Substack Privacy Policy

Substack collects your personal information whenever you use its services or subscribe to any publication, free or paid. When you subscribe to a Creator's publication, your name and email address are shared with that Creator, and Substack personnel can access your direct messages for platform enforcement and support purposes. Your direct messages are not end-to-end encrypted, and you have qualified rights to access, correct, or delete your personal information, with Substack committing to respond within one month.

The Substack Privacy Policy establishes the basis on which Substack collects and processes Personal Information across all interactions with its services, both free and paid. It defines a set of qualified user rights — including access, correction, erasure, restriction, and portability — with a one-month response commitment, while conditioning those rights on unstated eligibility criteria. The policy delineates the boundaries of Substack's role: it does not apply where Substack acts as a data processor on behalf of a Creator, placing compliance responsibility for that processing entirely on the Creator. Key operational disclosures include Substack personnel's permissive access to direct message contents for enforcement and support purposes, the absence of end-to-end encryption for direct messages, the sharing of subscriber name and email with Creators upon subscription, permissive sharing of account identifiers with child safety consortia, and an explicit acknowledgment that complete security cannot be guaranteed.

Subscribing to any Substack publication results in your name and email address being passed to the Creator, who operates outside of Substack's Privacy Policy. Direct messages you send are not end-to-end encrypted, Substack personnel may read them for operational purposes, and recipients may retain them even if you delete your account or request deletion. Your account identifiers may be shared with child safety organizations without a legal order. You have qualified rights — not guaranteed in every circumstance — to request a copy of, correction to, erasure of, or transfer of your Personal Information, and you can submit such a request and receive a response within one month.