Substack

Substack, Inc. is headquartered in San Francisco and processes user data mainly on US infrastructure under the CCPA; it does not offer a dedicated EU data residency option. This places Substack account and content data under US jurisdiction, including exposure to the CLOUD Act.

Substack's privacy policy states it uses SSL/TLS for data in transit and encrypted secure servers for storage but says this is not a substitute for secure messaging services. Direct messages and paid content are not end-to-end encrypted, and Substack's systems can read them.

Substack's privacy policy states it does not sell personal data, but does share it with third parties; an independent review notes "data is shared with advertising partners, analytics providers, and affiliated companies." Substack's own cookie disclosures list Google Analytics and Meta/Facebook Pixel under "third-party analytics tracking," and creators can add further trackers (Twitter/X, AdQuick, Parse.ly). Meta Pixel is an ad-retargeting tool by design, so this is behavioral data shared with an advertising partner, not merely anonymized aggregate analytics.

Substack states it does not use publisher content to train its own generative AI models. Separately, it offers creators an opt-out toggle to signal that third-party AI tools (ChatGPT, Claude, Gemini, etc.) should not train on their publication. However, Substack notes compliance depends on the external tool honoring the signal.

Substack's web and mobile apps are closed source with no public repository. Outside parties cannot inspect, audit, or fork Substack's code.

No independent security audit, SOC 2 report, ISO certification, or dedicated trust or security page exists for Substack.

Substack is a closed-source, commercial platform with no public contribution process or documented governance model.

Substack charges nothing to read or publish on the platform. Its revenue comes from a 10% fee on paid subscriptions that creators set for their readers, a marketplace or transaction-fee model rather than monetizing users' data.

Reading and publishing free newsletters are fully functional, with no artificial gating that pushes users toward paid tiers. The only notable paid add-on is an optional custom domain (~$50/year).

Substack's fees (10% platform cut, plus Stripe's roughly 2.9%+30¢ and a 0.7% recurring-billing fee added in July 2024) are documented in its help center. However, at least one independent critique argues that the effective total cost isn't clearly shown up front on creator subscription pages.

Substack supports payment in 13 currencies and lets creators set their own discount codes, providing some regional flexibility. However, there is no Substack-level purchasing-power-adjusted pricing policy. Regional discounting depends on individual creators or third-party tools like ParityDeals.

Writers can export their subscriber list as CSV (email, subscribe date, status, tier, payment amount) and their post archive as CSV and HTML via Settings → Exports, in open, machine-readable formats. But the export is well short of "all data": it excludes images, and independent reporting confirms it also omits Notes, comment threads, drafts, and per-post engagement data (likes, comments) — by one account, "about a third of the thing."

There is no self-hosting option for Substack. Leaving the platform means migrating content to an external tool like Ghost. Substack's export does not preserve images or internal links, making migration lossy.

Substack requires an internet connection to read, write, or publish. Only the email delivery to subscribers happens independently once a post is sent. No offline mode is documented.

Substack is available on web, iOS, and Android (Android publishing was added in June 2026). There is no official Linux, BSD, or F-Droid distribution. Only closed, proprietary apps are available.

No public accessibility statement or VPAT was found for Substack.

Substack is VC-backed: Andreessen Horowitz (a16z) led a $65 million Series B in March 2021, and a July 2025 Series C raised $100 million, led by BOND and The Chernin Group (with a16z, Rich Paul, and Skims CEO Jens Grede also participating), valuing the company at $1.1 billion.

Substack raised a $100 million Series C round in July 2025, adding BOND and The Chernin Group as new investors alongside existing backer a16z. This nearly doubled its valuation to unicorn status ($1.1 billion), marking a significant recent change to its capital structure within the last three years, short of an acquisition.

Substack does not run advertising, though its CEO said the company is "not ruling out" ads in the future. In 2023-2024, Substack faced sustained public criticism for hosting newsletters promoting Nazi and white-supremacist content. CEO Hamish McKenzie initially defended a hands-off moderation stance. Substack removed only five publications for incitement to violence in January 2024 under continued pressure, without committing to proactively remove extremist content more broadly.

No environmental or sustainability report, ESG disclosure, or climate commitment was found for Substack.

Substack was founded in 2017 by Chris Best, Hamish McKenzie, and Jairaj Sethi, giving it about nine years of continuous operation at the time of this evaluation, well past the five-year threshold.

Substack shipped a wide range of new features through 2025-2026: Notes scheduling, live video and a Recording Studio, a TV app beta, multi-author "Post as" collaboration, email automations, and cross-platform syncing to YouTube, Spotify, and LinkedIn. Paid subscriptions grew from about 3 million in early 2024 to over 5 million by March 2025. This clearly shows active, well-funded development, not stagnation.