legal

Privacy Policy

Last updated: May 2026 · Applies to psychnosis.org and all subpages

Psychnosis is designed to be as private as possible. We use no advertising cookies, no tracking pixels, and no fingerprinting. This document explains what little data we do process and why.

who we are

Psychnosis is an independent harm reduction project operated by an individual based in the European Union. For data protection purposes, the operator acts as data controller.

Contact: [email protected]

what data we collect

Data	What it is	Where stored	Retention
Anonymous query logs	The text of questions asked in the app, with no user ID, no IP address, no name. Cannot be linked to any individual.	Upstash Redis (EU region)	90 days rolling
Aggregate usage stats	Total query counts, model usage ratios. No personal data.	Upstash Redis (EU region)	Indefinite
Analytics	Page views, referrers, country-level location. No cookies, no fingerprinting, no cross-site tracking. Compliant with GDPR without consent banner.	Umami (self-hosted on Railway)	1 year
Contact form emails	Name, email address, and message content submitted via the contact or newsletter forms.	Formspree (US-based processor)	Until you request deletion
Browser storage	Chat history, language preference, theme preference, cached responses. Stored only in your browser's localStorage. Never transmitted to our servers.	Your browser only	Until you clear browser data

cookies

Psychnosis does not use cookies. Our analytics tool (Umami) is specifically designed to be cookieless and GDPR-compliant without requiring a consent banner. You will never see a cookie popup on this site because there is nothing to consent to.

legal basis for processing

Anonymous query logs: Legitimate interest — improving the service and monitoring for misuse, with no ability to identify individuals.
Analytics: Legitimate interest — understanding how the site is used, using a privacy-preserving tool that requires no consent.
Contact form data: Consent — you provide this data voluntarily when you contact us. You can request deletion at any time.

third party processors

OpenRouter (openrouter.ai) — routes AI queries to language model providers. Queries are processed in the US. See their privacy policy at openrouter.ai/privacy.
Upstash (upstash.com) — stores anonymised query logs and stats. EU region. See upstash.com/trust/privacy.pdf.
Umami — self-hosted analytics, operated by us on Railway infrastructure.
Formspree (formspree.io) — processes contact form submissions. US-based. See formspree.io/legal/privacy-policy.
Vercel (vercel.com) — hosts the application. May process request metadata (IP addresses) for security purposes. See vercel.com/legal/privacy-policy.

your rights under GDPR

If you are in the European Union or UK, you have the following rights:

Right of access — you can request a copy of any personal data we hold about you.
Right to erasure — you can request deletion of your personal data (primarily contact form submissions).
Right to rectification — you can request correction of inaccurate data.
Right to object — you can object to processing based on legitimate interest.
Right to data portability — you can request your data in a portable format.

Note: anonymous query logs cannot be subject to individual rights requests because we have no way to identify which queries came from you.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

data transfers outside the EU

Some of our processors are based in the United States (OpenRouter, Formspree). These transfers rely on standard contractual clauses or the processors' own compliance frameworks. We only share the minimum data necessary for each service to function.

children

Psychnosis is not intended for anyone under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has submitted personal data via our contact form, please contact us for immediate deletion.

changes to this policy

We may update this policy as the service evolves. The date at the top of this page reflects the most recent update. Continued use of the service after changes constitutes acceptance.

contact

For any privacy-related questions or requests:

[email protected]

We aim to respond to all privacy requests within 30 days as required by GDPR.