Data Report Card · Substack
Substack Data Report Card
Newsletters · reader + writer accounts · Substack Inc. (San Francisco)
Data
Practices
Practices
1Access1Portability1Friction1Deletion2Sells1Trains AI
=
C
7/12
Agent
Readiness
Readiness
1Access
1Portability
0API access
=
D
2/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · some cells re-verified Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Substack's published policy; none has been tested (run by us) yet.
1Accessstated
Account settings expose a handful of fields (name, email, profile); the copy-of-your-data path is emailing privacy@substackinc.com, with a stated one-month response — no data-download portal.
Substack Privacy Policy — Your Rights · accessed Aug 2026 ↗1Portabilitystated
The self-serve export is writer-side only: publication Settings → Exports generates a ZIP of posts (CSV and HTML), subscriber list and stats. A reader account has no export tool — partial coverage, so the score sits at the moderate level.
Substack Help Center — How do I export my posts? · accessed Aug 2026 ↗1Frictionstated
Account deletion is self-serve; other rights run through privacy@substackinc.com within a stated one month. The services “do not support Do Not Track requests at this time”, and there is no Do Not Sell link — but no retention gauntlet or dark patterns are documented.
Substack Privacy Policy — Your Rights / tracking · accessed Aug 2026 ↗1Deletionstated
Self-serve deletion (Settings → Danger Zone) will “Permanently erase all of your information except for anonymized analytics data and the limited records we require for regulatory, compliance, and security purposes” — clear scope, but no post-deletion purge timeline is stated, and DM recipients may keep messages after you delete.
Substack Help Center — How do I delete my Substack account? · accessed Aug 2026 ↗2Sells / sharesstated
The CCPA Policy states “We do not sell your Personal Information, and we do not share your information with third parties for the purpose of cross-context behavioral advertising” — the plain no-sell shape.
Substack CCPA Policy · accessed Aug 2026 ↗1Trains AIstated
Neither the privacy policy nor the CCPA policy states whether Substack trains AI models on user content — generative AI appears only as a service-provider mention — so model-training use is scored at the unclear level (Telegram/Netflix parity).
Substack Privacy Policy — (no AI-training clause) · accessed Aug 2026 ↗0API access — feeds Agent Readiness, not the /12stated
Substack publishes no developer platform or consumer OAuth API; there is no documented way for a third-party agent to fetch your subscriptions, comments or reading data — the self-data path is emailing privacy@substackinc.com.
Substack Help Center (no developer API documented) · accessed Aug 2026 ↗Graded 2026-08-31 against the Substack Privacy Policy (last updated May 14, 2026), the separate CCPA Policy (Feb 19, 2025) and Substack's help-center articles. Consumer surface = a Substack account, operated by Substack Inc., San Francisco — a two-sided surface: the self-serve export tool is writer-side (publication Settings → Exports); a reader has no export tool. By design, subscribing shares your name and email address with the publication's writer — service provision, not advertising, so it sits outside the Sells cell. The services “do not support Do Not Track requests at this time”. Recipients of direct messages may keep them after you delete your account. The policy is silent on training Substack's own models (generative AI appears only as a service-provider mention). All cells stated, not tested.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Substack — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Substack.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Substack
- Go to https://substack.com/settings — Substack's data-request entry point.
- Settings: self-serve account deletion (Danger Zone); writer-side export under publication Settings → Exports; other rights via privacy@substackinc.com.
- Expected wait: copy-of-data requests answered within a stated one month; CCPA requests “consistent with applicable law” — Substack's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Substack — Privacy: mailto:privacy@substackinc.com.
These steps reflect Substack's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.