What Verso does with your data.

At a glance

• Verso is a macOS app. There is no Verso account, no Verso server, and no Verso database.
• The app signs in to Substack directly in an embedded browser view. Your credentials go to Substack, not to us.
• Everything the app shows — your subscriptions, articles, read state, starred articles — is stored in a local SwiftData database on your Mac.
• The app contains no analytics, no crash reporting SDKs, and no telemetry. We do not collect usage data because we have nowhere to collect it to.
• This website does not use cookies, analytics, trackers, or third-party fonts. Web fonts are self-hosted from this domain.

How sign-in works

Verso presents Substack's own sign-in page inside an embedded WKWebView. When you enter your email and password, that information is submitted directly to substack.com. Verso does not see, intercept, or store your password.

After you sign in, Substack returns session cookies (substack.sid and substack.lli). These cookies are held in the macOS WebKit data store for the app, the same way Safari holds cookies for sites you visit. They stay on your Mac. Verso uses them to identify you to Substack on subsequent requests so your subscription list can be fetched.

If you sign out, the cookies are cleared from the app's data store.

What Verso asks for from the network

Verso makes two kinds of outbound HTTP requests:

1. Substack API requests

To Substack's own domains (substack.com and its subdomains), the app makes read-only GET requests to endpoints like:

• /api/v1/user — to confirm you are signed in and read your email address
• /api/v1/subscriptions, /api/v1/reader/subscriptions, /api/v1/feed/following — to list the newsletters you subscribe to
• /settings, /library — to discover subscriptions not returned by the APIs above

These are the same requests Substack's own website makes when you visit it. Verso never sends POST, PUT, or DELETE to Substack — it cannot change anything on your Substack account. Marking an article as read in Verso does not mark it read on Substack. Starring an article in Verso does not star it on Substack.

2. RSS feed requests

For each newsletter you subscribe to, Verso fetches that newsletter's RSS feed URL. Most Substack newsletters publish RSS at <publication>.substack.com/feed, but publications with custom domains (e.g. stratechery.com) serve their RSS from those domains instead. In those cases the request goes to that domain, not to Substack.

Article images

When you open an article, the embedded reader renders the article's HTML, which includes <img> tags pointing at wherever the publication hosts its images (typically substackcdn.com). Your Mac loads those images directly from the image host, the same way your browser would if you were reading the article on the web. Verso does not store the images.

What's stored locally

Verso keeps a local database on your Mac, managed by Apple's SwiftData framework. It contains:

• Newsletters you subscribe to — name, author name, feed URL, site URL, icon URL, whether the subscription is paid, a derived genre, and when the subscription was added to the library.
• Articles fetched from those feeds — id, title, URL, excerpt, body HTML, author, publish date, thumbnail URL, read/unread state, starred state, tags, and the id and name of the newsletter they came from.
• Tombstones for articles that were pruned from local storage — only the id, newsletter id, and dates. These exist so pruned articles don't reappear on the next sync.
• A single preference in macOS UserDefaults holding the list of article ids affected by your most recent "mark all as read" action, so the app can offer Undo.

Nothing is written to Keychain. No files are written outside the SwiftData container and the WebKit cookie jar described above.

You can wipe all of this at any time by deleting the app and its container.

Third parties

Verso has no third-party SDKs for analytics, crash reporting, advertising, attribution, feature flags, or A/B testing. The app does not talk to any service other than Substack and the RSS feed hosts of the newsletters you subscribe to.

Substack has its own privacy policy, which governs how Substack handles your account and the requests Verso makes on your behalf. You can read it at substack.com/privacy.

This website

This site is a static page, served without cookies or client-side analytics. The typefaces (Instrument Serif, Inter, JetBrains Mono) are self-hosted from this domain so your IP address is not shared with Google Fonts or any other third party. If that changes in the future, this page will be updated.

Changes

If the data-handling practices above change, this page will be updated and dated accordingly. Material changes will also be called out in the app's release notes.