What stays on your device, and what does not.

The short version

Fracton has no account system, collects no journal or profile data, shows no ads, and runs no analytics or behavioural tracking. The project does not operate a hosted journal service, user profile database, or automatic cloud backup.

Journal entries, favourites, custom values, settings, and recently viewed items are stored on your device. Loading the hosted website still requires ordinary network requests to the web host; those requests and other optional network actions are described below.

What Fracton stores locally

• Journal entries, notes, timing, dose, route, cost, colour, and calendar or statistics data.
• Favourites, recently viewed substances, custom dose or timing values, and local settings.
• Notification preferences and scheduled local-notification metadata.
• Optional encrypted journal-vault metadata.
• Bundled or refreshed reference snapshots from projects such as PsychonautWiki, TripSit, and the Subjective Effect Index, plus locally cached imported drug-checking sample records where the Samples feed provides them.

On the web, journal data is stored in localStorage. It is plaintext JSON when journal encryption is disabled and an encrypted vault blob when encryption is enabled. General preferences, favourites, recent items, custom reference values, and other app state remain outside the journal vault.

IndexedDB can store refreshed source snapshots and a non-extractable unlock key when you select a remember mode. Older source snapshots are migrated from localStorage when they are first read. Otherwise, an encrypted journal's unlock key is held in memory only and a reload or relaunch requires the passphrase again. Raw encryption keys are not stored in browser Web Storage. Cache Storage keeps application and reference assets available offline.

Browser storage belongs to the fracton.me web origin and the browser profile that created it. Chrome, Firefox, Safari, private windows, and separate browser profiles do not share one local copy.

In the Android or iOS app, app data remains in the app's private device storage, with secure key caching through the platform storage layer when available. Fracton does not operate a cloud-backup service. The Android package also opts its app data out of automatic Android backup and device transfer.

What web-app installation changes

Adding Fracton to a home screen gives it an icon, a standalone window, and easier access to cached offline files. It does not turn browser storage into native-app storage, create a Fracton account, upload the journal, or create a backup.

You can request persistent-storage protection under More > Data > Storage protection. When the browser grants it, the browser should not automatically evict Fracton's data under routine storage pressure. The browser decides whether to grant the request. This protection is not a backup and does not prevent deletion when you clear site data, remove the app and its data, or reset the device. Private or incognito storage may be deleted when that private session closes.

The public homepage remains a landing page. Opening /substances or another app route shows the same app surface used on mobile; on a desktop browser, app routes are shown inside a framed, mobile-sized viewport for the beta. This is only a presentation choice and does not create an installed app or change where data is stored.

Journal encryption

Journal encryption is optional. When enabled, Fracton encrypts journal data locally with AES-256-GCM using a key derived from your passphrase with Argon2id. The current Argon2id settings use a 256-bit random salt, 64 MiB of memory, three iterations, and one lane. New passphrases must contain at least 12 characters. Your passphrase is processed on your device and is not sent to Fracton or to a server controlled by this project.

On the web, remember modes cache a non-extractable Web Crypto key in IndexedDB. This prevents the raw key from being exported through the Web Crypto API, but it is not equivalent to hardware-backed native secure storage. Remember modes trade some local protection for convenience, especially on a shared or unlocked browser profile.

Lock now clears the active decrypted journal and any remembered browser key. While the journal is unlocked, decrypted content and the active key exist in memory so the app can display and edit it. Encryption does not protect an unlocked screen, prevent deletion, or create a backup.

If you forget your passphrase, Fracton cannot recover the encrypted journal.

When network requests happen

Fracton does not send journal contents to a project-owned backend. Network activity can occur in these cases:

• Loading or updating the hosted web app sends ordinary HTTPS requests to the infrastructure serving fracton.me. Like other web requests, that infrastructure can receive metadata such as your IP address, browser information, requested path, and request time. Fracton adds no analytics, advertising, or behavioural-tracking requests.
• Opening an external source, emergency, or help link contacts that third party.
• Refreshing a source snapshot contacts the relevant public source endpoint.

Journal contents are not included in source-refresh or normal page-load requests by the Fracton application code.

Permissions

• Notifications: used for local phase reminders. Notification text can reveal sensitive information if you enable rich titles.
• Device storage: used for journal data, settings, source snapshots, and offline operation. In supported browsers, you can optionally ask the browser to protect this storage from automatic eviction.

You can deny optional permissions, but the related feature may not work.

Source data and attribution

Fracton includes local snapshots and normalized fields from third-party harm-reduction or reference projects. Those projects do not endorse Fracton. Their content remains attributed in the app according to the relevant source and licence notices.

When source data is refreshed, Fracton updates the local source snapshot only after the refresh succeeds. Custom user values remain separate and take priority where the app supports them.

Data loss and recovery

There is no Fracton account, automatic cloud backup, or project-operated recovery service. Installing the web app does not create a second copy of its data.

Local data can be lost if you clear site or browser data, use private browsing, uninstall while choosing to remove app or browser data, reset or lose the device, or if the browser evicts unprotected site data under storage pressure. An encrypted journal can be deleted just as easily as an unencrypted one.

Fracton provides explicit export options under More > Data, including a complete Fracton backup and compatibility exports for PsychonautWiki Journal. These downloads are plaintext JSON even when the on-device journal is encrypted, so store them somewhere private and protected. They are manual backups, not automatic synchronisation, and Fracton cannot recover a forgotten passphrase or deleted local data.

Safety notice

Fracton is informational harm-reduction software. It does not encourage substance use, does not provide medical advice, and cannot determine whether a dose, combination, or situation is safe. In an emergency, contact local emergency services.

Policy changes

This policy may change as Fracton changes during the beta and before the planned open-source release. The current version should describe the actual behaviour of the app as shipped. Any feature that sends more data off-device must be reflected here before it is introduced.