Privacy Policy

How Psychedex handles your data. Last updated October 2026.

Data collected

– Account infoEmail address, display name, and an optional profile image URL when you sign up

– Sign-in dataYou can sign in with Google, Discord, an email magic link, or a passkey. We store the OAuth tokens, magic-link verification tokens, and passkey credentials needed to keep you signed in.

– SessionsActive sign-in sessions, including your browser's user-agent string. We do not store IP addresses with sessions.

– ContributionsContent you submit (edits, reports, corrections), published under your pen name. The pen name is linked to your account internally; the link is never shown publicly, can be accessed only by site admins for abuse investigation (every access is recorded in an audit log), and is severed if your account is deleted.

– Psychedex appNo account is needed, and the app itself sends none of your record anywhere. Its own page lists what does leave the phone, and to whom: What leaves your phone.

– Tolerance trackerIf you use the tolerance tracker, your per-substance use logs are stored on our servers in readable form

– Bookmarks & alertsPages you bookmark and alert subscriptions you set are stored with your account

– Aggregate analyticsPublic pages report anonymous, cookieless pageview counts to Plausible (open-source, EU-hosted). No cookies, no persistent identifiers, no stored IP addresses, no cross-site tracking. The account areas send nothing

– Request logsOur host, Vercel, keeps IP addresses in its request logs for its retention period. We do not store them with sessions or contributions.

– Session timerIf you log a session from a substance page or the Session Navigator, what you enter stays in this browser on this device and is never sent to our servers. The one exception is a report you send from a section's console: only what you typed, and the substance, section and route it's about, after you confirm, under your pen name. Ended sessions are cleared the next time this site is opened 7 or more days after they end, and Discard clears them at once. Opening the Session Navigator is a page view that loads its code and our public reference data. Like any page view, these requests reach our host's request logs, which show that someone opened the Session Navigator and which page they opened it from, not what they entered.

Data not collected

–No tracking pixels or tracking cookies — analytics are cookieless and aggregate-only

–No advertising identifiers

–No data sold to third parties

–No IP addresses stored with sessions or contributions

–No substance search logs tied to accounts

Cookies

– SessionAn HttpOnly session cookie keeps you signed in, alongside a short-lived session-cache cookie

– Sign-in flowTransient state and CSRF-protection cookies exist only during OAuth sign-in

– AdminAn idle-timeout cookie is set only on admin dashboard paths, which require staff access

– ThemeYour light/dark preference is kept in your browser's localStorage, not a cookie

All cookies are functional — required for sign-in and security. There are no advertising or analytics cookies, which is why you don't see a consent banner.

Retention

– SessionsSign-in sessions expire automatically

– Everything elseAccount data, contributions, tolerance logs, bookmarks, and alerts are kept while your account is active, and removed or de-associated when your account is deleted

Third parties

– VercelHosting and content delivery

– NeonPostgres database hosting

These providers process data on our behalf under their own security commitments. Our infrastructure is hosted in the United States; if you use Psychedex from elsewhere, your data is transferred to and stored there.

Your rights

Export. For an export of your account data, email us.

Deletion. Account deletion is currently handled on request: email contact@psychedex.org and we will scrub your account record, remove your sessions and sign-in connections, erase the private data stored with your account, and de-associate your contributions (published content remains under its pen name, no longer linked to you). Self-serve account deletion is planned.

Age

Psychedex accounts require you to be 18 or older. We do not knowingly collect data from anyone under 18.

Changes and contact

We may update this policy as the product changes; material changes will be announced on the site, and the date at the top always reflects the current version. Questions about your data go to contact@psychedex.org.