Privacy Policy

1. What Data We Collect

The app does not ask for your name, email address or location; the few things it sends that can identify a Mac, such as a hashed machine identifier at license activation, are in the table below. The app runs entirely on your Mac and processes information locally. Here is an accounting of what the app reads, stores, and (in narrow disclosed cases) transmits; Section 3 lists where it is stored:

Data Type	Handling	Details
AI agent config files	On your Mac	Read from folders you explicitly grant access to. Config structure is analyzed on your Mac, and Dryx does not send the files; the parts that can leave, such as a server's name for a registry check you allow and finding text for your agents or a webhook you set up, are described in Sections 2 and 4.
Secret key names	On your Mac	Key names (e.g., OPENAI_API_KEY) and their file paths are stored on your Mac. An agent that asks Dryx through the Authority Anchor can receive finding text that names a key (Section 2), and a webhook you set up can receive key names, depending on the level of detail you choose (Section 4). Dryx reads secret values in memory while it inspects, and keeps a secret key's name and location, not its value. Quoted text can still hold a secret: when a line in an agent instruction file matches a prompt-injection pattern, its finding keeps up to 80 characters of the line, with recognized secrets redacted, and a monitoring alert quotes up to 60 characters of it without that redaction; an alert about a newly added MCP server includes its command and URL. A webhook you set up can receive them (Section 4).
MCP server names	On your Mac	Names of configured MCP servers are stored on your Mac. Server names (not your data) may be sent to the MCP Registry API for verification. See Section 4. They also appear in what the Authority Anchor tells your agents, and in webhook alerts you set up.
Inspection results & findings	On your Mac	Stored in a SQLite database at ~/Library/Containers/ai.dryx.Dryx/Data/Library/Application Support/RootShield/ (Section 3). Finding text reaches an agent that asks Dryx through the Authority Anchor (Section 2) and a webhook you set up (Section 4).
Behavioral baseline data	On your Mac	Per-agent behavioral metrics across inspections (capability counts, edge counts, secret counts, etc.) used to detect anomalies. Stored in the same local SQLite database. When a metric moves far from its baseline, the finding Dryx raises states the current value and the baseline, and goes where findings go (Sections 2 and 4).
Drift & monitoring history	On your Mac	Time-series of inspection snapshots and continuous-monitoring events. Stored locally. Never transmitted unless you configure a webhook (Section 4).
Skill Shield analysis history	Local only	Records of pre-install analyses you've run (skill name, capabilities detected, risk rating). Stored locally. Never transmitted.
Preferences	On your Mac	Appearance settings, filter states, dismissed hints and the other settings listed in Section 3, stored in UserDefaults on your Mac.
Skill / MCP package contents (when you initiate Skill Shield analysis)	Fetched, analyzed locally	When you paste a URL into Skill Shield, Dryx fetches that package (e.g., from GitHub, npm, ClawHub) over HTTPS for analysis. Standard HTTP request only — no user data is sent in the request beyond what your browser would send. Analysis happens locally after fetch.
Personal information	At license activation	The app does not collect your name, email address or location. License activation (direct download) sends your license key and a one-way hash of this Mac's hardware identifier to our license provider, so a license can be tied to a machine. A webhook you set up receives a random per-install handle that names this Mac in each delivery, never the hardware identifier, at your own endpoint. Like any web request, the app's connections show your IP address to the server they reach. Your purchase email is in the licensing record (Section 8).
App usage analytics	None	The Dryx app performs no usage analytics — no click tracking, session recording, or behavioral analytics of any kind. (The dryx.ai website uses cookieless, aggregate analytics — Plausible — disclosed above.)
Crash reports	None	No crash data is sent to us. If you opt in to Apple's crash reporting in System Settings, Apple may collect standard crash logs under their own privacy policy.
Advertising / IDFA	None	No advertising identifiers, no IDFA, no fingerprinting, no tracking pixels.
App tracking	None	Dryx does not request or use App Tracking Transparency permissions and does not track users across other companies' apps or websites.

2. How We Handle Secrets

Dryx is a developer tool that maps where your AI-agent secrets are exposed. We take extra care with this responsibility:

• For a secret key it finds, Dryx keeps the name and location, never the value. Dryx reads file contents in memory to detect that a key named OPENAI_API_KEY exists at a specific file path and line number, and records that name and location. Text Dryx keeps as written from your files can still hold a secret: when a line in an agent instruction file matches a prompt-injection pattern, its finding quotes up to 80 characters of it with recognized secrets redacted, a monitoring alert records up to 60 characters of it as written, and both can reach a webhook you set up (Section 4).
• Dryx sends no secret data to a server Dryx runs. Inspection and verdicts run locally. A webhook you set up can receive key names and text quoted from your configuration, as Section 4 describes. One route is not Dryx's: what the Authority Anchor tells your agent becomes part of that agent's context, which its vendor may transmit under its own terms — today that includes finding text with key names and file paths; Dryx is moving those answers to counts and handles.
• Inspection results name a secret key, not its value. Findings in the UI and in exports give a secret key's name and file location, never its value; a finding about a matched instruction-file line quotes up to 80 characters of that line, with recognized secrets redacted.

3. Local Storage

Dryx stores data in the following locations on your Mac. All of them remain entirely under your control.

• SQLite database — ~/Library/Containers/ai.dryx.Dryx/Data/Library/Application Support/RootShield/ — Contains inspection history, behavioral baselines, drift records, monitoring events, Skill Shield analysis log, findings, and bookmarks. This database holds the inspection history and analysis log; Dryx also writes the files listed on this page.
• Authority Anchor files — ~/.dryx/ — The scan export your agents read through the Anchor (posture, agents, MCP servers and findings, with no secret key's value; a remote MCP server's address is copied as configured, so a token written into that address is copied too), the signed workspace policy, the attestation and gate-event ledgers, and the Anchor server and gate scripts. Owner-only permissions; readable by other software running as you, like any file in your home folder.
• UserDefaults — Standard macOS preferences storage — Contains appearance settings, filter states, monitoring and Context Shield state, and UI preferences; the update-check switch; the names of MCP servers you turned registry checks on for; if you set up a webhook, its address, the header value you enter for it (for example an access token) and any fleet labels; and, while Context Shield has changed an instruction file, a copy of that file's original text (up to 256 KB) so you can restore it. It sits inside the app's container.
• Security-scoped bookmarks — Stored by macOS to remember folders you granted access to via the system file picker (NSOpenPanel). You can revoke access at any time by removing bookmarks in the app.
• App Group container — A macOS app-group container shared between the Dryx app and the optional macOS widget. Used to share posture data with the widget: the score and grade, finding counts, the top three score drivers, the most recent alert, and the top finding's sentence, which can name a secret key and where it was found. This data never leaves your device.
• Authority Anchor MCP server file — A local MCP server file is created in your local user directory so AI agents on your machine can query Dryx's posture data through their standard MCP protocol. The file is local-only and contains no user data — it's an executable script.
• Context Shield shadow copies (when enabled) — If you opt into Context Shield, Dryx maintains a shadow copy of each agent instruction file it has written to, so you can roll back its changes with one click. Shadow copies are local-only.

To remove Dryx: in the app, turn Action Guard off and remove any Cursor and Codex hook entries it shows, then turn the Authority Anchor off, then disable Context Shield — each removes what it placed. Then remove the app, ~/.dryx, and the container folder named above. Backups made while Dryx ran keep whatever they captured. No data persists on any external server because no data is ever sent to one (except as expressly disclosed in Section 4).

4. Network Requests & Third-Party Services

Dryx makes a small, deliberately-limited set of outbound network requests, all explicitly disclosed below. None of them transmit your inspection data, secret names, or behavioral telemetry to Dryx-controlled servers. The one Dryx-operated host the app contacts is the release server, for the once-a-day update check described below; the app does not contact the website's license service (Section 8); license activation goes to our license provider at api.keygen.sh.

Update check (on by default, once a day)

Dryx asks releases.dryx.ai whether a newer version exists and tells you if one does. The request carries only the app version and the platform — no machine identifier, no inspection data, no telemetry. Dryx does not download or install updates itself; it points you at dryx.ai/download. Turn the check off in Settings → General ("Check for updates automatically").

Payment processing (direct-download purchases)

Paid plans are sold via direct download from dryx.ai and processed by our merchant of record, Paddle. Payment happens in Paddle's checkout — Dryx (the App) never sees, processes, or stores your payment information; Paddle's handling of that data is governed by Paddle's Privacy Policy. The Mac App Store version is free and involves no purchases and no StoreKit transactions.

MCP Registry API (off by default, per-server opt-in)

Dryx never queries the registry on its own. If you turn the lookup on for a specific MCP server (a per-server choice in the findings panel; revoke it in Settings), Dryx queries the public MCP Registry API (registry.modelcontextprotocol.io) to verify whether that server is known and recognized. The query contains only the MCP server name — no user data, file paths, secret names, or machine identifiers are included.

With the lookup left off, inspections complete exactly as before; servers are simply classified with reduced trust information.

Skill Shield package fetches (user-initiated)

When you paste a URL or package identifier into Skill Shield (for pre-install analysis), or click to have Dryx read one, Dryx issues an HTTPS request to that address and, when the address is a registry entry or listing page, to where it points for the package: the registry itself or the GitHub source it names. The hosts it can reach are GitHub (github.com, www.github.com, codeload.github.com), npm (registry.npmjs.org, npmjs.com, www.npmjs.com), ClawHub (clawhub.ai and its download service, wry-manatee-359.convex.site), MCP.so, Smithery.ai and Glama.ai. Standard HTTP request headers only — no user data, inspection results, or telemetry is included. Fetched package contents are analyzed locally after download. Whatever logging the receiving registry performs is governed by that registry's privacy policy, not Dryx's.

SIEM/SOAR webhook output (user-configured, opt-in)

If — and only if — you explicitly configure a webhook URL in Settings → Integrations, Dryx will POST inspection summaries and monitoring events as JSON to that URL, with a random per-install handle naming this Mac in each delivery, never the hardware identifier. The endpoint is your endpoint (a SIEM, SOAR, or HTTP collector you control or that your organization controls); Dryx does not operate it. You control:

• What is sent. Privacy modes let you choose redacted output (findings with no file paths and with key names replaced by placeholders), executive-summary output (the score and each finding's general sentence, with no files or key names), or full output (the same data you'd see in an export). Monitoring alerts keep their text at every level, with home-folder paths shortened below Full.
• Whether secret values are included. For a secret key Dryx finds, a delivery carries at most the key's name and file location, not its value. Quoted text is different: at the Full level, a finding about an agent instruction file can quote up to 80 characters of the line it matched, with recognized secrets redacted; at any level, a monitoring alert can quote up to 60 characters of such a line without that redaction, and an alert about a newly added MCP server includes its command and URL. A secret written in those places can be sent.
• When to disable. Disable the webhook in Settings to stop transmission immediately.

Authority Anchor MCP (local-only API exposed to your AI agents)

Dryx runs a local MCP (Model Context Protocol) server that exposes read-only security-posture queries to AI agents installed on your machine (e.g., Claude Code, Cursor). This server is local-only — it never makes outbound network calls. It listens for queries from agents on your local machine.

When your AI agents query Authority Anchor MCP, the response travels over your machine's local MCP connection. Dryx does not control what happens after your agent receives the response — if your AI agent transmits its overall conversation context to its own provider (Anthropic, OpenAI, etc.), that transmission is governed by your AI agent's provider, not by Dryx.

Connections addressed to this Mac

The Dryx app listens on 127.0.0.1, the loopback address, so the Authority Anchor your agents start can reach it; programs on other machines cannot connect to it, and the connection itself never leaves your Mac. During an inspection, Dryx may also send a short request to a port on 127.0.0.1 to see whether a local server your agents use is running.

Direct download license activation (dryx.ai version only)

If you purchase Dryx through direct download from dryx.ai (not the App Store), license activation may verify your license key with our license-server endpoint. The activation requests carry the license key and a machine identifier (a one-way hash of this Mac's hardware identifier), and no inspection data. Choosing "Deactivate this Mac" sends the license key and the same machine identifier to api.keygen.sh to free the seat when you are online; offline, that request is skipped and this Mac is still deactivated. Mac App Store users do not encounter this; that version is free and involves no licensing.

5. Folder Access Permissions

Dryx requires read access to AI agent configuration directories to perform inspections. This access is granted explicitly by you through the macOS system file picker (NSOpenPanel) and stored as security-scoped bookmarks.

• Read access for inspection is the default and covers the vast majority of Dryx's use. An inspection reads your configurations. When these features are on, it also writes back Dryx's own entries: with the Authority Anchor on, Dryx's entry in each detected agent's configuration; with Action Guard armed, Dryx's hook in Claude Code's settings if the hook has gone missing (unless you removed it yourself); and with Context Shield on, the section you approved, if something removed it (Dryx tells you when it does).
• You choose exactly which folders to grant access to.
• You can revoke access at any time from within the app.
• On the App Store version, all file access is governed by macOS App Sandbox restrictions.

5.1 Optional features that write to your files (user opt-in)

Some optional features require Dryx to write to files on your machine. These are off by default and require explicit user opt-in; each removes what it placed when you turn it off.

• Context Shield — When you enable Context Shield in Settings, Dryx writes a marker-delimited block of security context into your AI agent's instruction file (e.g., ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, .cursorrules, equivalent for your agent). The block is bounded by clear markers so the content Dryx added can always be identified and removed. Disabling Context Shield removes the block; a Context Shield "Cleanup" action removes any orphaned blocks in known locations.
• Shadow copies — To support one-click rollback if anything (Context Shield, an AI agent, or any other tool) modifies an instruction file, Dryx maintains shadow copies of those files locally. Shadow copies are local-only and never transmitted.
• Quick Fix actions — If you click a "Quick Fix" pill on a finding (for example, "rotate this exposed secret" or "remove this orphaned config"), Dryx may execute the suggested remediation, including removing or modifying files. Each Quick Fix surfaces the exact actions before you confirm; nothing runs without your explicit click.
• Removing orphaned configurations (Ghost Agent cleanup) — If you choose to clean up a detected orphaned configuration directory, Dryx will move the directory to your macOS Trash on your confirmation. This is also a user-initiated action.

None of these write actions transmit data outside your Mac. They are explicit, opt-in, and surfaced in the UI; each removes what it placed when you turn it off. Until Dryx ships a single Withdraw screen, hook entries and Anchor registrations are removed by turning Action Guard and the Anchor off in the app before uninstalling.

6. Notifications

Dryx uses local macOS notifications (via UNUserNotificationCenter) to alert you about monitoring events and inspection results. These notifications are generated and delivered entirely on your device. No push notification infrastructure or external notification service is used.

7. Children's Privacy

The app does not ask anyone for a name, email address, age or location, and purchasing (the licensing record in Section 8) is an adult transaction, so Dryx does not knowingly collect personal information from children under 13 (or under any other age threshold in COPPA, GDPR-K, or equivalent regulations). What the app sends at license activation, and to a webhook you set up, is described in Section 1.

8. Data Sharing and Transfers

We do not share, sell, rent, or transfer your data to any third party. There is no app user data of ours to share — Dryx has no server infrastructure that receives your inspection data, workspace contents, or app usage, no database of such records, and no analytics pipeline for app usage. The narrow exception is purchasing and licensing: our license service (a Cloudflare Worker we operate) processes purchase fulfillment and the self-serve requests described above, and keeps a minimal licensing record (purchase email, plan, and license/assent facts — never anything the app inspects). The dryx.ai website's cookieless visit analytics (Plausible) are aggregate and anonymous, never tied to an individual, and never sold.

The outbound network requests Dryx makes are exhaustively listed in Section 4. Briefly:

• License activation and verification for direct-download purchases (license key + machine identifier only)
• Update check (app version and platform only, once a day)
• Optional MCP Registry name lookups (server name only)
• Skill Shield package fetches (when you paste, drop or click to read a package)
• Webhook output to your own endpoint (only when you configure one)

None of these transfer your data to Dryx-controlled servers. We do not aggregate, profile, or sell your data.

9. Data Retention

Data the app generates is stored locally on your Mac and retained until you choose to delete it; copies that leave your Mac (Sections 2 and 4) are kept by whoever receives them. You are in full control of what is on your Mac:

• Delete individual inspection snapshots from within the app.
• Remove Dryx as described above: turn its features off in the app first (each removes what it placed), then remove the app, ~/.dryx, and the container folder. Backups made while Dryx ran keep whatever they captured.
• Dryx keeps no server-side record of anything the app inspects; for licensing, it keeps the minimal record described in Section 8.

10. Security

Dryx is designed with a security-first architecture:

• App Sandbox — The Mac App Store version runs in Apple's App Sandbox with minimal entitlements (user-selected file access, app-scoped bookmarks, network client/server — used for the disclosed endpoints and the local loopback IPC). Outbound network use is limited to the endpoints disclosed in Section 4 — a commitment Dryx keeps and you can verify with a network monitor, not an OS-enforced restriction: the sandbox does not scope network access by endpoint.
• Hardened Runtime — Code signing with hardened runtime enabled, preventing code injection and unauthorized library loading.
• Minimal remote attack surface — no Dryx server component ever receives your inspection data or workspace contents, so no remote compromise can expose what you inspect; the license service (Section 8) holds only the minimal licensing record.
• Notarized — The direct download version is notarized by Apple, verifying it has been checked for malicious content.
• Deterministic, no-LLM architecture — Dryx's analysis engine is rule-based and deterministic. There is no LLM in the security-analysis path, so the verdict itself can't be prompt-injected; the agent it protects still can.
• Patent pending — U.S. filings since April 2026. See dryx.ai/patents.

11. Subscriptions, Auto-Renewal, and Billing

Dryx offers optional paid plans that unlock additional features. Free use of Dryx does not require any subscription.

Mac App Store version (free)

The Mac App Store version of Dryx is free, read-only inspection. It has no paid subscriptions or in-app purchases. All paid plans (Pro, Team) and the Founding Lifetime are available only via direct download from dryx.ai.

Direct-download plans and the Founding Lifetime (dryx.ai)

Paid plans and the Founding Lifetime are purchased through dryx.ai via Paddle, our merchant of record, which handles billing, tax, and a customer portal for managing or canceling your subscription. Billing, refunds, and cancellation are governed by the Terms of Service at dryx.ai/terms and the Refund Policy at dryx.ai/refunds.

12. Children's Privacy (continued)

Dryx is intended for adult professional use (typically developers, security researchers, and IT/compliance professionals). The product is not directed at children under 13. The App does not ask anyone for a name, email address, age or location, and Dryx does not knowingly collect personal information from children.

13. Changes to This Policy

If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page and, where practical, notify users through the app. Dryx is offline-first: your workspace stays on your Mac, and what does leave is listed in Section 4. There is no data-contribution channel in Dryx today; if we ever introduce an opt-in way to contribute anonymized data, it will be off by default, disclosed on this page first, and never required to use Dryx.

14. Your Rights

Under GDPR, CCPA, and other privacy regulations, you have the right to access, correct, delete, and port your personal data. For what the app inspects, these rights are inherently satisfied: Dryx stores no inspection or usage data on any server, and the app's own records are in your possession, on your machine, under your control. For the minimal licensing record described in Section 8 (purchase email, plan, and license/assent facts), email [email protected] to exercise access, correction, or deletion — honored to the extent consistent with our record-keeping obligations (tax, accounting, and evidence of the license itself). You can:

• View Dryx's stored inspection data in ~/Library/Containers/ai.dryx.Dryx/Data/Library/Application Support/RootShield/, and the other locations Section 3 lists
• Delete individual inspection snapshots from within the app
• Remove Dryx at any time: turn its features off in the app first (each removes what it placed), then remove the app and its data folders
• Disable any optional feature (Context Shield, Continuous Monitoring, Webhook Output, Authority Anchor MCP) from Settings

If you have any questions about your data or this policy, we are happy to help.

15. Contact

If you have questions or concerns about this privacy policy or Dryx's data practices, contact us at:

Email: [email protected]

Website: dryx.ai

Operator: Dryx AI, Inc., a Utah corporation. Founder and inventor of record: Matthew Jackson. Salt Lake City, Utah, United States.