Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A sender's deletion request or account deletion does not obligate recipients to remove direct messages, meaning the sender has no enforceable right to compel removal of messages from recipients' possession.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
View change record →The updated policy no longer commits to responding to privacy rights requests within one month or within three months for complex requests. This removes a procedural timeline that previously bound Substack's response obligations. Additionally, the explicit disclosure that Substack shares account identifiers with child safety consortia to detect online child sexual exploitation has been removed from the policy, though the practice itself is not stated to have ended. The direct message retention language is now framed more directly: recipients may retain messages even if you request deletion or close your account.
View change record →If you send a direct message on Substack, the recipient may retain it regardless of any deletion request you make or any account action you take.
How other platforms handle this
TINDER ASSUMES NO RESPONSIBILITY FOR ANY CONTENT THAT YOU OR ANOTHER USER OR THIRD PARTY POSTS, SENDS, RECEIVES, AND/OR ACTS ON THROUGH OUR SERVICES, NOR DOES TINDER ASSUME ANY RESPONSIBILITY FOR THE IDENTITY, INTENTIONS...
we do not warrant that Offering descriptions are accurate, complete, reliable, current, or error-free.
Please note that these third parties are responsible for their own privacy practices.
Monitoring
Substack has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"recipients of direct messages may keep those messages even if you request their deletion, and even if you delete your Substack account.Excerpt from Substack's Privacy Policy
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
A sender's deletion request or account deletion does not obligate recipients to remove direct messages, meaning the sender has no enforceable right to compel removal of messages from recipients' possession.
If you send a direct message on Substack, the recipient may retain it regardless of any deletion request you make or any account action you take.
ConductAtlas has identified this type of provision across 292 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.