Get subshack
⚡ subshack

Privacy Policy

Last updated: 13 October 2026

Subshack is a browser extension for Substack creators, on Chrome and Firefox. It reads your own Notes and articles statistics to show you what works, shows you the readers behind those numbers, and lets you reach them through campaigns and welcome messages that you set up. This policy explains exactly what data Subshack handles, where it goes, and what we will never do with it.

Who we are

Subshack is published by 404-DEV, INC. For any question about this policy or your data, contact us at contact@404-dev.com.

What Subshack does

The extension collects the performance of your own Notes and articles so it can be analysed, shows you the people who engage with them (Audience, Opportunities), audits a public Substack profile you point it at, and sends the messages you set up (campaigns, welcome messages and replies) from your own Substack account, as described in the next section. Subshack never publishes a Note, an article or a restack, never follows, likes or subscribes on your behalf, never auto-inserts a mention, and never automates any public engagement. Requests to Substack are throttled to a human pace and only read data you already have access to.

Public audit emails. The public profile audit does not discover, infer or buy an email address. After seeing a report, you may explicitly enter your email and agree to receive that report plus one follow-up two days later. We then keep the address, the audited profile handle, browser timezone, the language selected from the public profile text, consent and delivery timestamps. Resend may record message opens through a small remote image and link clicks through a redirect so we can measure whether these requested emails are useful. We send PostHog only the message type, clicked URL and a one-way SHA-256 hash of the recipient address, never the address itself. The link in every message stops the follow-up and future lifecycle emails. Historical anonymous audits cannot be matched to an email address.

Messages, campaigns and group chats

Sending a message is the one thing Subshack can do on your behalf, and only in the ways you set up below. Every message leaves from your own Substack account, through Substack. Every sending feature has a daily limit (on the free plan: 7 private messages and 2 group-chat posts a day), respects your do-not-contact list, and can be paused at any time.

Campaigns. A campaign is one message and a link that you write, sent either to the Substack group chats you already belong to or privately to the readers you choose. Nothing is sent until you press Start sending; the campaign then sends one message at a time, spaced minutes apart. Before posting in a group, Subshack reads that chat to find whether your link is already there, so it does not post twice, and reads the group’s published house rules; groups whose rules forbid self-promotion are skipped. The campaign, its recipients and what was sent are stored in your private Subshack account so the same person or chat is not messaged twice.

Welcome messages (Automations). Subshack can welcome new subscribers and new followers with a private message you write. It is off by default. Once switched on, each welcome is prepared as a draft that waits for you, unless you explicitly choose Send automatically: it is then sent after the wait you set, outside quiet hours, once per person, and never to someone you already contacted. In AI mode, an AI model writes each welcome from your instructions.

Suggested replies. For a private conversation, Subshack can prepare a suggested reply: the message and the conversation so far are sent to our backend at saas-maker.com, which asks an AI model for the draft. The draft waits for you in Inbox; a reply is sent automatically only if you explicitly turn automatic replies on, after a random delay, within the quiet hours and the daily cap you set.

The Inbox tab keeps track of what came back from a campaign. Every two hours, and when you press Check inbox, Subshack re-reads the private conversations that a campaign started, never your whole inbox, and sends the new messages of each conversation, yours and theirs, grouped by conversation, to our AI provider so it can tell what they contain: a promise and its date, a question left unanswered, how interested the person sounds. The text is read and discarded; what is kept is that reading: a status, a date, a few words summarising the promise, the one sentence that carries it (quoted from the message) and a one-line summary of where the conversation stands, never the messages themselves. You can switch this off in Inbox › Safety; a small keyword reader then runs on your device instead, and no message text leaves it.

Prospects and your group chats. Subshack can point out readers who keep engaging with your Notes but have no confirmed subscription, and suggest a short personal note you copy and send yourself. To know whether you already share a group chat with such a reader, it can read the chats you belong to, but it is off by default, and when you switch on Read my group chats to spot prospects it only reads the threads you wrote or commented in, never the rest of a group. What it keeps is who was there (Substack ids, handles and dates), on your device; message text is never stored, and nothing is posted or sent.

Lead spotting in your group chats. Off by default, and only for accounts where the feature is enabled. When you switch on Spot leads in my group chats, the latest threads and new comments of the group chats you opted in, and the messages of any group chat you open, are sent to our backend at subshack.pro, which asks a decision model (Jev, by TypeSafe, reached through OpenRouter) two questions: what the message is about, and whether its author is looking for help with their own Substack. The text is read for that question; apart from the lead cards described below, what our servers keep is that verdict, under the id of the message, never the message. To judge how well such a person matches the ideal reader you describe, or, if you did not describe one, the reader your own public Substack bio and latest titles point to (your bio is read once every 30 days from your own profile and only travels inside that evaluation), Subshack may read their public Substack bio once: that bio is kept for 30 days in a registry shared by all Subshack accounts, so a person is never fetched twice by two of our users. That registry describes public Substack profiles, is not tied to your account, and is therefore not covered by “Delete my account” (like the public profile audit). A spotted lead keeps the one sentence that triggered it (160 characters at most) on this device and on your Subshack account. A lead you did not handle leaves both after 7 days (a message older than that is no longer a lead); on this device, a lead you handled is kept 14 days so the same person is not suggested again: when lead spotting finds someone, your extension sends the lead to subshack.pro: their name and Substack handle, that sentence, the group chat it was written in and the link to the message. This lets Subshack email you about new leads even when your browser is closed. These lead cards are deleted from your account after 7 days, and with your account. At most once every two days, when at least two new leads are waiting and your account has an email address you did not unsubscribe, Subshack emails you up to two of them through our email provider (Resend). A reply is drafted only when you click Prepare reply, and nothing is sent or posted to those people by Subshack. Turning lead spotting off deletes the lead cards from your account and stops the email; the unsubscribe link in any of our emails stops the email.

Conversation sorting. The Conversations screen opens on the replies that need you. It is off by default for conversations a campaign did not start: only if you switch on Sort my conversations does Subshack read, for each conversation listed there, your last message and theirs since (at most four, 800 characters each) and send them to our AI provider to tell what their last message calls for: a question, interest, a thank-you, a request to talk again later and when, or a request to stop. A thank-you, an emoji or a lone “stop” is sorted on your device and never sent. The text is read and discarded; the result (a status, a date, a one-line summary, up to three suggested replies and a few tags from a fixed list) stays in this browser and is not stored on our servers. When someone asks you to stop, Subshack adds them to your Never contact list (you can turn this off, and undo it from Conversations). With the switch off, or with AI features disabled, simple rules on your device sort what they can.

Subshack still never publishes a Note, an article or a restack, and never follows or subscribes for you.

Campaign Mode links

Campaign Mode runs directly on supported Substack pages, Facebook Groups, Reddit communities and X. It lets you choose a campaign and copy a link to the campaign’s destination URL, with campaign parameters describing where you plan to share it. The page you are visiting is never substituted for that destination.

Campaigns are stored in your private Subshack account. When, and only when, you press Copy link, we store the campaign, destination URL, platform, context type and stable context id, a readable community name when available, the source page URL without query parameters or fragments, the UTM parameters and the creation date. This lets the same campaign and context reuse one link instead of creating duplicates. A snapshot of the active campaign is also kept in Chrome local storage so Campaign Mode survives a browser restart.

Campaign Mode does not read or store the text of posts, Notes, chats or private messages. Substack Inbox and X Messages are excluded from context detection. Opening or navigating a supported page prepares only its URL-derived context and stores nothing on our servers until you click Copy link.

How Subshack reads your Substack data

When you start a synchronization, Subshack calls Substack from your browser, using your own logged-in session, to read data about your Notes. Your Substack session cookie stays in your browser: it is never sent to us or to anyone else. These Substack endpoints are internal and undocumented; they can change or break at any time, which may interrupt synchronization.

Public profiles of people who engage with you

Substack does not include a bio in the like, restack or reply payloads. To tell you which of your known readers is genuinely connected to the topic you are writing about, Subshack can read the public profile of the people who engaged with your Notes organically or subscribed through them: substack.com/api/v1/user/<handle>/public_profile, the same data anyone sees on their public page (bio, publication, follower count), plus whether that person follows you. Substack only answers that last question to a signed-in request, so these reads are sent with your Substack session, like the synchronization itself. They are throttled, run at most once a month per person, and the result stays on your device.

These profiles are used only to show you who engages with your content. They stay on your device: they are not sent to our servers by synchronization, enrichment, or any automatic process. The one exception is the assistant, and only when you ask it a question about your audience (see The assistant below, including which fields are never sent).

Data stored on your device

The following is stored in your browser (extension local storage). A private copy is also sent to your Subshack account while Backup to your Subshack account is enabled, on by default for new users, described in its own section below, and switchable off:

You can delete all of it at any time: see Your choices below.

Backup to your Subshack account (on by default for new users)

Data is computed and stored locally. When backup is enabled, a private server copy also supports your web dashboard, AI connector (MCP), and connected agents while the browser is closed.

New users have private account backup enabled by default when they connect their publication. You can turn it off in Settings › Privacy at any time. Existing disabled backup settings are preserved. Creating or connecting the account required for Growth features does not override a disabled backup preference.

While backup is enabled, each synchronization also sends:

This copy is private to your account. It is never shared with other users, never sold, and never used to train any model. Turning the setting off stops any further upload; to remove the copy already stored, use Delete my Subshack data in the extension, which deletes the server-side copy as well as the local one.

If you create a separate read-only analytics token, tools you choose to connect, such as a Google Sheet, NotebookLM, ChatGPT or Claude, can read a privacy-filtered projection of this copy. It contains your publication's public identity and bio, its public and aggregate audience counts, article titles and URLs, Note excerpts and URLs, Note classifications, and aggregate content performance. It excludes subscriber identities, e-mail addresses, recipients, messages and raw source payloads. You can revoke each token from your dashboard at any time.

Data sent to an AI provider

The AI features that work on your conversations (suggested replies, the campaign reading in Inbox, conversation sorting and welcome messages in AI mode) are described in Messages, campaigns and group chats above. Three other features send data to an AI provider:

All AI features go through OpenAI as the model provider, are used only to return your result, are not used to train models, are not sold, and are not used to build advertising profiles. We do not store your conversations or your drafts on our servers. The only thing kept is the short campaign reading described above. You can turn off generation and classification in Settings → Privacy → Disable AI features, with rule-based classification only; the campaign reading has its own switch in Inbox › Safety, and conversation sorting is switched on and off in Conversations.

Your audience data

Your subscriber list, per-Note and per-article statistics, and which subscribers opened each e-mail are read from your own publication during synchronization and kept on this device. They are copied to your private Subshack account only while backup is enabled (see above), never shared with other users, never sold, never used for advertising.

The assistant

The assistant answers questions about your own account. It is the only part of Subshack that can send information about other people off your device, so it asks for your explicit agreement the first time you open it, and does nothing until you agree.

What it can send, and only when the question requires it:

What it never sends, by design and enforced by an automated test: the text of anyone’s replies, their profile photo, or their bio. Your conversation is kept on your device and can be cleared from the panel at any time.

People who are not Subshack users

The people named above are Substack creators and readers who interacted with your Notes. They are not Subshack users and have not agreed to anything with us. We handle their data on the following basis:

Analytics

To understand which features are useful and improve the product, Subshack sends anonymous, aggregated usage events (for example: a suggestion was generated) to PostHog (EU region, eu.i.posthog.com). These events are tied to the anonymous identifier described above, never to your name, email, or Substack account, and contain no personal content.

One exception, and we want to be precise about it. Extension events also carry a publication fingerprint: the first 16 characters of a SHA-256 hash of your public Substack handle. Your handle itself never leaves your device. We use it for one thing: counting one creator once, instead of counting a new person every time the extension is reinstalled. Because Substack handles are public, this fingerprint is pseudonymous rather than anonymous: someone holding a list of handles could match it back. It is never used to contact you or to build a profile.

When you remove the extension, Chrome opens one last page. That is a Chrome feature (uninstall URL), not a background process of ours. Nothing of Subshack is running at that point. The page records that the extension was removed, with the same anonymous identifier, the publication fingerprint and the version, so we can tell people who left from people who simply stopped opening it. It carries no reason, no content and no personal data, and your local data is already gone with the extension.

On the subshack.pro website, the same anonymous events record the pages you visit and how you got there: the referring site (for example substack.com) and any campaign parameters in the link you clicked (utm_source and the like). This tells us which links bring people in. We use no advertising or cross-site tracking cookies, and we do not build a profile of you across other websites.

The website sets a first-party cookie. It holds the anonymous identifier and nothing else, and it is what lets us tell a returning reader from a new one instead of counting the same person twice. Website analytics are served from subshack.pro/ph-relay, our own domain, and forwarded to PostHog in the EU, so that privacy tools blocking third-party domains do not silently break our page counts. Same data, same processor, one less broken measurement.

The extension keeps one more cookie on subshack.pro: your account key. Removing a browser extension erases everything it stored, including the key that ties this browser to your Subshack account, so reinstalling used to start a new, empty account while yours still existed. subshack.pro now keeps that key in a cookie of its own (subshack_device): no script can read it, it is only sent to our own API, and no other website can send it. When you reinstall, the extension asks for it and finds your account again, with your streak and your backup. It holds nothing else, expires after 400 days, stops working the moment you delete your account, and disappears when you clear subshack.pro’s cookies.

We record website sessions. On subshack.pro we capture a replay of the page as you saw it (clicks, scrolling, navigation) to find where the site confuses people. Everything you type is masked: form fields are never recorded. Replays are stored by PostHog in the EU and are used only to fix the site. If you sign in, this and the events above are linked to your account id, never your email address, so that we can count one person once across devices.

We also record the extension’s dashboard, and there every single word is masked. The Subshack dashboard (the extension’s options page) is recorded the same way, for the same reason: to see where the product wastes your time. Because that page shows your subscribers, their email addresses, your message drafts and your Note contents, the recording is far stricter than on the website: all text is replaced by ••• before anything leaves your device: not only what you type, but every label, name, number and paragraph on screen, along with link addresses, images and anything that could identify a person. What is left is the shape of the page: layout, cursor, clicks, scrolling, which screen was open and how long it took to load. Nothing readable is ever sent. You can turn this off in the extension under Settings → Privacy → Session recording; usage counters keep working.

The Subshack workspace at subshack.pro/app displays what the extension holds in this browser. The page reads it from the extension, locally; nothing is uploaded to display it. In a browser without the extension, if you are signed in, the same page shows your account’s private backup instead, read-only and dated: only what the extension already backed up, never anything new. It is not recorded by session replay.

Signing in joins your existing Subshack account. When you sign in on subshack.pro in a browser where the extension already works, your sign-in is attached to the Subshack account that extension has been using: your data stays where it is, nothing is recreated. If two of your Subshack accounts follow the same Substack account, they are combined into one without deleting anything; if they follow different Substack accounts, we ask you before combining them.

Crash reports

When something breaks, Subshack sends a short technical report to Sentry (EU region, de.sentry.io) so we can fix it. A report says where in the product the failure happened, an error code, a few counters, the extension version and whether it came from Chrome or Firefox. Before anything is sent we strip email addresses, Substack handles, web addresses and long identifiers out of the message, so no subscriber name, no draft, no page content ever travels with it.

A report carries the same identifier as the analytics above: your account id if the extension is linked, otherwise the anonymous device identifier, plus the publication fingerprint when we have it. We use it for one thing: telling whether twenty reports are twenty people or one person twenty times, and being able to look into your case if you write to us. We explicitly switch off IP collection on these reports, which is why an identifier we chose replaced the address Sentry would otherwise have recorded on its own.

What we never do

Your choices

If you are a Substack creator whose public identity appeared in someone’s Subshack audience and you want it removed, that data lives on that person’s device; contact us and we will explain how to have it cleared. For anything else, email contact@404-dev.com.

Data retention

On-device data persists until you clear it or uninstall the extension. Content sent to generate a suggestion is processed to return your result and is not used to build a profile of you. Analytics events are retained in aggregate to measure product usage.

Children

Subshack is intended for Substack creators and is not directed to children under 13.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected on this page with a new “Last updated” date.

Contact

404-DEV, INC., contact@404-dev.com

← Back to Subshack