| April 19, 2026 06:13 UTC | May 6, 2026 05:48 UTC | ||||
|---|---|---|---|---|---|
| 5 | Explore | 5 | Explore | ||
| 6 | Substack AppDiscoverFeaturedSubstacks around the world | 6 | Substack AppDiscoverFeaturedSubstacks around the world | ||
| 7 | Creators | 7 | Creators | ||
| n | 8 | Switch to SubstackGo paidGrow your audienceFor live videoFor videoFor podcastsFo | n | 8 | Switch to SubstackGo paidGrow your audienceFor live videoFor videoFor podcastsFo |
| > | r bloggersFor finance writersFor authorsFor food writersFor local news | > | r bloggersFor finance writersFor authorsFor food writersFor local newsFor media | ||
| > | founders | ||||
| 9 | Resources | 9 | Resources | ||
| 10 | How to start a SubstackGoing paid guideResource centerCommunity & programsHelp c | 10 | How to start a SubstackGoing paid guideResource centerCommunity & programsHelp c | ||
| > | enterBrand assets | > | enterBrand assets | ||
| 11 | Documents | 11 | Documents | ||
| 18 | CCPA Policy | 18 | CCPA Policy | ||
| 19 | Support Chatbot Terms | 19 | Support Chatbot Terms | ||
| 20 | Privacy Policy | 20 | Privacy Policy | ||
| n | 21 | Last Updated: December 1, 2025 | n | 21 | Last Updated: May 4, 2026 |
| 22 | Changes in the Last Update | 22 | Changes in the Last Update | ||
| n | 23 | Address Creator privacy responsibilities | n | 23 | Added disclosure that Substack shares account identifiers with child safety indu |
| > | stry consortia to detect CSAM. | ||||
| 24 | Amend discussion of services providers | 24 | Added a one-month response commitment for certain privacy rights requests and th | ||
| > | e right to object to certain types of processing. | ||||
| 25 | About this Privacy Policy | 25 | About this Privacy Policy | ||
| 26 | Substack Inc. knows you care about how your personal information is used and sha | 26 | Substack Inc. knows you care about how your personal information is used and sha | ||
| > | red, and we take your privacy seriously. This Privacy Policy outlines how we col | > | red, and we take your privacy seriously. This Privacy Policy outlines how we col | ||
| > | lect, use, and share your personally identifiable information ("Personal Informa | > | lect, use, and share your personally identifiable information ("Personal Informa | ||
| > | tion") through our website (www.substack.com) and our services. Please read it c | > | tion") through our website (www.substack.com) and our services. Please read it c | ||
| > | arefully. | > | arefully. | ||
| 27 | Remember that your use of Substack is at all times subject to the Terms of Use, | 27 | Remember that your use of Substack is at all times subject to the Terms of Use, | ||
| > | which incorporates this Privacy Policy. Any terms we use in this Privacy Policy | > | which incorporates this Privacy Policy. Any terms we use in this Privacy Policy | ||
| > | without defining them have the definitions given to them in the Terms of Use. | > | without defining them have the definitions given to them in the Terms of Use. | ||
| 30 | This Privacy Policy details how we collect, receive, use, store, share, transfer | 30 | This Privacy Policy details how we collect, receive, use, store, share, transfer | ||
| > | and process your Personal Information. It also describes the choices you have r | > | and process your Personal Information. It also describes the choices you have r | ||
| > | egarding the use of your Personal Information, as well as your rights and how yo | > | egarding the use of your Personal Information, as well as your rights and how yo | ||
| > | u execute these rights. | > | u execute these rights. | ||
| 31 | This Privacy Policy only applies to the processing of your Personal Information | 31 | This Privacy Policy only applies to the processing of your Personal Information | ||
| > | by Substack as a data controller, meaning where we process your Personal Informa | > | by Substack as a data controller, meaning where we process your Personal Informa | ||
| > | tion for our purposes. This Privacy Policy does not apply to any processing of y | > | tion for our purposes. This Privacy Policy does not apply to any processing of y | ||
| > | our Personal Information by Substack as a data processor on behalf of a Creator. | > | our Personal Information by Substack as a data processor on behalf of a Creator. | ||
| > | Creators will have their own privacy practices governing their use of Personal | > | Creators will have their own privacy practices governing their use of Personal | ||
| > | Information as outlined in their own terms of use and/or privacy policies. | > | Information as outlined in their own terms of use and/or privacy policies. | ||
| 32 | Will Substack ever change this Privacy Policy? | 32 | Will Substack ever change this Privacy Policy? | ||
| n | 33 | We’re constantly trying to improve our services, so we may need to change this P | n | 33 | We’re constantly trying to improve our services, so we may need to change this P |
| > | rivacy Policy from time to time as well, but we will alert you to changes by pla | > | rivacy Policy from time to time as well, but we will alert you to material chang | ||
| > | cing a notice on our site, by sending you an email, and/or by some other means. | > | es by placing a notice on our site, by sending you an email, and/or by some othe | ||
| > | r means. | ||||
| 34 | Please note that if you’ve opted not to receive legal notice emails from us (or | 34 | Please note that if you’ve opted not to receive legal notice emails from us (or | ||
| > | you haven’t provided us with your email address), those legal notices will still | > | you haven’t provided us with your email address), those legal notices will still | ||
| > | govern your use of Substack, and you are still responsible for reading and unde | > | govern your use of Substack, and you are still responsible for reading and unde | ||
| > | rstanding them. | > | rstanding them. | ||
| 35 | What Information does Substack collect? | 35 | What Information does Substack collect? | ||
| 36 | We collect and process Personal Information about you when you interact with us | 36 | We collect and process Personal Information about you when you interact with us | ||
| > | and our services, as well as when you subscribe to any of our paid or unpaid ser | > | and our services, as well as when you subscribe to any of our paid or unpaid ser | ||
| > | vices. This may include: | > | vices. This may include: | ||
| 60 | allow you to create, maintain, customize and secure your account with us; | 60 | allow you to create, maintain, customize and secure your account with us; | ||
| 61 | to personalize our services for you and provide recommendations; | 61 | to personalize our services for you and provide recommendations; | ||
| 62 | to monitor any user accounts to prevent, investigate and/or report fraud, misrep | 62 | to monitor any user accounts to prevent, investigate and/or report fraud, misrep | ||
| > | resentation, terrorism, security incidents or crime in accordance with applicabl | > | resentation, terrorism, security incidents or crime in accordance with applicabl | ||
| > | e law; | > | e law; | ||
| n | n | 63 | to share account identifiers with trusted industry child safety consortia for th | ||
| > | e detection and prevention of online child sexual exploitation and abuse (OCSEA) | ||||
| > | ; | ||||
| 63 | to invite you to take part in surveys or market research; | 64 | to invite you to take part in surveys or market research; | ||
| 64 | to facilitate contact syncing between users who opt in to our app’s contact sync | 65 | to facilitate contact syncing between users who opt in to our app’s contact sync | ||
| > | ing functionality; | > | ing functionality; | ||
| 65 | Where our use of Personal Information is made pursuant to a balancing of our leg | 66 | Where our use of Personal Information is made pursuant to a balancing of our leg | ||
| > | itimate interests with your privacy interest, we will provide more information a | > | itimate interests with your privacy interest, we will provide more information a | ||
| > | bout our balancing analysis and process on request. Please send any such request | > | bout our balancing analysis and process on request. Please send any such request | ||
| > | s to privacy@substackinc.com. | > | s to privacy@substackinc.com. | ||
| 75 | Other users: If your user profile allows it, you may choose to populate certain | 76 | Other users: If your user profile allows it, you may choose to populate certain | ||
| > | user profile information, including, without limitation, your name, subscription | > | user profile information, including, without limitation, your name, subscription | ||
| > | s, publications, location, and any image content. Any user profile information u | > | s, publications, location, and any image content. Any user profile information u | ||
| > | ploaded may be displayed to other users to facilitate user interaction within th | > | ploaded may be displayed to other users to facilitate user interaction within th | ||
| > | e services (including when you post comments or upload images or videos through | > | e services (including when you post comments or upload images or videos through | ||
| > | the services). Your public profile data may be shared or accessed via automated | > | the services). Your public profile data may be shared or accessed via automated | ||
| > | means (e.g., APIs or indexing services). Your account privacy settings may allow | > | means (e.g., APIs or indexing services). Your account privacy settings may allow | ||
| > | you to limit the other users who can see the Personal Information in your user | > | you to limit the other users who can see the Personal Information in your user | ||
| > | profile and/or what information in your user profile is visible to others. Your | > | profile and/or what information in your user profile is visible to others. Your | ||
| > | username and user profile may also be displayed to other users when you interact | > | username and user profile may also be displayed to other users when you interact | ||
| > | with a publication post, for instance, by “liking” the post or leaving a commen | > | with a publication post, for instance, by “liking” the post or leaving a commen | ||
| > | t. You may have the option to allow Substack to share information on what you’ve | > | t. You may have the option to allow Substack to share information on what you’ve | ||
| > | read or are reading on Substack with the public, or with other accounts sociall | > | read or are reading on Substack with the public, or with other accounts sociall | ||
| > | y connected to your own, such as your social media followers. If you opt into co | > | y connected to your own, such as your social media followers. If you opt into co | ||
| > | ntact syncing through our app, your profile information will be shared with any | > | ntact syncing through our app, your profile information will be shared with any | ||
| > | user who has (i) also opted into contact syncing, and who (ii) identified you as | > | user who has (i) also opted into contact syncing, and who (ii) identified you as | ||
| > | a contact. | > | a contact. | ||
| 76 | Prospective sellers or buyers: We may share and/or transfer customer information | 77 | Prospective sellers or buyers: We may share and/or transfer customer information | ||
| > | in connection with the sale or merger of our business or assets (subject to loc | > | in connection with the sale or merger of our business or assets (subject to loc | ||
| > | al laws). Also, if we go out of business, enter bankruptcy, or go through some o | > | al laws). Also, if we go out of business, enter bankruptcy, or go through some o | ||
| > | ther change of control. | > | ther change of control. | ||
| 77 | Government authorities, law enforcement officials, and court-ordered disclosures | 78 | Government authorities, law enforcement officials, and court-ordered disclosures | ||
| > | : If required for the purposes as described in this Privacy Policy, if mandated | > | : If required for the purposes as described in this Privacy Policy, if mandated | ||
| > | by law or if required for the legal protection of our legitimate interests in co | > | by law or if required for the legal protection of our legitimate interests in co | ||
| > | mpliance with applicable laws we may share Personal Information with competent r | > | mpliance with applicable laws we may share Personal Information with competent r | ||
| > | egulatory, prosecuting, tax or governmental authorities, courts or other tribuna | > | egulatory, prosecuting, tax or governmental authorities, courts or other tribuna | ||
| > | ls, or with litigants entitled by law to receive personal information, in any ju | > | ls, or with litigants entitled by law to receive personal information, in any ju | ||
| > | risdiction or markets, domestic or foreign. | > | risdiction or markets, domestic or foreign. | ||
| n | n | 79 | Industry Child Safety Programs: We may share account identifiers (such as email | ||
| > | addresses and usernames) with trusted industry child safety organizations for th | ||||
| > | e purpose of detecting and preventing online child sexual exploitation and abuse | ||||
| > | (OCSEA). | ||||
| 78 | In certain cases, we may anonymize your Personal Information in such a way that | 80 | In certain cases, we may anonymize your Personal Information in such a way that | ||
| > | you can no longer be identified as an individual, and we reserve the right to us | > | you can no longer be identified as an individual, and we reserve the right to us | ||
| > | e and share such anonymized information to trusted partners not specified here. | > | e and share such anonymized information to trusted partners not specified here. | ||
| > | However, we never disclose aggregated or de-identified information in a manner t | > | However, we never disclose aggregated or de-identified information in a manner t | ||
| > | hat could identify you as an individual. | > | hat could identify you as an individual. | ||
| 79 | Where will we send your Personal Information? | 81 | Where will we send your Personal Information? | ||
| 80 | Substack is established in the US and uses service providers established both in | 82 | Substack is established in the US and uses service providers established both in | ||
| > | the US and in other countries to process Personal Information as described in t | > | the US and in other countries to process Personal Information as described in t | ||
| > | his Privacy Policy. As such, your Personal Information may be shared internation | > | his Privacy Policy. As such, your Personal Information may be shared internation | ||
| > | ally.Does Substack participate in the Data Privacy Framework? | > | ally.Does Substack participate in the Data Privacy Framework? | ||
| 86 | Your account is protected by a password for your privacy and security. You must | 88 | Your account is protected by a password for your privacy and security. You must | ||
| > | prevent unauthorized access to your account and Personal Information by selectin | > | prevent unauthorized access to your account and Personal Information by selectin | ||
| > | g and protecting your password appropriately and limiting access to your compute | > | g and protecting your password appropriately and limiting access to your compute | ||
| > | r or device and browser by signing off after you have finished accessing your ac | > | r or device and browser by signing off after you have finished accessing your ac | ||
| > | count. | > | count. | ||
| 87 | We endeavor to protect the privacy of your account and other Personal Informatio | 89 | We endeavor to protect the privacy of your account and other Personal Informatio | ||
| > | n we hold in our records, but unfortunately, we cannot guarantee complete securi | > | n we hold in our records, but unfortunately, we cannot guarantee complete securi | ||
| > | ty. Unauthorized entry or use, failure of the services, or other factors may com | > | ty. Unauthorized entry or use, failure of the services, or other factors may com | ||
| > | promise the security of user information at any time. | > | promise the security of user information at any time. | ||
| 88 | Privacy and your direct messages | 90 | Privacy and your direct messages | ||
| n | 89 | You can use Substack to send direct messages to other Substack users, and to rec | n | 91 | You can use Substack to send direct messages to other Substack users, and to rec |
| > | eive direct messages from other Substack users. Please note that, at this time, | > | eive direct messages from other Substack users. Please note that, at this time, | ||
| > | direct messages are not end-to-end encrypted, and are not a substitute for secur | > | direct messages are not end-to-end encrypted, and are not a substitute for secur | ||
| > | e messaging services. Direct messaging contents are disclosed to their intended | > | e messaging services. Direct messaging contents are disclosed to their intended | ||
| > | recipients. Recipients of direct messages may keep those messages even if you re | > | recipients. The platform may restrict your access to direct messages received fr | ||
| > | quest their deletion, and even if you delete your Substack account. Keep in mind | > | om other users when those users delete messages or block your account. Neverthel | ||
| > | that recipients of your direct messages do not necessarily have any obligation | > | ess, please note that — regardless of platform functionality or policy — recipie | ||
| > | to keep them private. | > | nts of direct messages may keep those messages even if you request their deletio | ||
| > | n, and even if you delete your Substack account. Keep in mind that recipients of | ||||
| > | your direct messages do not necessarily have any obligation to keep them privat | ||||
| > | e. | ||||
| 90 | We will only disclose direct message contents to people other than the intended | 92 | We will only disclose direct message contents to people other than the intended | ||
| > | recipients in very limited circumstances where allowed or required by law, for e | > | recipients in very limited circumstances where allowed or required by law, for e | ||
| > | xample, in response to valid court orders or in emergency situations involving d | > | xample, in response to valid court orders or in emergency situations involving d | ||
| > | anger of death or serious physical injury. While we maintain strict internal acc | > | anger of death or serious physical injury. While we maintain strict internal acc | ||
| > | ess controls on direct messaging content, keep in mind that Substack personnel m | > | ess controls on direct messaging content, keep in mind that Substack personnel m | ||
| > | ay access the contents of direct messages to enforce our Terms of Use, ensure th | > | ay access the contents of direct messages to enforce our Terms of Use, ensure th | ||
| > | e security of our platform, to provide user support, or as otherwise necessary t | > | e security of our platform, to provide user support, or as otherwise necessary t | ||
| > | o provide our services. We may also use automated means to ensure the safety of | > | o provide our services. We may also use automated means to ensure the safety of | ||
| > | direct messaging content, including scanning for spam, malicious content, and ch | > | direct messaging content, including scanning for spam, malicious content, and ch | ||
| > | ild abuse material. | > | ild abuse material. | ||
| 91 | Privacy and SMS Services | 93 | Privacy and SMS Services | ||
| 92 | If you provide us with your phone number, we may use a third-party service provi | 94 | If you provide us with your phone number, we may use a third-party service provi | ||
| > | der to verify your phone number with an SMS text message. Information regarding | > | der to verify your phone number with an SMS text message. Information regarding | ||
| > | this SMS verification is used only for verification purposes, and is not shared | > | this SMS verification is used only for verification purposes, and is not shared | ||
| > | with third parties/affiliates for marketing/promotional purposes. | > | with third parties/affiliates for marketing/promotional purposes. | ||
| 93 | What are your rights? | 95 | What are your rights? | ||
| 94 | Depending on applicable local laws, you may be entitled to ask Substack for a co | 96 | Depending on applicable local laws, you may be entitled to ask Substack for a co | ||
| > | py of your Personal Information, to correct it, erase or restrict its processing | > | py of your Personal Information, to correct it, erase or restrict its processing | ||
| > | , or to ask us to transfer some of this information to other organizations. You | > | , or to ask us to transfer some of this information to other organizations. You | ||
| > | may also have rights to object to some processing activities or to request restr | > | may also have rights to object to some processing activities or to request restr | ||
| > | iction of some processing activities. Where we have asked for your consent to pr | > | iction of some processing activities. Where we have asked for your consent to pr | ||
| > | ocess your Personal Information, you may also have the right to withdraw this co | > | ocess your Personal Information, you may also have the right to withdraw this co | ||
| > | nsent. These rights may be limited in some situations or in accordance with appl | > | nsent. These rights may be limited in some situations or in accordance with appl | ||
| > | icable law – for example, we cannot delete your Personal Information when we can | > | icable law – for example, we cannot delete your Personal Information when we can | ||
| > | demonstrate that we have a legal obligation to retain it. In some instances, th | > | demonstrate that we have a legal obligation to retain it. In some instances, th | ||
| > | is may mean that we are able to retain data even if you withdraw your consent or | > | is may mean that we are able to retain data even if you withdraw your consent or | ||
| > | you delete your account. | > | you delete your account. | ||
| n | n | 97 | We will respond to any request to exercise your rights within one month of recei | ||
| > | pt. Where your request is complex or you have made a number of requests, we may | ||||
| > | extend this period by a further two months and will notify you of any such exten | ||||
| > | sion, together with the reasons for the delay, within one month of receipt of yo | ||||
| > | ur request. | ||||
| 98 | In particular, where we process your Personal Information on the basis of our le | ||||
| > | gitimate interests — including where we profile you in order to personalise cont | ||||
| > | ent recommendations — you have the right to object to such processing at any tim | ||||
| > | e on grounds relating to your particular situation. We will cease such processin | ||||
| > | g unless we can demonstrate compelling legitimate grounds which override your in | ||||
| > | terests, rights and freedoms, or the processing is necessary for the establishme | ||||
| > | nt, exercise or defence of legal claims. To exercise this right, please contact | ||||
| > | us at privacy@substackinc.com. | ||||
| 95 | Where we require Personal Information to comply with legal or contractual obliga | 99 | Where we require Personal Information to comply with legal or contractual obliga | ||
| > | tions, then provision of such information is mandatory: if such information is n | > | tions, then provision of such information is mandatory: if such information is n | ||
| > | ot provided, then we will not be able to manage our contractual relationship, or | > | ot provided, then we will not be able to manage our contractual relationship, or | ||
| > | to meet obligations placed on us. In all other cases, provision of requested pe | > | to meet obligations placed on us. In all other cases, provision of requested pe | ||
| > | rsonal data is optional. Please note we will always inform you where the provisi | > | rsonal data is optional. Please note we will always inform you where the provisi | ||
| > | on of your Personal Information is mandatory or optional. | > | on of your Personal Information is mandatory or optional. | ||
| 96 | We hope that we can satisfy any queries you may have about the way we process yo | 100 | We hope that we can satisfy any queries you may have about the way we process yo | ||
| > | ur Personal Information. If you have any concerns about how we process your Pers | > | ur Personal Information. If you have any concerns about how we process your Pers | ||
| > | onal Information, or would like to opt out of marketing, you can get in touch at | > | onal Information, or would like to opt out of marketing, you can get in touch at | ||
| > | privacy@substackinc.com. | > | privacy@substackinc.com. | ||
| 97 | If you are a California consumer, please see the section further below titled “A | 101 | If you are a California consumer, please see the section further below titled “A | ||
| > | dditional Notices for California Residents” for more notices regarding your Pers | > | dditional Notices for California Residents” for more notices regarding your Pers | ||
| > | onal Information. | > | onal Information. | ||
| 109 | In the event you have unresolved concerns, please note that you have the right t | 113 | In the event you have unresolved concerns, please note that you have the right t | ||
| > | o complain to a data protection authority. Contact details for data protection a | > | o complain to a data protection authority. Contact details for data protection a | ||
| > | uthorities in the EEA, Switzerland and certain non-European countries are availa | > | uthorities in the EEA, Switzerland and certain non-European countries are availa | ||
| > | ble here. | > | ble here. | ||
| 110 | What are Creators’ privacy responsibilities? | 114 | What are Creators’ privacy responsibilities? | ||
| 111 | Creators using our services are responsible for their own privacy compliance and | 115 | Creators using our services are responsible for their own privacy compliance and | ||
| > | this Privacy Policy does not apply to any processing of your Personal Informati | > | this Privacy Policy does not apply to any processing of your Personal Informati | ||
| > | on by Substack as a data processor on behalf of any Creator using our services. | > | on by Substack as a data processor on behalf of any Creator using our services. | ||
| > | A Creator’s own terms and policies govern their use of the Personal Information | > | A Creator’s own terms and policies govern their use of the Personal Information | ||
| > | they collect using our services, including their own marketing emails and other | > | they collect using our services, including their own marketing emails and other | ||
| > | communications. A Creator’s editorial decision to include personal information i | > | communications. A Creator’s editorial decision to include personal information i | ||
| > | n published content will always be made in the Creator’s capacity as a data cont | > | n published content will always be made in the Creator’s capacity as a data cont | ||
| > | roller. | > | roller. | ||
| t | 112 | It is Substack’s obligation as a data processor is to provide any privacy notice | t | 116 | Substack’s obligation as a data processor is to provide any privacy notice it re |
| > | it receives to the appropriate data controller, meaning that privacy complaints | > | ceives to the appropriate data controller, meaning that privacy complaints about | ||
| > | about editorial content will generally be provided to the Creator who posted th | > | editorial content will generally be provided to the Creator who posted the cont | ||
| > | e content in question. | > | ent in question. | ||
| 113 | How long will Substack retain your data? | 117 | How long will Substack retain your data? | ||
| 114 | We retain information about you only for as long as reasonably necessary to fulf | 118 | We retain information about you only for as long as reasonably necessary to fulf | ||
| > | ill the purposes for which it was collected. We may retain your Personal Informa | > | ill the purposes for which it was collected. We may retain your Personal Informa | ||
| > | tion for a longer period in the event of a complaint or if we reasonably believe | > | tion for a longer period in the event of a complaint or if we reasonably believe | ||
| > | there is a prospect of litigation in respect to our relationship with you. | > | there is a prospect of litigation in respect to our relationship with you. | ||
| 115 | Automated individual decision-making, including profiling | 119 | Automated individual decision-making, including profiling | ||
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.