gumroad
- The policy says your content is not used for AI training.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
Gumroad collects account, payment, and ad-ID data, can send voice to OpenAI.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account and payment info, device and ad IDs, browsing data, and sometimes voice audio.
Read the exact line
Privacy policy
“device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our Site”
Training
They run the store, fight fraud, market to you, and send some voice sessions to AI vendors.
Read the exact line
Privacy policy
“We do not use this data for advertising or to train our own models.”
Sharing
Staff vendors, payment processors, sellers you buy from, ad partners, and OpenAI or Anthropic for voice features.
Read the exact line
Privacy policy
“We currently use OpenAI and Anthropic for these features. These providers process this data under contract solely to provide the feature to you”
Kept
They keep data as long as they need it for the service, law, or fraud, even after you close an account.
Read the exact line
Privacy policy
“We do retain Personal Data from closed accounts to comply with law, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems”
Controls
Edit your profile, email them to delete, opt out of marketing and some ads, and decline the in-app voice prompt.
Read the exact line
Privacy policy
“You may of your Personal Data by us, but please note that we may be required to keep this information and not delete it”
Fine print
They can close you anytime; subscriptions auto-renew with no prorated refund.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
of your personal data
Email support@gumroad.com or edit your profile in the account
Opt out of targeted ads
NAI, DAA, or EDAA opt-out pages, AppChoices on mobile, and device ad-ID settings, as described under Your Choices
Decline voice AI or revoke the microphone
In-app AI disclosure prompt, or device microphone settings
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If you use the voice AI features, your recording and transcript go to outside AI companies.
Read the exact line
Privacy policy
“When you use these features, we send the relevant content you provide — for example, the voice audio you record and the resulting transcript — to these providers”
For example, a walk you record in Gumroad Walks can be sent to OpenAI to transcribe.
You keep ownership, but they get a lasting right to use and what you post to run the service.
Read the exact line
Terms of service
“you grant Gumroad a fully paid, , , , worldwide, , non-exclusive and fully right (including any moral rights) and license to use, license, distribute, reproduce, modify, adapt, publicly perform, and publicly display Your Content”
For example, a product description you upload can still be used by Gumroad even after you leave.
They can shut your account or stop sales without warning.
Read the exact line
Terms of service
“Gumroad may decline, remove or halt sales of any Product, suspend or terminate an Account, and/or suspend or terminate the Services at any time, in its sole discretion, without cause or notice to you”
For example, a seller account could be closed overnight with no email first.
If your content or use causes a legal fight, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and hold the Gumroad Parties harmless from any losses, costs, liabilities and expenses (including reasonable attorneys' fees) relating to or arising out of any and all of the following: (a) Your Content”
For example, if a buyer sues over a file you sold, you might have to cover Gumroad’s lawyers.
Subscriptions keep billing until you cancel, and unused time is not refunded.
Read the exact line
Terms of service
“However, the Buyer will not be eligible for a prorated refund of any portion of the Subscription price paid for the then-current Subscription Period.”
For example, if you cancel a monthly membership on day 2, you still pay for the whole month.
Ad companies can follow your browsing to show you targeted ads.
Read the exact line
Privacy policy
“Targeted and advertising cookies - These cookies track your browsing habits to enable us and third-party advertising networks to deliver ads that may be of interest to you.”
For example, visiting a creator’s page could later show you ads for similar products on other sites.
They say they may watch chats, texts, and voice, and you should not expect those to stay private.
Read the exact line
Terms of service
“you acknowledge and agree that you have no expectation of privacy concerning the transmission of Your Content, including without limitation chat, text, or voice communications.”
For example, a support chat or voice session could be reviewed by Gumroad.
They say voice and transcript from the AI features are not used to train Gumroad’s own AI.
Read the exact line
Privacy policy
“We do not use this data for advertising or to train our own models.”
For example, your Walks recording should not become training data for a Gumroad model.
Voice AI is supposed to wait for an in-app yes before recording or sending audio.
Read the exact line
Privacy policy
“Before any audio or transcript is collected or shared, we present a clear in-app disclosure identifying what is sent and to whom, and we ask for your permission.”
For example, you can tap decline on the Walks prompt and not send audio to OpenAI.
They say you must be at least 13, but that is just you saying so.
Read the exact line
Terms of service
“You represent that you are (i) at least thirteen (13) years old; (ii) of legal age to form a binding contract”
For example, a 13-year-old can check a box and create an account without ID checks described here.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- right to erasure
- Your right to have a company delete the personal data it holds about you, with some exceptions. For example, you can ask a social app to wipe your old posts and profile and it must, unless a law says otherwise.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
How we got here · grade C · score 47/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect account and payment details plus device IDs, advertising IDs, IP address, and site usage.
Does it record your voice, face or body, and what happens to that?
Voice audio from some apps is recorded in-session and sent to OpenAI and Anthropic. They say they do not train their own models on it.
Are your chats and uploads used to train AI models, and is that off by default?
For the AI features they describe, they say they do not use that data to train their own models.
Can employees or contractors read your conversations, and when?
They may monitor and review content, including chat and voice, and they do not describe an opt-out.
Are you profiled or tracked for advertising?
Third-party advertising cookies and SDKs track browsing to show targeted ads. Industry opt-outs are offered.
Do they sell or share your data, and can you opt out?
They share with vendors, affiliates, sellers, payment processors, and ad partners. Targeted-ad opt-outs are listed.
What rights do they take over what you type and what the AI makes?
You own your content, but you grant a perpetual, irrevocable, sublicensable license to use it to run the service.
How long do they keep your data after you delete it, and can you delete it in the app?
You ask them to delete by email or profile edits. Closed accounts can still be kept for law, fraud, and fees.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they use security technologies and procedures, but they do not promise data will stay private.
Is there a real age gate, and are teens protected?
You must say you are at least 13 and old enough to contract. No extra age check is described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated 2018. Material privacy changes may be posted, and continued use counts as acceptance.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate an account at any time, without cause or notice.
If something goes wrong, who pays?
The service is as-is, liability is capped around $100 or one month of payments, and you must indemnify them.
Do subscriptions renew on their own, and can you get a refund?
Subscriptions auto-renew. Canceling stops the next cycle, but they say there is no prorated refund.
The privacy policy is 6,084 words at a college graduate level (Flesch reading ease 39.6); the terms are 16,926 words at a college graduate level.
