Privacy.

• Your workspace content (writing samples, drafts, Voice File, settings) is stored to make the product work. We do not sell it and do not use it to train AI models.
• The Chrome companion reads only the text you select and the empty editor you focus, only on substack.com and your signed-in Stackvoice tab. It never reads cookies and never stores a key.
• Your account and workspace data live in a Supabase Postgres database in Frankfurt, Germany (eu-central-1). App servers run on Vercel in Frankfurt (fra1).
• AI drafting is sent through OpenCode Zen to Anthropic's Claude models. Payments are handled by PayPal; we never see or store a card number. Email is sent through Brevo.
• You can export or delete your workspace and account yourself, from Settings.

MACHINES - WORDS (Pty) Ltd, registration number 2026/713540/07, registered at 17A Ophir Road, Plumstead, Cape Town 7801, South Africa, is the responsible party under the Protection of Personal Information Act (POPIA) and the controller under the GDPR where it applies. Aaqiel Pillay is the Information Officer. Reach us through the support form. We do not publish a personal email address or phone number for account requests.

• Account: your name, email address and a hashed password. Kept while your account exists.
• Workspace: publication settings, writing samples, Voice File, drafts, ideas, headlines, replies, imported metrics. Kept while the workspace exists.
• Plan: which plan a workspace is on, its status, and PayPal's subscription id. Kept while the workspace exists.
• Billing events: the notifications PayPal sends about a subscription, so a dispute can be settled from a record. Kept as long as tax and accounting law requires.
• Sign-in and error records: short-lived rate-limit counters, and error records used for reliability monitoring (a route, an error type and a truncated message, never a request body or an email address).

A new workspace starts with 10 free AI drafts, tracked as a count on the workspace. No card is required for this, and no card details are stored until you choose a paid plan.

The companion is a side panel next to Substack. It can read the text you select and the empty editor you focus, only on substack.com or a *.substack.com tab and your one paired, signed-in Stackvoice tab. It can show you a saved, approved draft. It can insert the exact saved revision into the editor you captured, after you confirm the revision, the surface and the destination.

It never reads a cookie, never stores a key or token of its own, never presses Publish, Post or Send, never auto-schedules, auto-likes or auto-follows, and has no permission on any site other than substack.com and the one paired Stackvoice origin.

• Vercel, Inc. - application hosting, Frankfurt, Germany (fra1).
• Supabase, Inc. - database, Frankfurt, Germany (eu-central-1).
• OpenCode Zen - routes AI drafting requests to Anthropic's Claude models. Anthropic PBC processes the request text needed to generate a draft.
• PayPal - payments. PayPal's own privacy policy governs what PayPal collects.
• Brevo - transactional email (verification, password reset, support replies).

One session cookie so you stay signed in, and one cookie that remembers your active workspace. No advertising cookies and no third-party analytics cookies.

• You can export your workspace content at any time from Settings.
• You can delete a workspace you own from Settings. Nothing in it survives: no draft, no idea, no saved item. This cannot be undone.
• You can delete your account from Settings. This removes any workspace where you are the only member. A workspace you share with others keeps its data and its other members. You are removed from it.
• A deletion is not written to any log with your name or email attached.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it, through the support form. Most of this you can already do yourself in Settings. You may also complain to the Information Regulator of South Africa, or to your own data protection authority if the GDPR applies to you.

Your data is processed in the European Union by the sub-processors above (Vercel and Supabase in Frankfurt, Germany) and by their own further processors under standard contractual terms. If you need a data processing agreement for your own compliance, ask through support.

We will update the date shown above and email account holders about a material change.