Substack Privacy Policy

This document is Substack Inc.'s Privacy Policy (last updated May 14, 2026), governing the collection, use, storage, and sharing of Personal Information by Substack as a data controller across its media and publishing platform; it does not govern processing performed by Creators acting as independent data controllers. The policy states that Substack collects name, email, phone number, date of birth, payment details, location, device and IP information, direct message contents and metadata, social media account identifiers, and third-party integration data (including YouTube account and video identifiers), and authorizes use of this information for service provision, fraud prevention, personalization, and direct marketing (with consent where required). Two provisions are operationally distinct relative to commonly observed practice: the policy discloses sharing of account identifiers (email addresses and usernames) with industry child safety consortia for CSAM detection, and explicitly states that direct messages are not end-to-end encrypted and may be accessed by Substack personnel for Terms of Use enforcement, security, user support, and automated scanning. The policy asserts compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, and references CCPA-specific notices in a separate section; GDPR, UK GDPR, and applicable state privacy laws (including California) create compliance obligations that may constrain or supplement the terms as written. Material compliance considerations include the scope of Creator data controller independence (requiring separate lawful basis analysis), the DPF certification and its FTC enforceability, and the one-month response commitment for privacy rights requests added in the most recent update.