Privacy Policy

https://substack.com/privacy • 319 KB fetched
Open original page

Resources

Creators

Explore

Start publishing Sign in

Explore
Substack App Discover Featured Substacks around the world
Creators
Switch to Substack Go paid Grow your audience For live video For video For podcasts For bloggers For finance writers For authors For food writers For local news For media founders
Resources
How to start a Substack Going paid guide Resource center Community & programs Help center Brand assets

Documents

* Terms of Use

* Privacy Policy

* Publisher Agreement

* Content Guidelines

* Copyright Dispute Policy

* Copyright Repeat Infringer Policy

* CCPA Policy

* Support Chatbot Terms

* Added disclosure that Substack shares account identifiers with, and receives information from, child safety industry consortia to detect CSAM.

* Added a one-month response commitment for certain privacy rights requests and the right to object to certain types of processing.

About this Privacy Policy
Substack Inc. knows you care about how your personal information is used and shared, and we take your privacy seriously. This Privacy Policy outlines how we collect, use, and share your personally identifiable information ("Personal Information") through our website ( www.substack.com ) and our services. Please read it carefully.
Remember that your use of Substack is at all times subject to the Terms of Use , which incorporates this Privacy Policy. Any terms we use in this Privacy Policy without defining them have the definitions given to them in the Terms of Use .
This Privacy Policy includes additional notices that may apply to you if you are a California consumer. Please see the section further below titled "Additional Notices for California Residents" for more details.
What does this Privacy Policy cover?
This Privacy Policy details how we collect, receive, use, store, share, transfer and process your Personal Information. It also describes the choices you have regarding the use of your Personal Information, as well as your rights and how you execute these rights.
This Privacy Policy only applies to the processing of your Personal Information by Substack as a data controller, meaning where we process your Personal Information for our purposes. This Privacy Policy does not apply to any processing of your Personal Information by Substack as a data processor on behalf of a Creator. Creators will have their own privacy practices governing their use of Personal Information as outlined in their own terms of use and/or privacy policies.
Will Substack ever change this Privacy Policy?
We’re constantly trying to improve our services, so we may need to change this Privacy Policy from time to time as well, but we will alert you to material changes by placing a notice on our site, by sending you an email, and/or by some other means.
Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of Substack, and you are still responsible for reading and understanding them.
What Information does Substack collect?
We collect and process Personal Information about you when you interact with us and our services, as well as when you subscribe to any of our paid or unpaid services. This may include:

* your first and last name;

* your email address;

* your phone number;

* your date of birth;

* your payment details (including billing address, credit card details, where you make a purchase from us);

* your location and/or mailing address;

* your photograph;

* your marketing preferences, including any consents you have given us;

* information related to the browser or device you use to access our website (including your IP address);

* any information we collect online from you and maintain in association with your account, such as your username and password;

* your subscription status with Substack publications;

* public information about the social media accounts you associate with your Substack account;

* your direct message contents and metadata;

* information from integrated third-party services that you choose to use or link to on Substack — for example, if you use Substack to upload video content to YouTube, we collect account identifiers (including the email address associated with the account), video identifiers, and upload status information associated with the YouTube account you use to upload video content to YouTube; and

* any other information you provide us when communicating with us.

We may also collect information about you when one of our users syncs their address book information with our app for contact syncing purposes. This information collection is strictly limited to email addresses and phone numbers, and any information collected in this manner is securely stored only as hashed values.
We may also obtain additional information from third parties and sources. We use this information to supplement the information we collect about you in order to provide more relevant, safer experiences for you on the platform and to improve the platform and analytics. If we combine or associate information from other sources with information that we collect through the platform, we will treat the combined information in accordance with this Privacy Policy.
Finally, we also collect information on the use of our website via Cookies. Please view the section “Cookies” below for more information.
How does Substack use your Personal Information?
We process this Personal Information for the following purposes:

* To establish and fulfill a contract with you, for example when you subscribe to a subscription Service. This may include verifying your identity, taking payments, communicating with you, providing customer service;

* As required by Substack to enable our business and pursue our legitimate interests. In particular we use your Personal Information for the following purposes:

* to provide services you have requested, and respond to any communications, comments or complaints you send us;

* to monitor the use of our services and to help us monitor, improve and protect our services, content and website;

* allow you to create, maintain, customize and secure your account with us;

* to personalize our services for you and provide recommendations;

* to monitor any user accounts to prevent, investigate and/or report fraud, misrepresentation, terrorism, security incidents or crime in accordance with applicable law;

* to share account identifiers with trusted industry child safety consortia for the detection and prevention of online child sexual exploitation and abuse (OCSEA);

* to invite you to take part in surveys or market research;

* to facilitate contact syncing between users who opt in to our app’s contact syncing functionality;

* Where our use of Personal Information is made pursuant to a balancing of our legitimate interests with your privacy interest, we will provide more information about our balancing analysis and process on request. Please send any such requests to [email protected].

* Compliance with applicable laws (including, but not limited to, age verification where required) and protection of Substack’s legitimate business interests and legal rights, including but not limited to use in connection with legal claims, compliance, regulatory, investigative purposes (including disclosure of such information in connection with legal process or litigation).

* In addition, we will send you, based on your consent (if required), direct marketing communication in relation to our relevant services, or other services provided by us, our affiliates and carefully selected partners. You can withdraw your consent at any time ("opt out"); see the section "What are your rights?" below. In case of electronic direct marketing you can opt out by following the instructions in the communication.

* In certain cases, we may also share some Personal Information with third parties, but only as described in this Privacy Policy.

How will Substack share the Personal Information it receives?
We may share your Personal Information with third parties as described below:

* Affiliates: We may disclose your Personal Information to our subsidiaries and/or corporate affiliates for the purposes as described above.

* Creators: when you subscribe to a Creator’s publication, we provide them the information necessary (including your name and email address) to provide you their publication(s). Please note that Creators control their own publications; accordingly, when you interact with a Creator’s publication in a way that requires your personal information, including when commenting on a publication that you have not subscribed to, that personal information is provided directly to the Creator.

* Our Service Providers: We share your Personal Information with third-party service providers that provide services on our behalf; for example, we use Stripe (a third party payment provider) to receive and process your credit card transactions for us. Such third parties further include, but are not limited to, providers of: website hosting; maintenance services; email services; security services; generative AI services; content delivery networks; customer support operations and software services; traffic and usage analytics services; and cloud storage and computing services.

* Third-Party Data Controllers: We provide integrations with third-party services for you to use at your option. When we do, we only use the Personal Information we collect from the integrated third-party service for the purpose of providing the integration to you, and do not disclose that information except where required by law or as directed by the third-party service. Please keep in mind that you may use an integrated third-party service to send your Personal Information or content to the provider of the integrated third-party service, in which case you should refer to the privacy policy of the applicable third-party service provider to understand how your Personal Information is used. For instance, you may use Substack to upload content to YouTube, in which case the Google privacy policy governs how YouTube uses your Personal Information.

* Other users: If your user profile allows it, you may choose to populate certain user profile information, including, without limitation, your name, subscriptions, publications, location, and any image content. Any user profile information uploaded may be displayed to other users to facilitate user interaction within the services (including when you post comments or upload images or videos through the services). Your public profile data may be shared or accessed via automated means (e.g., APIs or indexing services). Your account privacy settings may allow you to limit the other users who can see the Personal Information in your user profile and/or what information in your user profile is visible to others. Your username and user profile may also be displayed to other users when you interact with a publication post, for instance, by “liking” the post or leaving a comment. You may have the option to allow Substack to share information on what you’ve read or are reading on Substack with the public, or with other accounts socially connected to your own, such as your social media followers. If you opt into contact syncing through our app, your profile information will be shared with any user who has (i) also opted into contact syncing, and who (ii) identified you as a contact.

* Prospective sellers or buyers: We may share and/or transfer customer information in connection with the sale or merger of our business or assets (subject to local laws). Also, if we go out of business, enter bankruptcy, or go through some other change of control.

* Government authorities, law enforcement officials, and court-ordered disclosures: If required for the purposes as described in this Privacy Policy, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws we may share Personal Information with competent regulatory, prosecuting, tax or governmental authorities, courts or other tribunals, or with litigants entitled by law to receive personal information, in any jurisdiction or markets, domestic or foreign.

* Industry Child Safety Programs: We may share account identifiers (such as email addresses and usernames) with trusted industry child safety organizations for the purpose of detecting and preventing online child sexual exploitation and abuse (OCSEA).

In certain cases, we may anonymize your Personal Information in such a way that you can no longer be identified as an individual, and we reserve the right to use and share such anonymized information to trusted partners not specified here. However, we never disclose aggregated or de-identified information in a manner that could identify you as an individual.
Where will we send your Personal Information?
Substack is established in the US and uses service providers established both in the US and in other countries to process Personal Information as described in this Privacy Policy. As such, your Personal Information may be shared internationally.

Does Substack participate in the Data Privacy Framework?
Substack complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (each, a “DPF”) as set forth by the U.S. Department of Commerce. Substack has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Substack has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/
When we receive Personal Information under a DPF, the DPF Principles apply to our processing of that information. Under any DPF, we are accountable for the onward transfer of Personal Information, and only transfer Personal Information received pursuant to a DPF under agreements that provide the same protections as the DPF. Our adherence to the DPFs specified above is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
In the event of a dispute between you and us regarding our use of Personal Information under a DPF, we ask that you first raise the dispute with us directly at [email protected]. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. These dispute resolution services are provided at no cost to you.
If you have a “residual claim” regarding our use of your Personal Information under a DPF that is unresolved after (i) direct contact with us; (ii) your use of the independent dispute resolution mechanism identified above; and (iii) your raising the issue with your data protection authority, you have the the right to seek redress through binding arbitration in accordance with the applicable DPF.
Is Personal Information about you secure?
Your account is protected by a password for your privacy and security. You must prevent unauthorized access to your account and Personal Information by selecting and protecting your password appropriately and limiting access to your computer or device and browser by signing off after you have finished accessing your account.
We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry or use, failure of the services, or other factors may compromise the security of user information at any time.
Privacy and your direct messages
You can use Substack to send direct messages to other Substack users, and to receive direct messages from other Substack users. Please note that, at this time, direct messages are not end-to-end encrypted, and are not a substitute for secure messaging services. Direct messaging contents are disclosed to their intended recipients. The platform may restrict your access to direct messages received from other users when those users delete messages or block your account. Nevertheless, please note that — regardless of platform functionality or policy — recipients of direct messages may keep those messages even if you request their deletion, and even if you delete your Substack account. Keep in mind that recipients of your direct messages do not necessarily have any obligation to keep them private.
We will only disclose direct message contents to people other than the intended recipients in very limited circumstances where allowed or required by law, for example, in response to valid court orders or in emergency situations involving danger of death or serious physical injury. While we maintain strict internal access controls on direct messaging content, keep in mind that Substack personnel may access the contents of direct messages to enforce our Terms of Use, ensure the security of our platform, to provide user support, or as otherwise necessary to provide our services. We may also use automated means to ensu

Privacy Policy

Links found on this page