Privacy policy

Last updated October 16, 2026

The short version

Stoke reads your Stripe accounts (read-only) to show you who pays you.
It sends email from your Gmail only when you approve a note. It can’t read your email.
Your readers’ email addresses and names are stored encrypted. We keep only the fields Stoke needs.
We don’t sell data, show ads, or use your data or your readers’ data to train AI models.
You can delete everything from Settings, at any time.

Who we are

Stoke (“Stoke”, “we”) is an analytics and outreach service for Substack writers, run by Stoke Software, 151 Charles Street West, Suite 100, Kitchener, Ontario, Canada, N2G 1H6. For anything in this policy, email support@substoke.com.

This policy covers you, the writer who uses Stoke. It also explains what happens to the details of your readers and customers that Stoke handles for you. For those details, you decide whom to contact and why, and Stoke processes them on your behalf.

What we collect

Your account

Your email address and a user id from Auth0, the service that handles sign-in. Auth0 holds your password or social sign-in; Stoke never sees it.
When your account was created and last used.
Your settings: reporting currency, Substack handle, plan names you set, and the links you add (revenue streams and social channels).

From the Stripe accounts you connect

When you install Stoke’s Stripe app, you approve read-only access on Stripe. Stoke then imports, and keeps current, a copy of these objects, limited to an allowlist of fields:

payments, charges, refunds and the fees on each payment;
invoices and subscriptions: plan, price, status, dates, discounts, and Stripe’s cancellation reason;
customers: email address and name, stored encrypted;
disputes: amount, status and deadline;
the account’s name and payout currency.

Stoke never stores customers’ postal addresses, phone numbers, card details (beyond the card brand, type and issuing country), metadata, free-text cancellation comments, or dispute evidence. Stripe never shares full card numbers with apps.

From Google, when you connect Gmail

Your Gmail address, so Stoke can show which account it sends from and send test notes to you.
A refresh token that lets Stoke send email as you, stored encrypted.
For each note sent, the message and thread id Gmail returns, so Stoke can show it as sent.

Stoke asks only for permission to send email (gmail.send), and to know your address. It can’t read, search, list, label or delete your messages, and it keeps no copy of your mailbox.

From Substack, when you upload an export

From the subscriber export you upload: each free subscriber’s email address and first name (stored encrypted), start date, and engagement counts (opens, days active, post views, clicks, comments, shares). Paid subscribers in the file are ignored, and the file itself isn’t stored.
Your public Substack profile and publications, read from the handle you enter.

What you write

Your note templates, and each note sent to a reader (subject and text), stored encrypted.

Technical data

Our hosting provider keeps standard server logs (IP address, time, and the page or API address requested) for security and troubleshooting. Customer pages use opaque ids, so readers’ emails don’t appear in these logs.
The app keeps your sign-in session in your browser’s local storage, and uses a short-lived cookie while you connect Stripe or Gmail, to make sure the connection is yours.
We don’t use analytics, tracking pixels or advertising cookies, on this site or in the app.

How we use it

To show you your customers, payments, at-risk subscribers and suggested actions.
To send the notes you approve, to the readers you choose, from your Gmail, and test notes to yourself.
To keep Stoke secure, fix problems, and answer your support requests.
To bill you for your plan, and to meet legal obligations.

We don’t sell or rent personal data, use it for advertising, or use it, or let others use it, to train AI or machine-learning models.

Google user data

Stoke's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In particular:

Stoke uses Google user data only to send the notes you approve and to show which Gmail account is connected.
It doesn’t transfer that data to anyone, except as needed to provide this feature, to comply with the law, or as part of a merger or sale of Stoke, with notice to you.
It doesn’t use that data for advertising, and doesn’t sell it.
No person at Stoke reads it, unless you ask us to (for example, for support), it’s needed for security, or the law requires it.

To stop Stoke’s access, choose Disconnect in Settings → Gmail. That revokes the token at Google and deletes it from Stoke. You can also remove Stoke at myaccount.google.com/permissions.

Only the service providers that run Stoke for us, under contracts that limit their use of it:

Provider	What for
Render	Hosting and the database, in the United States
Auth0 (Okta)	Sign-in
Google	Sending your notes through the Gmail API
Stripe	The source of your payment data; billing for your Stoke plan
Amazon Web Services	Encryption key management, when enabled

Stoke also looks up currency exchange rates from the European Central Bank, via Frankfurter. Those requests contain only currencies and dates, never personal data.

We may disclose data if the law requires it, or to protect our users or Stoke from harm.

How long we keep it

Your account and settings: until you delete your account.
A Stripe account’s imported data: while it’s connected. Removing it in Settings deletes the data, unless another Stoke user still has the same account connected.
Free subscribers: until you upload a newer export (which replaces them) or remove the list.
Gmail access: until you disconnect it.
Notes you’ve sent: until you delete your account.
Deleted data can remain in our hosting provider’s encrypted database backups for up to 30 days, until they’re overwritten.

Deleting your data

Settings → Delete your account deletes everything listed above straight away: your Stripe connections and their imported data, free-subscriber lists, notes and settings. It also revokes Gmail access. Your sign-in identity at Auth0 is kept, so you can sign up again; email support@substoke.com and we’ll delete it too. To stop Stripe’s access completely, also uninstall Stoke from your Stripe Dashboard.

If you’re a reader

If a writer you pay or subscribe to uses Stoke, Stoke holds your email address and name, your payment history with that writer, and (if you’re a free Substack subscriber) your engagement counts, on the writer’s behalf. Ask the writer to remove you, or email support@substoke.com and we’ll help. Every note sent through Stoke comes from the writer’s own email address, so you can reply to them directly.

Your rights

Depending on where you live (for example, under the GDPR in the EU and UK, the CCPA in California, or PIPEDA in Canada), you can ask to access, correct, export or delete your personal data, or object to how we use it. Email support@substoke.com and we’ll respond within 30 days. You can also complain to your local data protection authority. We don’t sell or “share” personal data as the CCPA defines it.

Security

Access tokens, readers’ emails and names, and your notes are encrypted at rest, and everything travels over HTTPS. See the security page for details.

Where data is kept

Stoke’s servers and database are in the United States. If you use Stoke from elsewhere, your data is transferred there, with safeguards such as the European Commission’s Standard Contractual Clauses where required.

Children

Stoke is for people running a business, and isn’t meant for anyone under 16.

Changes

If we change this policy, we’ll update the date at the top. If a change affects how we use data you’ve already given us, we’ll email you before it takes effect.

Contact

support@substoke.com · Stoke Software, 151 Charles Street West, Suite 100, Kitchener, Ontario, Canada, N2G 1H6