DownStack ("we," "our," or "us") operates the website at downstack.app (the "Service"). This Privacy Policy explains how we collect, use, share, and protect your information when you use the Service.
By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
1. Information We Collect
Information you provide
- Account information: Email address and authentication data when you create an account (directly or via Google/Facebook sign-in)
- Payment information: We do not currently charge for the Service. Earlier purchases were processed by Stripe. We do not store credit card numbers.
- Contact information: Name, email, and message content when you use our contact form
- Featured writer submissions: Email, Substack URL, and display name if you opt into the featured writers showcase
Information collected automatically
- Usage data: Conversion counts, feature usage, pages visited, time spent on site, click patterns, and referral sources
- Technical data: Browser type, device type, operating system, IP address, and approximate location for security, performance, and analytics purposes
- Cookies and tracking technologies: Information collected via cookies, pixels, tags, and similar technologies as described in Section 6 below
Information we do NOT collect
- Your content on the website: In the DownStack editor, markdown is processed in your browser. We do not store that text. The editor sends rendered table images to our servers so they can be hosted.
DownStack in ChatGPT
If you use the DownStack plugin in ChatGPT, this section describes that path. It is separate from accounts, payments, and analytics on the website.
You do not need a DownStack account to use the plugin, and we do not create one or link your ChatGPT use to an existing account.
- What we receive: The markdown you ask ChatGPT to convert, and an optional table style. We do not receive your ChatGPT account, and this path does not use Supabase or Stripe.
- How it is processed: The markdown is processed in memory to produce HTML for a Substack post. We do not store the markdown text.
- Table images: Tables are rendered as PNG files and stored in Cloudflare R2 under
chatgpt/. The URL is a public content hash. It is unguessable if you do not already know the image, and anyone with the URL can load it, which is what lets Substack display the table. The same markdown and style reuse the same URL. - How long we keep them: Objects under
chatgpt/ are deleted after 90 days by an R2 lifecycle rule. - Who processes them: Cloudflare hosts the Worker and stores the images. Cloudflare is our processor for this path. OpenAI operates ChatGPT. Your use of ChatGPT is covered by the OpenAI Terms of Use.
- Deletion requests: To delete a table image sooner, use the contact page and include the image URL (
https://downstack.app/i/chatgpt/…). You can also email hello@downstack.app. - Sensitive data: Do not send passwords, government identifiers, health information, payment card numbers, or other sensitive data through the plugin. We do not need them to convert markdown.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To provide, maintain, and improve the Service
- To honor any previous purchases
- To communicate with you about your account, the Service, and support requests
- To send you marketing communications, product updates, newsletters, and promotional offers (you may opt out at any time)
- To personalize your experience and recommend features or content
- To analyze usage trends and improve our product, marketing, and business strategies
- To create and manage advertising audiences on third-party platforms (such as Google, Meta, LinkedIn, and X/Twitter)
- To serve targeted and retargeted advertisements to you across third-party platforms and websites
- To measure the effectiveness of our marketing campaigns and advertising
- To share anonymized or aggregated data with business partners for analytics, co-marketing, and joint promotional initiatives
- To detect and prevent fraud, abuse, and unauthorized access
- To comply with legal obligations
3. Data Sharing and Partners
We may share your information with the following categories of recipients:
- Service providers: Companies that help us operate the Service, including hosting (Cloudflare), authentication (Supabase), payment processing (Stripe), and email delivery services
- Advertising and analytics partners: We share data with platforms such as Google Ads, Meta/Facebook, X/Twitter, and LinkedIn for advertising, remarketing, and audience creation. This may include hashed email addresses, usage data, or information collected via tracking pixels and cookies.
- Business partners: We may share anonymized or aggregated data with business partners for co-marketing, market research, and joint promotional initiatives
- Affiliate partners: If you click a sponsored card, we record that click (a content id and placement, not your article text) and may forward it to PartnerStack, the network that tracks those partnerships
- Legal and safety: We may disclose information when required by law, legal process, or government request, or to protect the rights, property, or safety of DownStack, our users, or the public
- Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as a business asset
We do not sell your personal information to data brokers. We may share personal information with advertising partners as described above for targeted advertising purposes.
4. Data Storage and Security
Your data is stored and processed using the following services:
- Supabase: User authentication and account data (hosted on AWS)
- Cloudflare R2: Hosted table images (globally distributed)
- Cloudflare KV: Subscription and featured writers metadata, plus counts of clicks on sponsored cards
- Stripe: Payment processing (PCI DSS compliant)
We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
5. Third-Party Services
We use the following third-party services that may collect or process your data:
- Supabase — Authentication and database (Privacy Policy)
- Cloudflare — Hosting, CDN, image storage, and optional cookieless Web Analytics (Privacy Policy)
- PartnerStack — Sponsored and affiliate placements (Privacy Policy)
- Buy Me a Coffee — Optional support link. We do not send your content. Their site applies only if you follow the link (Privacy Policy)
- Stripe — Payment processing (Privacy Policy)
- Google Analytics / Google Tag Manager — Website analytics and tag management (Privacy Policy)
- Google Ads — Advertising and remarketing (Privacy Policy)
- Meta (Facebook/Instagram) — Advertising pixel and audience creation (Privacy Policy)
- X (Twitter) — Advertising pixel and conversion tracking (Privacy Policy)
- LinkedIn — Insight Tag and advertising (Privacy Policy)
- Google Fonts — Font delivery (Privacy Policy)
These third-party services may collect information about your online activities over time and across different websites. We encourage you to review their respective privacy policies.
6. Cookies and Tracking Technologies
We use cookies, pixels, and similar tracking technologies to collect information and improve the Service. These include:
Essential cookies
Required for the Service to function. These include authentication session cookies (Supabase) and security tokens. You cannot opt out of essential cookies.
Analytics cookies
Help us understand how visitors interact with the Service. We use Google Analytics and similar tools to track page views, conversion events, session duration, and usage patterns. When enabled, Cloudflare Web Analytics counts page views without setting a cookie.
Sponsored cards are labeled with the partner’s name. Clicking one may record a content id and placement so we can tell which placement was used. That record does not include the markdown you paste into the editor.
Marketing and advertising cookies
Used to deliver relevant advertisements and measure campaign effectiveness. These include pixels and tags from Google Ads, Meta (Facebook), X (Twitter), and LinkedIn. These technologies may track your activity across websites to build interest-based advertising profiles and deliver retargeted ads.
Preference cookies
Store your preferences and settings, such as UI preferences.
You can manage cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Disabling certain cookies may affect the functionality of the Service. For more information about opting out of interest-based advertising, visit aboutads.info or youronlinechoices.com.
7. Data Retention
- Account data: Retained as long as your account is active. Deleted upon account deletion request.
- Hosted images from the website editor: Retained while the Service hosts them, and removed if they violate these policies or applicable law.
- Table images from ChatGPT: Stored under
chatgpt/ and deleted after 90 days. You can ask us to delete one sooner from the contact page. - Contact form submissions: Retained for up to 2 years.
- Payment records: Retained as required by applicable tax and financial regulations.
- Analytics and advertising data: Retained in accordance with our third-party partners' retention policies.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your personal data
- Portability: Request transfer of your data to another service
- Objection: Object to processing of your personal data for marketing or profiling purposes
- Opt-out of targeted advertising: Request that we stop sharing your data with advertising partners for targeted advertising purposes
- Withdraw consent: Where we rely on consent, you may withdraw it at any time
To exercise any of these rights, contact us at hello@downstack.app. We will respond within 30 days.
9. GDPR Compliance (EU/EEA Users)
If you are in the European Economic Area, we process your personal data under the following legal bases:
- Contract performance: To provide the Service and manage your account
- Legitimate interest: For security, fraud prevention, service improvement, analytics, and direct marketing to existing customers
- Consent: For marketing emails, advertising cookies, and sharing data with advertising partners. You may withdraw consent at any time.
EU/EEA users have additional rights including the right to lodge a complaint with a supervisory authority. For data-related requests, contact us at hello@downstack.app.
10. CCPA Compliance (California Users)
If you are a California resident under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the following rights:
- Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you
- Right to delete: You may request that we delete your personal information
- Right to opt out of sale/sharing: We do not sell personal information to data brokers. We may share personal information with advertising partners for cross-context behavioral advertising (targeted advertising). You may opt out of this sharing by contacting us.
- Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights
To exercise your rights, contact us at hello@downstack.app.
11. Children's Privacy
The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The updated policy will be effective upon posting to this page. We encourage you to review this Privacy Policy periodically.
13. Contact
For privacy-related inquiries, contact us at: