Privacy Policy — Substack Autopilot

Last updated: October 3, 2026

Substack Autopilot ("the Extension", "we") is a Chrome extension that helps writers draft, schedule and analyze Substack Notes. This policy explains exactly what data the Extension handles, where it goes, and why. Substack Autopilot is an independent tool and is not affiliated with or endorsed by Substack Inc.

1. Data stored only on your device

The following is saved in your browser using chrome.storage.local and is never sent to our servers:

Your note drafts, scheduled queue and posting history
Note analytics the Extension reads from your Substack Notes page
Your Substack username (detected from the Substack subdomain you visit)
Any AI provider API keys you enter (OpenAI, Google Gemini, Anthropic) and your writing examples
Your settings and preferences

Uninstalling the Extension deletes all of this data.

2. Data we collect

Data	When	Why	Where it goes
First name, last name, email, Substack username, registration time, plan status, license key (if you enter one)	When you register in the Extension	To create your account, manage your free trial and paid plan, and provide support	Our account database (Supabase) and our private registration sheet (Google Sheets, via Google Apps Script)
Email and password	When you sign in to a Pro account	Authentication. Passwords are handled by Supabase Auth and are never visible to us.	Supabase
Note topic, writing examples and mode	Only when a Pro user clicks AI generate	To generate the note text; we also store a daily usage counter to enforce limits	Our server (Supabase Edge Function), which forwards the request to Anthropic. We do not store the prompt or the generated text.

3. Data sent directly to third parties

Substack. The Extension acts on your behalf using your existing, logged-in Substack session in your browser. It sends your notes and mention searches to Substack and reads public leaderboard, profile, note and reply data. We never see or store your Substack password or cookies. Substack's own Privacy Policy applies.
AI providers (bring-your-own-key). If you enter your own OpenAI, Google Gemini or Anthropic API key, the text you ask the AI to work on is sent directly from your browser to that provider. It does not pass through our servers. That provider's privacy policy applies.

4. What we do not do

We do not sell or rent your data.
We do not use your data for advertising, and we do not use tracking or analytics scripts.
We do not read your browsing history. The Extension only runs on substack.com pages.
We do not use or transfer your data for purposes unrelated to the Extension's core functionality, or to determine creditworthiness or for lending.

The use of information received from Google APIs and the Chrome Web Store adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Permissions

storage: to save your queue, history, settings and keys on your device.
scripting: to read your Notes analytics and to fill in the Substack editor when you choose to post through it.
Access to substack.com: to schedule notes, search mentions, and read leaderboard and analytics data through your Substack session.

6. Security and retention

Data in transit is sent over HTTPS. We keep account data while your account is active. You can ask us to delete your account data at any time, and we will do so within 30 days.

7. Changes

If this policy changes, we will update the date above and post the new version on this page.

8. Contact

Questions or deletion requests: taylanhanr@gmail.com · taylanhanr.substack.com