Medium Privacy Policy

This document is Medium's Privacy Policy, effective March 24, 2022, governing the collection, use, sharing, and retention of personal data for users of the Medium platform (medium.com), published by A Medium Corporation. The policy states that Medium collects account registration data (name, email, password), payment information, content and activity data (drafts, reading history, search queries, follows), device identifiers, IP addresses, browser type, operating system, referral URLs, and inferred interests, and the terms authorize use of this data for service operation, personalization, analytics, communications, and marketing. The policy discloses sharing of personal data with third-party service providers (analytics, payment processors, infrastructure), business partners, and in the context of corporate transactions such as mergers or acquisitions, and reserves the right to share aggregated or de-identified data without restriction. The policy states that it engages the EU General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), explicitly acknowledging legal bases for processing EU personal data (legitimate interests, contract performance, consent) and granting California residents rights to know, delete, and opt out of data sale; applicable law in these jurisdictions may constrain certain data-sharing or retention assertions beyond what the policy alone establishes. Material compliance considerations include the adequacy of disclosed consent mechanisms for marketing communications, the scope of the legitimate interests basis asserted for behavioral tracking, and the policy's handling of data transfers from the EU to the United States, which engages Standard Contractual Clauses or equivalent transfer mechanisms required under post-Schrems II frameworks.