter it in Profile |
| Company name, role, and team invitations | For business accounts: to run your team and keep an audit trail of who was invited. | You enter it; invites you create |
| Questions you ask Dex, and facts you ask it to remember | To answer you and keep continuity between sessions. Stored encrypted; the most recent 20 conversation turns are kept. | You type or speak them |
| Today's calendar events (summary only) | So Dex can answer "what's on today?". The summary accompanies your question and is not retained. Your calendar itself stays on your phone. | From your iPhone's calendar, with your permission |
| Bank account connection (via Plaid) | To show balances and recent transactions, read-only. We store an encrypted access token and Plaid's opaque account identifiers — not your bank login, not account numbers, not balances. | You link a bank in the app; you sign in at your bank |
| Servers you ask Dex to monitor | To run read-only health checks. The SSH key is stored encrypted. | You add them in the app |
| Technical logs (IP address, request path, errors) | To keep the service running and secure. Logs never contain passwords, tokens, bank data or conversation content. Kept 30 days. | Automatically |
We do not collect your precise location, contacts, photos (other than a profile picture you choose), advertising identifiers, or anything from other apps. We do not use tracking SDKs or analytics networks.
2. How we use it
Only to provide the service you signed up for: showing you your day, your money and your systems, answering your questions, and keeping your account secure. We do not use your information for advertising, do not build profiles for marketing, and do not sell or rent it to anyone.
3. Who we share it with
We share information only with the service providers needed to run DeX Agent, each for a single purpose and bound by its own privacy terms:
- Plaid Inc. connects your bank account when you choose to link one. You authenticate directly with your bank through Plaid. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
- Anthropic provides the AI model behind Dex. Your question, together with the context Dex needs to answer it (your account summary, balances if you have linked a bank, today's calendar summary), is sent to Anthropic's API. Anthropic does not use API data to train its models.
- DigitalOcean hosts our servers and database in the United States.
- MailerSend delivers verification-code emails.
- Apple distributes the app and provides Face ID and the Keychain on your device; biometric data never leaves your phone.
We will also disclose information if required by law or legal process, or to protect the rights and safety of our users or the public, and we will tell you unless we are legally prevented from doing so. If Belmont Labs is ever acquired, your information would transfer under this same policy and you would be notified.
4. How we protect it
Every stored credential and token — Plaid access tokens, SSH keys, Dex's memory — is encrypted with AES-256-GCM, with the key held only in our server environment. All connections use TLS 1.2 or better. Our database is not reachable from the internet. The Money section of the app requires Face ID or Touch ID. Our full practices are described on the Security page.
5. How long we keep it
- Account information, Dex's memory, and bank links: for as long as your account exists.
- Bank balances and transactions: never stored; held in memory for at most five minutes.
- Conversation history: the most recent 20 turns; older ones are deleted automatically.
- Verification codes: 10 minutes.
- Server logs: 30 days. Database backups: 14 days.
6. Your choices and rights
- See and clear what Dex remembers: Settings → What Dex remembers.
- Unlink a bank: Money tab → the menu next to the bank. The connection is revoked at Plaid and the token deleted.
- Revoke calendar, microphone or Face ID access: iPhone Settings → DeX Agent.
- Delete your account: Settings → Delete my account. This removes your account, servers, Dex's memory, profile photo and every bank link, immediately. Deleted data leaves backups within 14 days.
- Access, correct, or export your information, or ask a question: email privacy@dex-agent.com. We respond within 30 days.
If you live in California, Virginia, Colorado, Connecticut, Utah or another state with a consumer privacy law, you have the rights described above to access, correct, delete and port your data, and we will not discriminate against you for exercising them. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. If you live in the European Economic Area or the United Kingdom, Belmont Labs is the controller of your data, the legal basis for processing is performance of our contract with you (and your consent for calendar and bank access), and you may lodge a complaint with your local supervisory authority.
7. Children
DeX Agent is for business use by adults. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, email us and we will delete it.
8. Changes
If we change this policy in a way that matters, we will tell you in the app and by email before the change takes effect. The effective date at the top always shows the current version.
9. Contact
Belmont Labs Inc. · privacy@dex-agent.com