Substack Privacy Policy

This document is Substack Inc.'s Privacy Policy (last updated May 4, 2026), governing the collection, use, storage, and sharing of personal information across Substack's website and services, with Substack acting as data controller for its own processing purposes. The policy states that Substack collects a broad range of data including names, email addresses, phone numbers, dates of birth, payment details, IP addresses, direct message contents and metadata, and social media account information linked to user profiles; the terms authorize sharing this data with affiliates, service providers (including generative AI providers), creators, third-party data controllers, industry child safety consortia, and government authorities, and reserve the right to transfer data in connection with a merger or acquisition. Two operationally distinct provisions are notable: the policy explicitly discloses that direct messages are not end-to-end encrypted and that Substack personnel may access message contents to enforce terms or provide services; and the policy permits sharing account identifiers such as email addresses and usernames with child safety industry consortia for CSAM detection, a practice newly disclosed in this update. The policy asserts compliance with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF as mechanisms for transatlantic data transfers, engaging GDPR and UK GDPR obligations, with DPF Principles stated to govern in the event of conflict with policy terms; the policy also includes dedicated CCPA disclosures for California residents, engaging California Consumer Privacy Act obligations enforced by the California Privacy Protection Agency.