About this site
Privacy policy
The short version
- We don't want your name. You can read every page without an account, and nothing asks who you are. Accounts are optional. They need a username, a password and an email address, and the email is stored encrypted.
- Google Analytics only runs if you tap Yes. Tap No and no analytics load, ever.
- Dose self-reports go to our database as anonymous counts. If you're logged in, a private copy also goes on your own list, which only you can see unless you choose to show the substance names on your profile. If our server can't be reached, the report is kept in your browser instead.
- We never sell your data, and we don't use ad networks or ad trackers.
What we collect
Here's everything the site can store, what's in it, and how long we keep it. "Your browser" means it's saved on your device and never sent to us.
| Feature | What's stored | Where it lives today | How long we keep it |
|---|---|---|---|
| Self-reported doses | For the public count: the substance, amount, unit, route (oral, insufflated and so on) and the date. No name, no account and no IP address, so it can't be traced back to you. If you're logged in, a second copy with the same details is stored on your account as your own list. It's private: only you see it, unless you tick the profile option to show which substances are on it (names only, never amounts or dates). You can remove entries from it on your profile. | Our database on Cloudflare. Your browser only if our server can't be reached. | The anonymous count: for as long as the page exists. Your own list: until you remove an entry or delete your account. |
| Discrepancy reports | The value you flagged, the page, its source, the problem type, your optional note and link, and the time. If you were logged in, which account sent it, so accepted reports can earn leaderboard points. | Our database on Cloudflare. Your browser only if our server can't be reached. | Until a reviewer checks it, then 12 months. Any fix it leads to goes in the public edit log. If you delete your account, your reports stay but lose the link to it. |
| Leaderboard points | When a reviewer accepts a report you sent while logged in: the points, whether it was a correction or a better source, which value it was about, and the day. The leaderboard shows your username with your points unless you turn that off on your profile. | Our database on Cloudflare | Until you delete your account. Reviewers can void points. |
| Timeline submissions | The metabolic timeline you send from the timeline maker and your optional note to the reviewer. No email or IP address. If you are logged in and tick “show my username”, your username is kept and shown on the timeline once it’s approved. Your browser also keeps your draft and a list of what you sent so you can see if it was accepted. | Our database on Cloudflare (the draft stays in your browser) | Rejected ones: 90 days after the decision. Approved ones are shown on the site until staff take them down. |
| Accounts (optional) | Your username; your email address, encrypted (AES-GCM) with a key kept apart from the database, plus a keyed fingerprint of it so a password reset can find your account; whether you've confirmed the email; your password and your recovery code as salted one-way hashes (PBKDF2) that we can't turn back into the originals; the day the account was made; the experience level you picked (novice, intermediate or expert), used only to choose how substance pages open for you and never shown to anyone, moderators included; and your Drug of Choice if you set one (substance pages show how many accounts picked that page, as a number only, never who). Your email is used only to confirm it and to send password reset links. It is never shown to anyone, shared or used for newsletters. Confirmation and reset links are single-use and stop working after 2 days and 1 hour. While you're logged in, a random login token, stored on our side only as a one-way hash, with the date it runs out. No real name, IP address, browser or device details. After 5 wrong passwords in a row the account locks for 15 minutes, which needs a count of recent wrong tries. | Our database on Cloudflare | Until you delete the account, which you can do yourself on the account page and takes effect at once. Logins end 180 days after your last visit or when you log out. |
| Google sign-in (only if you use it) | If you log in or sign up with Google, Google tells us your email address and a fixed ID for your Google account. We keep the email the same way as any account email (encrypted, and marked confirmed because Google confirmed it), and only a keyed one-way fingerprint of the ID, never the ID itself, so we can tell it's you next time. We don't ask Google for your name, picture or contacts, and no Google script loads on our pages: your browser goes to Google's own sign-in page and comes back. While you're away at Google, a cookie holds a random one-time code for up to 10 minutes so the sign-in can't be swapped for someone else's. Google sees that you signed in to intoxicant.wiki, under Google's own privacy policy. | Our database on Cloudflare | Until you unlink Google on the account page or delete the account. An unfinished Google sign-up stops working after 30 minutes and is then cleared out. |
| Forum posts (only if you post) | Each thread and post you write, its forum, the time you posted or edited it, and which account wrote it. Reports you send name the post, the reason, your optional note and your account, so moderators can act on them. If a moderator stops your account from posting, the end date and reason are kept. No IP address, browser details or email go with any of it. | Our database on Cloudflare. Posts are shown to everyone who can open the forums, with your username | Until you delete the post or your account (deleting wipes the text at once). Reports until a moderator deals with them |
| Memorial wall tributes (only if you share one) | The first name or nickname you remember, the optional years, your message and symbol, an optional photo, the time, and which account shared it. A photo is made smaller and re-saved in your browser before it’s sent, and our server removes any metadata left in it, so no location, camera or date details are kept. Reports you send name the tribute, the reason, your optional note and your account. No IP address, browser details or email. | Our database on Cloudflare. A tribute is shown to everyone on the memorial wall after a moderator approves it, without your username; only moderators can see who shared it | Until you delete the tribute or your account (both remove it for good). Reports until a moderator deals with them |
| Cat photos (only if you post one) | The photo, your cat’s name and caption if you add them, the time, and which account posted it. The photo is made smaller and re-saved in your browser before it’s sent, and our server removes any metadata left in it, so no location, camera or date details are kept. Reports you send name the photo, the reason, your optional note and your account. No IP address, browser details or email. | Our database on Cloudflare. A photo is shown to everyone on /cats/ and on your profile after a moderator approves it; your username shows next to it only if your profile is public. Moderators can see who posted it | Until you delete the photo or your account (both remove it for good). Reports until a moderator deals with them |
| Profiles (optional) | Only what you put on your profile: a picture, colour and banner picked from our lists, a bio of up to 500 characters, a one-line flavor text (shown only after a moderator approves it), up to 3 links, up to 5 favourite pages, any Steam, PlayStation Network or Xbox names you type in (we don't sign in to those services or load anything from them; Steam names link to that public Steam profile page, and you can hide them or empty the boxes), and whether to show your Drug of Choice, the names of the substances on your dose list, and your recent forum activity. The site adds your badges (confirmed email, first forum post, first experience report), your forum post count and any role a moderator gives you; these are worked out from what's already stored, apart from roles. No email or real name. A profile is public by default: anyone can see it at its address, and it's listed on the members page with your username, picture, colour, roles, flavor text, join month, post count and leaderboard points (points only if you're on the board). To make yours private, shown only to you, untick "Show my profile to everyone" on your profile. Your email is never shown, and your dose list and Drug of Choice show only if you tick them. Moderators can hide a profile or clear what is on it. | Our database on Cloudflare | Until you change it or delete your account |
| Friends and private messages (only if you use them) | Who you’ve added as a friend or sent a request to, who you’ve blocked, your message settings (who can message you, whether people can send you friend requests, whether your friends show on your profile), and each private message you send or get: the text, the time, which conversation it’s in and which account wrote it, plus when you last opened each conversation. Messages are kept as plain text in our database (they are not end-to-end encrypted), so don’t share anything that identifies you. If you report a message, moderators see that message, who sent it, the reason and your note. Blocking someone isn’t shown to them. Your friends list shows on your profile only if you turn that on. No IP address, browser details or email go with any of it. | Our database on Cloudflare | Until you remove the conversation and the other person removes it too, or either of you deletes your account (that deletes the whole conversation for both of you, and your friends and blocks). A reported message is kept until a moderator deals with it. The log of staff checks is kept until the account that was checked is deleted. |
| Problem reports (only if you send one) | What you write in the “Report a problem” form, the page you came from and the time. If you used “Report element” in the right-click menu, a short description of the part of the page you clicked (its position on the page and up to 200 characters of its text). Any photos you attach (.png, .jpeg or .webp, up to 3), with hidden photo data such as location removed in your browser and again on our server; only staff who review problem reports can see them, and they are deleted with the report. Your email and username only if you type them; the email is encrypted (AES-GCM) with a key kept apart from the database, and only staff who review problem reports can read it. If you were logged in, which account sent it. No IP address. | Our database on Cloudflare | Until staff close the report, then deleted within 12 months |
| 7-OH & Cat’s Claw reports (only if you post one, with or without an account) | Whether it’s 7-OH or Cat’s Claw extract, the product name, the optional date you bought it, the optional state or region (reports from before 2 November 2026 may also have a country), the batch number, the optional expiry date, your rating, how strong it felt, whether it made you ill, your optional experience text, a photo, the time, and which account posted it (or, for a guest, the display name you pick). Your IP address, stored encrypted (AES-GCM) with a key kept apart from the database, and a basic browser fingerprint: a one-way keyed hash of your browser’s user agent, language, screen size, time zone and platform (the values themselves aren’t kept). We log these to stop fake reviews, such as a seller rating its own batches, and to limit guest posts. A guest also gets a private key, kept in their browser, to open or delete their waiting report. The photo is made smaller and re-saved in your browser before it’s sent, and our server removes any metadata left in it, so no location, camera or date details are kept. Flags you send name the report, the reason, your optional note and your account. No email. | Our database on Cloudflare. Reports are shown to everyone who can see the site on the 7-OH & Cat’s Claw reports page, with your username unless you untick “Show my username” (a guest’s display name is always shown); guest reports are shown only after a moderator approves them. Staff can always see who posted. The IP address and fingerprint are seen only by staff who review reports | Until you delete the report or your account (both remove it for good, with its IP address and fingerprint); they are not deleted after a set time otherwise. Flags until staff deal with them |
| Beta applications (only if you send one) | Your answers on the beta access form: the username you’d like, your age, how long you’ve used drugs and roughly how many, your first drug, your drug of choice, the class of drugs that interests you most, your answer to the motto question, whether you have web development experience and what you wrote about it, anything else you add, your email and the time. The email is encrypted (AES-GCM) with a key kept apart from the database. Only staff who review applications can read any of it. No IP address. | Our database on Cloudflare | Until staff decide, then deleted within 12 months |
| Fidget stats (only if you play with the background structures while logged in) | Counts of how you handled the floating chemical structures in the page background: total and longest time held, grabs, throws, knocks into other structures, your fastest throw, and per-substance counts used to show your favourites. Private: only you see them, in the Nerd stats tab of Trail controls. Nothing about doses or drug use. | Our database on Cloudflare | Until you press Reset stats or delete your account |
| Page view counter | One number per page per day: how many times real browsers opened it. No cookie, IP address, browser or device details, and nothing that tells one visitor from another. Visits from bots and scripts are not counted. | Our database on Cloudflare | For as long as the site runs, as anonymous totals |
| Analytics (only if you tap Yes) | Which pages were visited, plus your IP address, browser and device type, as Google collects them. | 2 months, the shortest setting Google offers | |
| Site settings | Your layout choice, your analytics answer and the country for the emergency numbers. | Your browser | Until you clear it |
| Emails to us | Whatever you write, plus your email address | Our inbox | Until the conversation is done, then deleted within 12 months |
Please don't put your real name, phone number or anything else that identifies you in a report note. We'll strip it out if you do.
Resend (sends our account emails)
If you make an account, the confirmation and password reset emails we send you go out through Resend, an email delivery service. Resend sees your email address and the email we send (which names your username and holds a single-use link) while delivering it, and keeps a delivery log for a limited time under its own policy. We send nothing else through it.
Google Analytics
We use Google Analytics. Yes, that Google. It helps us see which pages people actually read, so we know what to fix first. It only loads if you tap Yes on the little banner. Until then, no Google code runs on the page.
If you tap Yes, here's what Google gets:
- Which pages you visit. Compound pages are reported by their CAS Registry Number (a chemical ID like 561-27-3) instead of the drug's name. Be aware that anyone can look up a CAS number in seconds, so treat it as a light disguise, not a privacy shield.
- The usual technical stuff: your IP address (we ask Google to anonymize it), browser, device type, rough location and how you got here.
- A cookie (named
_ga) so Google can tell a returning visitor from a new one.
Google doesn't get your name, your email or any account from us. We keep analytics data for 2 months, the shortest setting Google offers. Google handles the data under its own privacy policy.
Cloudflare (our host)
The site runs on Cloudflare, which delivers the pages and, once it's live, stores the things you submit. Like any web host, Cloudflare sees each request when you load a page: your IP address, the page address, your browser and the time. It uses this to serve the site and block attacks and bots, and handles it under its own privacy policy.
We don't keep our own visitor logs of IP addresses, and we don't turn on any extra Cloudflare logging or analytics. When the server starts taking submissions, it may check your IP address for a moment to stop spam floods. It won't store your IP next to anything you submit, with one exception: 7-OH & Cat’s Claw reports keep the poster’s IP address and a browser fingerprint hash, so staff can spot fake reviews (see the table above).
Cookies and stuff saved in your browser
The site itself sets no cookies. The only cookies come from Google Analytics, and only after you tap Yes. Some features save small notes in your browser's local storage, which stays on your device:
| Name | What it remembers |
|---|---|
__Host-iw-s (cookie) | Only set if you log in: a random token that keeps you logged in for up to 30 days. Your browser hides it from scripts and sends it only to this site. |
iw-account | Your username, so the top of the page can show it. Removed when you log out |
iw-analytics | Whether you said yes or no to analytics |
iw-doc | The one substance page you marked as your Drug of Choice (its name and the date), when you aren't logged in. Never sent to us. If you log in, it moves to your account and is removed from the browser |
iw-view | Your page layout (safety card, full article or at a glance) |
iw-country | The country you picked for emergency numbers |
iw-doses-<page> | Your dose self-reports for that page |
iw-fidget | Your fidget stats (time holding background structures, throws and so on). When you're logged in they are sent to your account every 20 seconds and cleared here |
iw-reports | Discrepancy reports you've filed |
iw-dm | Only while you’re logged in: how many unread messages and friend requests you have, so the top of the page can show the number without asking our server on every page. Kept only until you close the tab. |
iw-seen/<page> | That this tab already counted a view of that page, so a reload isn't counted twice. Kept only until you close the tab, and never sent to us. |
To wipe all of it, clear this site's data in your browser settings. Private or incognito windows forget it when you close them.
Buy Me a Coffee and other links
The "buy us a coffee" link takes you to Buy Me a Coffee, a separate site that handles the payment. We never see your card details. We may see the name and message you choose to leave with a tip, and you can tip as "Someone" if you'd rather not. Their privacy policy covers what they collect.
The same goes for the sources we link to, like Wikipedia, PsychonautWiki, TripSit, PubChem and DailyMed. Once you click through, you're under their rules, not ours.
If we ever feature a named sponsor, it's labelled as a sponsor, and we share no visitor data with them.
Coming later: votes and chat
Voting values up or down and the peer chat aren't live yet. When they are, they'll need some extra data, roughly:
- Votes: which values you voted on and when. We'll use this to spot bots and trolls, for example a burst of hundreds of votes in an hour. If an account is flagged, a human moderator looks at it.
- Chat: your messages and the room they were in.
We'll update this policy with the details, and how long each is kept, before any of these launch. Nothing gets collected until then.
Your choices
- Changed your mind about analytics? Clear this site's data in your browser and the banner will ask again. Tapping No stops Google Analytics from loading from then on. Data Google already collected expires on the 2-month schedule above.
- Delete what's in your browser: clear this site's data.
- Delete your account: log in and use Delete account on the account page. It's removed at once, with no copy kept. The text of all your forum posts is wiped at the same time, and your memorial wall tributes, 7-OH & Cat’s Claw reports and their photos are removed; thread titles you wrote stay, shown as from a deleted account, so the replies still make sense. Email us if you want a title changed.
- Ask us for your data, or ask us to fix or delete it: email us. You have these rights under laws like the GDPR, UK GDPR and California's CCPA, but we'll do it for anyone who asks. We'll reply within 30 days.
One honest catch: we deliberately don't link submissions to names, so we may not be able to tell which anonymous dose report was yours. If you tell us the page, the date and what you entered, we'll do our best.
This site is for adults 18 and over. We don't knowingly collect anything from anyone younger.
Contact and changes
Questions, worries or requests: [email protected]. A real person reads it. To write privately, encrypt your message with our PGP key first.
If we change this policy, we'll update the date below and note the change in the public edit log. Any big change gets a notice on the site first. See also our disclaimer.
Last updated: October 26, 2026.