Not only does the app not have to be open source, your don't even need root access on the device it's running on. As long as you can see the packets being sent, you can see what servers it's talking to.

Not so when going though someone else' website tho. It does look like there are direct connections to the selected instance happening, but also obviously there is data being sent and received from alexandrite, and there's no way to know what they're doing with that info. For all you know, they're fingerprinting you for Meta. (I don't think that's happening, but there's no way to know).