Privacy
A concise policy for the current public edition of Flow Hijacked.
Updated: 23 August 2026
The browser hash is a pseudonymous deduplication key—not anonymity or identity verification. Its row is deleted once its last activity day is more than 400 days old; a browser returning after that horizon begins a new cohort. Non-linkable aggregate counters may be retained for longitudinal comparison.
The site installs no advertising trackers and does not send traffic data to an external analytics provider. Traffic measurement begun on 15 August 2026 keeps the day, language, page path, a coarse source category, a campaign label from a closed list, landing-page group, broad device class, approximate country code and the name of a broad journey step. Source classification happens in the browser; the full referrer, raw or unapproved UTM values and search query are not transmitted. From 20 August 2026, the stricter arrival count uses a random token created and retained in the browser. The token is sent only to create a SHA-256 hash; only that hash is stored with the first-seen, first-qualified and last-seen days, first campaign and first landing path. Qualification requires active time plus one or two interaction types—press, touch, keyboard or scroll—without recording what was pressed, typed or read. Its purpose is to reduce refresh and automation counts; it is not identity verification. One person can use several devices and several people can share one device. Clearing site data resets the token. Global Privacy Control, Do Not Track and owner exclusion prevent measurement. The server does not store IP addresses, user agents, full referrers, field values, craving, mental state, search terms, notes, questions, answers or visitor profiles. Earlier aggregate counters remain outside the clean baseline. The aggregate report is available only to the site owner. Opening that private report places a secure exclusion cookie in the owner's browser; D1 keeps only its opaque hash and its creation and last-used days so the owner's visits can be omitted. Account sign-in remains optional for visitors and is used only when you choose cross-device process memory.
Question text is sent to the server only to generate the answer, is not sent to ordinary analytics and is not stored in the Flow Hijacked database. So you can open a source and return—or refresh without losing the answer—the current browser tab temporarily keeps the question and answer in session storage; it disappears when that tab session ends, is not added to Ask memory and is not synchronized. Answers use an external model provider with response storage disabled. Aggregate measurement keeps only a broad topic category, retrieval-confidence band, destination type and feedback result. Ask memory is optional and separate from Recovery OS memory; it stores structured explanation preferences, concepts and resource paths—not question text. You can edit or delete it inside Ask.
The external widget sends no impression or measurement event from the host site. Measurement begins only after someone deliberately enters Flow Hijacked. Aggregate attribution keeps a short or opaque node identifier, the organisation type and country configured in the embed, the widget variant, a broad topic for topic embeds, and continuation paths inside Flow Hijacked. The raw host name is not sent; when no identifier is supplied, the script derives a short one-way token from it in the browser. No names, diagnoses, personal responses or partner-visible behavioural profiles are collected. Any future partner report will be aggregate by default.
By default, field dimensions, change signals, check-ins, route choices and action feedback remain in this browser, and personal pattern detection runs on the device. A signed-in user may explicitly enable account memory; then a copy of recovery history is stored under a one-way account identifier and synchronized across devices. You can pause synchronization or permanently delete the account copy inside My Recovery Field. Signing out alone does not delete it. On a shared computer, anyone using the same browser may be able to see local data.
Your daily action, one degree of freedom, evening response and optional note stay in this browser by default. There are no streaks, scores or relapse forecasts. Signed-in users may separately and explicitly enable Here and Now account memory; it can be paused or the account copy permanently deleted from the page without erasing the local copy.
To keep a source round trip, refresh or Back action from throwing you to the top of a long page, the current tab keeps only the section name and your relative place inside it by default. In the section map you can explicitly choose to remember reading places on this device for later visits, and turn that choice off to delete saved places. Reading position is not synchronized to an account.
WhatsApp and device-sharing controls pass only the route name and suggested steps—not dimension scores, change signals or history. You choose the destination and can edit or cancel before sending; once opened, the sharing service operates under its own privacy policy.
Lecture 46, 48 and 49 files are hosted directly by Flow Hijacked. Earlier lecture files may open on Google Drive, and DOI records open on publisher sites. Those external services operate under their own privacy policies.
Text entered into toolkit worksheets remains in the browser and is not sent to the server. Downloads are generated locally on the device.
There is currently no signup form or email-address collection. Field Notes can be read on the site or followed through RSS without providing an address.