Privacy Policy

DEX is an invitation-only service. This page describes what we collect, why, and how it's used — including when you sign in through the DEX Custom GPT in ChatGPT.

Last updated: July 7, 2026.

Who we are

DEX (dexindex.ai) is operated by Strange Orbit. DEX provides invited limited partners and sponsors with scoped access to their own investment reports and market commentary for real estate deals they are a party to.

What we collect

DEX does not have public signup, a marketing list, or account creation. Each person is provisioned individually, ahead of time, as a named tenant. For each tenant we hold:

Identity — a display name and the entity you represent (e.g. your name and your LLC), tied to a private six-word phrase we send you directly. Entitlement scope — which deal(s) and which role (LP or sponsor) you're allowed to see. Audit records — timestamped sign-in attempts (success/failure), which scope was used, and general outcome. We do not collect a password, email address, or payment information as part of sign-in itself.

What we don't collect

We don't use cookies for advertising or cross-site tracking, don't sell or share your data with third parties for marketing, and don't run analytics scripts that build a profile of you across other sites.

How sign-in works

You sign in with a private six-word phrase we send you directly (never a public form). That phrase is matched against your tenant record and used to issue a short-lived, scoped access token — the token identifies only which deal and role you're entitled to see, not your personal identity. The same phrase and token model is used whether you sign in on dexindex.ai directly or via the DEX Custom GPT in ChatGPT (OAuth 2.0 Authorization Code flow). Your phrase is stored hashed, never in plain text once issued to you.

Using DEX through the ChatGPT Custom GPT

When you use the DEX GPT in ChatGPT, ChatGPT authenticates you against dexindex.ai using the sign-in flow above, then attaches your resulting access token to each request. DEX receives only the token and the specific deal_id being requested — never your ChatGPT account identity, conversation history, or any other data from your ChatGPT account. DEX returns your scoped report or market brief; we don't retain a copy of what ChatGPT does with that response, and OpenAI's own privacy policy governs how ChatGPT itself handles your conversations.

How we use what we collect

Solely to authenticate you, enforce that you only ever see data for the deal(s) and role you're entitled to, generate the reports and market commentary you request, and maintain a security audit trail of sign-in activity. We do not use your data for advertising, and we do not build behavioral profiles beyond what's needed to serve your own reports back to you.

Data retention and deletion

Tenant and entitlement records are retained for as long as your invitation is active. Audit log entries are retained for security and troubleshooting purposes. If you'd like your tenant record removed or your access revoked, contact us using the details below and we'll act on it directly — there is no self-service deletion flow since there is no public account system to begin with.

Security

Access phrases are stored as salted hashes, never in plain text. Access tokens are short-lived and scoped narrowly to a single deal and role. All traffic is served over HTTPS.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, we'll update this page and the "last updated" date above. Given DEX's invitation-only model, material changes will also be communicated to active tenants directly.

Contact

Questions about this policy or your data can be sent directly to Danny Heggen, Strange Orbit, at danny@strangeorbit.ai — or the same channel you received your invitation from.

Signed by Danny Heggen, Strange Orbit.