Last updated: September 22, 2026
This policy applies to the StackBuddy web application at stackbuddy.io and the StackBuddy Chrome Extension.
StackBuddy is a scheduling and publishing tool for Substack creators. It is operated by the StackBuddy team. If you have any questions about this policy, please contact us at privacy@stackbuddy.io.
When you create an account we collect your email address and a securely hashed password. We also store the role assigned to your account (e.g. Pro, Expert).
To connect your Substack account you provide your Substack handle, publication URL, and profile ID. We may also store your subscriber count when it is retrieved to display analytics.
We store the Substack Notes you create or schedule in StackBuddy, including their text, attachments, and scheduled publish time. We also store notes synced from your Substack profile via the Chrome extension (see section 4), including text, author handle, and engagement metrics (likes, restacks, comments).
If you use the AI generation features, we store your writer profile – a description of your writing voice and style that you create in the app – to generate notes in your voice.
Payments are processed by LemonSqueezy. We do not store your card or banking details. We store your subscription status and plan (e.g. Pro, Expert) to gate features.
We collect basic server-side logs for error tracking and performance monitoring. The Chrome extension periodically sends a lightweight heartbeat containing the extension version number and a truncated browser user-agent string (max 256 characters). This is used solely to monitor extension health and compatibility – no browsing history or personal data is included.
We do not use your data for advertising, profiling, or any purpose unrelated to providing the StackBuddy service.
The StackBuddy Chrome Extension interacts with Substack on your behalf. Here is exactly what it does and why:
| Permission | Why it is needed |
|---|---|
| storage | Saves your settings locally in the browser (StackBuddy server URL and publishing check interval) so they persist across browser sessions. |
| activeTab | Opens a Substack tab when needed to publish scheduled notes or fetch your existing notes for syncing. |
| scripting | Injects scripts into Substack pages to programmatically create and publish your scheduled Notes, and to read your existing notes for syncing to your StackBuddy dashboard. |
| alarms | Schedules background tasks: publishing checks (configurable interval), notes sync (every 6 hours), and heartbeat pings (every 2 minutes) to keep the extension responsive. |
| Host permissions (stackbuddy.io, substack.com) |
stackbuddy.io – to retrieve your scheduled notes and report publish results to the API. substack.com – to publish notes and read your existing notes on your behalf. |
The extension does not use remote code. All JavaScript is bundled within the extension package. It does not read, store, or transmit your Substack session cookies. Your active Substack login is used natively by the browser to authenticate API calls, exactly as a normal browser tab would.
The note content the extension reads from Substack is sent to your StackBuddy account on stackbuddy.io and is used only to populate your notes dashboard and analytics. It is not used for any other purpose and is not shared with third parties.
We use the following third-party providers to operate StackBuddy:
We do not sell, rent, or trade your personal data with any third parties outside the above service providers.
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (e.g. payment records).
Depending on your location you may have the right to:
To exercise any of these rights, please contact us at privacy@stackbuddy.io.
All data is transmitted over HTTPS. Passwords are hashed using ASP.NET Core Identity's built-in secure hashing. We apply role-based access control so users can only access their own data. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.
Necessary cookies support sign-in, security, and your requested preferences. We store your privacy choices in the host-only sb-consent cookie for 180 days. This cookie contains a version, choice timestamp, and category settings, with no account or visitor identifier. Theme, editor, and other requested interface preferences may use local browser storage.
Optional usage analytics is off until you allow it. When enabled, StackBuddy receives browser events about pages viewed and upgrade interactions. Rejecting or withdrawing this choice stops future optional browser event collection. We do not retain pre-consent events to send later. This choice does not erase account, billing, scheduling, or operational records already held by the service.
Vimeo testimonial videos load automatically, independently of cookie choices, using Vimeo’s do-not-track player setting. YouTube help videos remain blocked until you enable external media. When loaded, these providers receive your IP address and browser information and may use their own cookies or storage. Withdrawing external-media consent reloads the page to stop optional players; Vimeo testimonials continue to load. We cannot remove cookies held on a provider's own domain; those can be managed through your browser or the provider.
Fonts are served by StackBuddy. Lemon Squeezy checkout loads when you request checkout and processes payment under its own privacy policy. Rejecting optional categories does not prevent signing in, scheduling, or buying a subscription. Operational server-side error/security logs and records of account actions are separate from these optional browser categories. The Chrome extension uses chrome.storage.local for its settings and required publishing state; this website preference does not disable requested extension functionality.
You can accept, reject, or customize optional categories, and change your choice at any time using . Choices expire after 180 days; malformed or unavailable preferences keep optional features off. Rejecting does not prevent access to the site. We do not use advertising cookies. Tracking scripts installed by customers on other websites require that website's own privacy information and consent integration; your StackBuddy website choice does not authorize tracking on those sites.
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes we will notify you by email or via an in-app notice.
If you have any questions about this Privacy Policy or how we handle your data, please get in touch.
hello@stackbuddy.io