Subshack reads a Substack writer's own account, using the browser session they are already signed in with. It never reads, stores or transmits that session; it holds no password and has no sign-up.

WHAT STAYS ON THE DEVICE
Settings, the local library of the user's own articles, their Notes and article statistics, their audience data, their subscriber list and the public profiles of readers who engaged with them. All of it lives in the browser's extension storage, on the user's machine.

WHAT LEAVES THE DEVICE
• Account backup, on by default for new users and disclosed in setup and Privacy: Notes and articles with statistics, the labels computed for them, the people Substack exposes on the user's Notes, and the subscriber list including e-mail addresses. It can be switched off at any time.
• Messages the user sets up — a campaign message in Substack group chats or to chosen readers, welcome messages — are sent from the user's own Substack account, to Substack. Campaigns are stored in the user's private Subshack account.
• AI on conversations: to suggest a reply, the message and its thread are sent to our backend and AI provider; to follow a campaign, the new messages of the conversations it started are read the same way and not stored. A welcome message in AI mode is drafted by the same provider. The text of the user's own Notes is sent for classification.
• The public Substack address the user types into the profile audit, scored server-side.
• Anonymous usage analytics — interface clicks and scroll depth, no personal data — and a session replay of our own options page in which all text, all input, all link URLs and all images are masked before sending. This is the optional "technicalAndInteraction" collection; the "Privacy & data" screen turns it off.

WHAT IS NEVER SENT
The Substack session or any cookie. Nothing is sold, and nothing is transferred to third parties for their own use.

Full policy: https://www.subshack.pro/privacy
Publisher: 404-DEV, INC. — contact@404-dev.com — support: hello@subshack.pro