Privacy Policy

User Data Collection

We collect user data that is needed to operate WriteStack: scheduling and publishing Substack Notes, analytics, automations, account access, billing, and related product features. We collect data you give us directly, data the Extension reads from Substack while you are signed in, and limited technical data generated by use of the Service.

Account and identity data we collect includes:

• Name, email address, profile photo, and password (stored as a hash) when you create an account
• Google account identifiers and OAuth tokens if you sign in with Google
• Session tokens and authentication cookies for your WriteStack account

Content and Substack data we collect includes:

• Notes, drafts, scheduled posts, images, attachments, voice memos, writing-style settings, and other content you create in WriteStack
• Public and non-paywalled Substack Notes, posts, comments, restacks, and engagement statistics needed for analytics, inspiration, scheduling, and automation
• Subscriber and audience metadata used by features you enable, such as welcome DMs (name, handle, photo, subscription type, and related profile data) and email-list export job records
• Direct-message metadata used to help you connect with people who engage with your content, such as thread participants, handles, timestamps, and unread counts. We do not store the body of your private Substack direct messages

Authentication and extension data we collect includes:

• Substack session cookies (including substack.sid, substack.lli, and related browser cookies) so the Extension can schedule, publish, and sync on your behalf while you are logged into Substack
• A WriteStack extension key, the installed Extension version, and your linked Substack author or publication identifiers
• API keys and OAuth tokens for optional integrations you connect, such as Buffer, Kit, or the WriteStack MCP

Connected social account data we collect, when you choose to connect an account, includes:

• OAuth access and refresh tokens (or, for Bluesky, an app password you create), their expiry, and the permissions you granted
• The account's platform ID, name, username or handle, and profile picture, so you can see which account you're posting to
• For accounts you manage on behalf of others, the Pages, organizations, channels, or business locations you can post to, so you can pick one
• Platform settings needed to publish, such as your Pinterest boards, your TikTok posting options (who can view, comment, duet, or stitch), and your YouTube channel
• The posts you send through WriteStack: text, images, videos, thumbnails, titles, tags, and per-platform settings, plus the resulting post ID, link, and publishing status

We do not currently read your followers, direct messages, or post analytics from connected social platforms. If we add features that do, we will update this policy first and ask for the matching permission when you connect.

Billing, usage, and device data we collect includes:

• Subscription status, Stripe customer and subscription identifiers, and limited payment metadata. Full card numbers are collected and stored by Stripe, not by WriteStack
• Product usage events, feature interactions, pages viewed, approximate location derived from IP address, browser type, and device information
• Support messages, feedback, and emails you send us

The Extension does not collect paywalled, subscriber-only, or similarly designated paid Substack content. That paid content stays on your device and is not transmitted to or stored by WriteStack.

User Data Handling

We handle user data only to provide, maintain, secure, and improve WriteStack's single purpose: helping creators write, schedule, publish, analyze, and grow Substack Notes and related content.

Specifically, we handle user data to:

• Create and authenticate your account, keep you signed in, and connect the Extension to the correct Substack publication
• Schedule, sync, and publish Notes and chat posts through the Extension using your Substack session
• Publish the posts you create or schedule to the social accounts you connected, at the time you choose, and show whether each post succeeded
• Keep connected social accounts working by refreshing their tokens before they expire, and email you when an account needs to be reconnected
• Show analytics, inspiration, activity, welcome DMs, and other features you turn on
• Generate or improve drafts when you use AI-assisted writing tools
• Process payments, manage subscriptions, and send transactional or product emails
• Diagnose errors, prevent abuse, and measure whether the product is working
• Comply with law, enforce our Terms of Service, and respond to support requests

User data is transmitted over HTTPS. Access inside WriteStack is limited to systems and people who need it to operate the Service, investigate abuse, or provide support you request.

Limited Use disclosure: We comply with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data collected through the Extension is used only to provide or improve user-facing WriteStack features. We do not sell Extension user data. We do not use Extension user data for personalized, retargeted, or interest-based advertising. We do not allow humans to read Extension user data except with your consent for support, when required for security or legal compliance, or after the data has been aggregated and anonymized for internal operations.

User Data Storage

We store user data on our application servers and in cloud infrastructure used to run the Service. That includes a hosted database, object storage for images and uploads, and application hosting.

How storage works:

• Account, notes, schedules, analytics, extension keys, integration tokens, and settings are stored in our primary database
• Images and other file uploads are stored in cloud object storage. Videos and images you send to social platforms are stored there so each platform can fetch them when your post is published
• Tokens for connected social accounts are encrypted before they are stored in our database and are only decrypted to publish or to refresh the connection. When you disconnect an account in WriteStack, we delete its stored tokens and stop its scheduled token refresh
• Substack session cookies needed for publishing are stored so the Extension and server-side automations can act on your behalf until they expire or you disconnect
• Payment card details are stored by Stripe. We store only the billing identifiers and subscription records needed to manage your plan
• Some preferences and UI state may also be stored locally in your browser (for example localStorage) and are not used to identify you across unrelated sites

We retain user data while your account is active and for as long as needed to provide the Service, meet legal or accounting requirements, resolve disputes, and prevent abuse. When you delete content or close your account, we delete or de-identify associated personal data within a reasonable period, except where we must keep a limited record (for example a billing receipt or a record of a ban).

We use commercially reasonable safeguards to protect stored data against loss, theft, unauthorized access, disclosure, copying, use, or modification. No method of storage is completely secure, and we cannot guarantee absolute security.

User Data Sharing

We do not sell personal information. We share user data only in the circumstances below, and only as needed to operate the Service or as required by law.

We share data with the following categories of parties:

• Substack, when the Extension uses your session to publish, schedule, sync, or read the non-paywalled data required for a feature you use
• Stripe, to process payments and manage subscriptions
• Google, if you sign in with Google, and for website analytics and advertising conversion measurement on writestack.io
• PostHog and Vercel, for product and website analytics
• Amazon Web Services, MongoDB, and Vercel, for hosting, database, file storage, and scheduled jobs
• Kit, to send transactional and product email and, if you connect Kit, to sync newsletter data you choose to connect
• AI model providers (including OpenAI and Anthropic) when you use AI writing, analysis, or chat features. Those providers receive the prompts and content needed to generate a response
• Buffer, if you connect Buffer to cross-post Notes
• The social platforms you connect (X, LinkedIn, Meta for Facebook, Instagram and Threads, Bluesky, your Mastodon server, TikTok, Google for YouTube and Google Business Profile, and Pinterest). We send each platform only the content and settings of the posts you publish to it, using the access you granted
• Meta, for advertising conversion measurement on the WriteStack website (not for Extension-collected Substack data)
• Datadog, for application logging and error diagnostics
• Rewardful, if you join or use the affiliate program
• Service providers who help us operate email, infrastructure, or support, under contracts that limit their use of the data

We may also share data if required by law, to protect the rights, safety, or property of WriteStack or others, to investigate abuse, or as part of a merger, acquisition, or sale of assets. In those cases we share only what is reasonably necessary.

We may publish aggregated, anonymized statistics that cannot reasonably identify you. We do not share Extension-collected personal or sensitive user data for advertising, and we do not transfer that data except as needed to provide the Extension's features, to comply with law, for security, or as part of a sale of the business.

Chrome Extension

The official browser extension is WriteStack: Substack Notes Scheduler & Analytics (Chrome Web Store item ID emdlbnkhjpfcooclfbodmhkhkohcjaoa). The Extension runs in your Chromium browser so WriteStack can schedule Notes, publish content, collect analytics, run automations, and stay signed into the Substack account you choose.

The Extension may read Substack pages you are viewing or logged into, including cookies, public Note and post content, engagement stats, subscriber metadata for features you enable, and related non-paywalled resources. It sends that data to WriteStack over HTTPS using your Extension key. It does not collect paywalled or subscriber-only content.

Connected Social Platforms

Connecting a social account is optional. You choose which accounts to connect, and we ask each platform only for the permissions needed to identify the account and publish to it. We use data from these platforms only to provide the publishing features you use. We do not sell it, use it for advertising, or use it to train AI models. Each platform's own privacy policy governs what it does with the content you publish there.

YouTube and Google: WriteStack uses YouTube API Services to upload the videos you publish to your YouTube channel, set their title, description, tags, visibility, category, and thumbnail, and identify the connected channel. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies to Google's handling of your data. WriteStack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The same applies to Google Business Profile. You can revoke WriteStack's access to your Google account at any time at https://myaccount.google.com/permissions

Each platform's privacy policy, and where you can revoke WriteStack's access on the platform itself:

• X: privacy policy https://x.com/en/privacy, revoke access at https://x.com/settings/connected_apps
• LinkedIn: privacy policy https://www.linkedin.com/legal/privacy-policy, revoke access at https://www.linkedin.com/mypreferences/d/permitted-services
• Facebook, Instagram, and Threads (Meta): privacy policy https://www.facebook.com/privacy/policy, revoke access in Facebook's Business Integrations settings, Instagram's Apps and Websites settings, or Threads' Website Permissions settings. When you remove WriteStack there, Meta tells us and we delete that connection
• TikTok: privacy policy https://www.tiktok.com/legal/privacy-policy, revoke access in the TikTok app under Settings and privacy, Security, Manage app permissions
• YouTube and Google Business Profile (Google): privacy policy https://policies.google.com/privacy, revoke access at https://myaccount.google.com/permissions
• Pinterest: privacy policy https://policy.pinterest.com/privacy-policy, revoke access in Pinterest's Security and Logins settings, under Apps
• Bluesky: privacy policy https://bsky.social/about/support/privacy-policy, revoke access by deleting the app password under Settings, Privacy and Security, App Passwords
• Mastodon: your server's own privacy policy applies, revoke access under Preferences, Account, Authorized apps on your server

You can also disconnect any account in WriteStack under Settings, Connected accounts. To ask us to delete data we received from a connected platform, email support@writestack.io.

Cookies and Similar Technologies

We use cookies and similar technologies on the website and in the Extension.

• Essential cookies keep you signed in and remember security and session state
• The Extension reads Substack cookies so it can act on your Substack account
• Analytics cookies and pixels (including PostHog, Vercel Analytics, Google Analytics, Google Ads, and Meta Pixel) help us understand website usage and measure marketing on writestack.io

You can block or delete cookies in your browser. If you block essential cookies, parts of the Service may not work.

Your Choices and Rights

You can refuse to provide personal information, but we may then be unable to provide some or all of the Service. You may access, update, or delete much of your account data in the product. You may disconnect integrations and social accounts, sign out, uninstall the Extension, or request account deletion.

To request access, correction, or deletion of your personal data, email orel@writestack.io or support@writestack.io. We will respond within a reasonable time. Depending on where you live, you may also have rights under laws such as the GDPR or CCPA, including the right to object to certain processing or to lodge a complaint with a supervisory authority.

Children's Privacy

WriteStack is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

International Transfers

We may process and store user data in the United States and other countries where we or our service providers operate. If you use the Service from the European Economic Area, the United Kingdom, or another region with data-transfer rules, you understand that your data may be transferred to and stored in countries that may not provide the same legal protections.

Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the bottom of this page will change when we do. For material changes we will provide notice through the Service or by email. Continued use of the website, app, or Extension after an update means you accept the revised policy.

Contact

Questions about this Privacy Policy or about how we collect, handle, store, or share user data can be sent to orel@writestack.io or support@writestack.io. The Service is operated by WriteStack at https://www.writestack.io.