Substack
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
You own posts, but they take a license, can read DMs, track you.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Name, email, phone, birthday, payments, location, photos, device data, messages, and sometimes contacts.
Read the exact line
Privacy policy
“your first and last name;your email address;your phone number;your date of birth;your payment details (including billing address, credit card details, where you make a purchase from us);your location and/or mailing address;your photograph;”
Training
They run the service, recommend content, market, and may profile you; staff can read DMs.
Read the exact line
Privacy policy
“We may use the information we collect to profile you in order to suggest content on our platform that is relevant to your interests.”
Sharing
Creators you subscribe to, affiliates, many vendors (including AI), and sometimes other users.
Read the exact line
Privacy policy
“when you subscribe to a Creator’s publication, we provide them the information necessary (including your name and email address) to provide you their publication(s).”
Kept
They keep it as long as they think they need it, and longer if they expect a fight.
Read the exact line
Privacy policy
“We retain information about you only for as long as reasonably necessary to fulfill the purposes for which it was collected.”
Controls
You can edit some profile fields and delete your account from the account page.
Read the exact line
Privacy policy
“If you'd like to delete your account, you can do so from your account page.”
Fine print
ban, you cover their legal bills, as-is service.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Delete your account
Your account page
Unsubscribe from marketing emails
Unsubscribe link in emails, communication preferences, or privacy@substackinc.com
Object to profiling for recommendations
Email privacy@substackinc.com
Edit name, email, and profile
Account settings
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If someone sues them because of how you used the site, you may have to pay their legal bills.
Read the exact line
Terms of service
“you agree to and hold Substack, its affiliates, officers, agents, employees, and partners harmless from and against any and all claims, liabilities, damages”
For example, if a comment you posted leads to a lawsuit against Substack, they can ask you to cover their lawyers.
They can keep using your posts forever even if you leave, though you still own them.
Read the exact line
Terms of service
“You agree that the licenses you grant are , , , and worldwide.”
For example, after you delete your account they may still have a license to copies they already made to run the service.
Company staff can read your private messages, not only when the law requires it.
Read the exact line
Privacy policy
“Substack personnel may access the contents of direct messages to enforce our Terms of Use, ensure the security of our platform, to provide user support, or as otherwise necessary to provide our services.”
For example, a support agent or trust-and-safety worker could open a DM thread you thought was private.
DMs are not locked so only you and the other person can read them.
Read the exact line
Privacy policy
“direct messages are not end-to-end encrypted, and are not a substitute for secure messaging services.”
For example, Substack’s systems (and staff in some cases) can see the text of your messages.
They keep tracking you after you leave the site and ignore browser Do Not Track.
Read the exact line
Privacy policy
“Our services do not support Do Not Track requests at this time, which means that we collect information about your online activity both while you are using the services and after you leave our services.”
For example, cookies may still record that you visited other sites after reading a newsletter.
They can shut your account for any reason. They will try to warn you so you can save posts, but they might not.
Read the exact line
Terms of service
“Substack is free to terminate (or suspend access to) your use of Substack, or your account, for any reason at our discretion.”
For example, they could close a writer’s account and you might not get time to export drafts.
Your personal information can go to outside companies that run AI tools for them.
Read the exact line
Privacy policy
“Such third parties further include, but are not limited to, providers of: website hosting; maintenance services; email services; security services; generative AI services;”
For example, text you send on the platform might be processed by a third-party AI vendor.
You keep ownership of your writing and uploads.
Read the exact line
Terms of service
“First and foremost, you own what you create. Any original content you post, upload, share, store, or otherwise provide to Substack remains yours”
For example, a newsletter you wrote is still yours to republish elsewhere.
You can close the account yourself in settings without only emailing them.
Read the exact line
Privacy policy
“If you'd like to delete your account, you can do so from your account page.”
For example, you can open your account page and delete it when you want to leave.
Words to know
Legal words from the lines above, in plain English.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
How we got here · grade F · score 28/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect account and payment data plus location, photos, device and IP info, messages, social accounts, and hashed contacts from address-book sync.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Staff may read direct messages for rules, security, support, and running the service. There is no opt-out described.
Are you profiled or tracked for advertising?
They use third-party analytics cookies including Facebook and Google families and do not honor Do Not Track.
Do they sell or share your data, and can you opt out?
They share with affiliates, creators, vendors, and child-safety groups. Marketing can be opted out; a full sale opt-out is not spelled out here.
What rights do they take over what you type and what the AI makes?
You own your posts, but you grant a royalty-free, perpetual, irrevocable, worldwide license so they can run and improve the service. Public posts also get a license to other users.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They profile you to recommend content. You can object by email, but there is no described in-app memory viewer or off switch.
Do they commit to basic security, and have they leaked data?
They mention passwords and that they try to protect data, but they say they cannot guarantee complete security. No audit or bug-bounty program is described.
Is there a real age gate, and are teens protected?
You must be 16 or older. They say they do not knowingly collect from kids under 16, with no extra age-check described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated. They say they will post or email about material changes; keeping using the site means you accept new terms.
Can they close your account without warning, and can you get your data out first?
They can close your account for any reason. They will try to give notice so you can save posts, but they may skip notice.
If something goes wrong, who pays?
The service is as-is, liability is capped at $100 or a year of fees, and you must indemnify them for third-party claims about your use.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 4,419 words at a professional or legal expert level (Flesch reading ease 0); the terms are 3,302 words at a professional or legal expert level.
