Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
Tumblr presents significant privacy risks through its public-by-default content sharing and actions (risk_flags-1, risk_flags-2). Any content shared publicly is accessible to everyone, including search engines, potentially leading to a loss of user privacy rights. User actions like liking or reblogging are also public record. Furthermore, in the event of a business acquisition or bankruptcy, user information is treated as a transferable asset, which means your personal data could be acquired by a third party and used under the terms of the existing policy (risk_flags-3).
The service also shares non-personal information with its family companies for product improvements and analysis (data_use-1), and may aggregate information about your use across multiple services to enhance and develop new services (data_use-2). Your data, including IP addresses, may also be shared with third-party agents for operational, enhancement, and development purposes (data_use-3), and with its parent company Automattic and its family of companies (data_use-4).
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Critical issues that pose significant risks to users.
high95% confidence
Loss of privacy rights due to public sharing
Content published and shared publicly is accessible to everyone, including search engines, and users may lose any privacy rights they might have regarding that content.
Why it matters: Users may lose privacy rights for any content they publish publicly, as it becomes accessible to anyone and can be indexed by search engines.
Content published and shared publicly is accessible to everyone, including search engines, and you may lose any privacy rights you might have regarding that content.
What We Collect and How We Use It, paragraph 8 · Citation strength: strong
high95% confidence
Public actions are recorded and visible
Liking, reblogging, and replying to posts are public actions, and anyone can see who performed these actions.
Why it matters: Users' actions like liking, reblogging, and replying to posts are public and can be viewed by anyone, potentially exposing their interests and activities.
Liking, reblogging, and replying are public actions – anyone can expand the “notes” view on a post, for example, to see who liked, reblogged, or replied to a post.
What We Collect and How We Use It, paragraph 10 · Citation strength: strong
high90% confidence
User information may be transferred during business acquisition or bankruptcy
If the company is acquired, goes out of business, or enters bankruptcy, user information would be one of the transferred or acquired assets, and the acquirer may continue to use personal information as set forth in the policy.
Why it matters: Should Tumblr be acquired or go out of business, user information, including personal data, could be transferred to a third party and used by the new owner as outlined in the current privacy policy.
Moreover, if we, or substantially all of our assets, were acquired, or if we go out of business or enter bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of us or our assets may continue to use your Personal Information as set forth in this policy.
How the service collects, uses, and shares your personal information.
medium90% confidence
Sharing of non-personal information with family companies
Non-personal information may be shared with family companies for product improvements, research and analysis, and to provide more relevant experiences.
Why it matters: The service may share non-personal data with affiliated companies, which could lead to its use for various business purposes, including research and customized experiences.
We may share non-personal information with our family companies for purposes such as product improvements, research and analysis, and to help them provide you with more relevant experiences.
Broad collection and use of aggregated information across services
Information about your use of multiple services may be aggregated and used to enhance and improve the services, and to develop new services.
Why it matters: The company may combine data from your use across its various services to understand your behavior better and create new features, potentially forming a more comprehensive profile of your activities.
We may, if possible, aggregate information about your use of multiple Services and use that consolidated information to enhance and improve the Services, and to develop new Services.
Information disclosure to Agents for service operation and improvement
Information such as IP addresses may be shared with third parties, including service providers, consultants, and other agents, to operate, enhance, and improve the services and develop new products.
Why it matters: Your information, including IP addresses, may be shared with external agents like service providers and consultants to help operate and improve the service, which means other companies will have access to your data for specific business functions.
In some cases, we share information we store (such as IP addresses) with third parties, such as service providers, consultants, and other agents ("**Agents**"), for the purposes of operating, enhancing, and improving the Services, and developing new products and services.
Sharing information with parent company and its family of companies
As a wholly-owned subsidiary of Automattic, the company and its family of companies may receive any information the service collects and may share information they have with the service.
Why it matters: Your data may be shared with the parent company, Automattic, and its affiliated companies, allowing a broader corporate group to access and potentially use your information.
Because we are a wholly-owned subsidiary, Automattic and the rest of our family of companies may receive any information we do, and may share information they have with us.
Use of web browser information for service enhancement
Information received from your web browser, including browser type, operating system, and cookies, is used to enhance and improve the services.
Why it matters: The service collects information about your web browser and device to improve its functionality and user experience.
We automatically receive and record information from your web browser when you interact with the Services, such as your browser type and version, what sort of device you are using, your operating system and version, your language preference, the website or service that referred you to the Services, the date and time of each request you make to the Services, your screen display information, and information from any cookies we have placed on your web browser (as described below).
What We Collect and How We Use It, paragraph 17 · Citation strength: strong
low85% confidence
Collection and use of location information
Information about your location, such as by converting your IP address into a rough geolocation, and user-provided location information for geotagging posts, may be collected and stored to improve and personalize services.
Why it matters: The service may determine your location using IP address conversion or user-provided data to geotag posts, which is then used to personalize and improve the service for you, for example by showing you relevant local content.
In some cases we collect and store information about where you are located, such as by converting your IP Address into a rough geolocation. We may also ask you to provide information about your location, for example to use your geolocation information from your mobile device to geotag a post. We may use location information to improve and personalize the Services for you, for example by showing you relevant local content.
What We Collect and How We Use It, paragraph 18 · Citation strength: strong
low85% confidence
Collection and use of mobile device information
Information related to your mobile device may be collected and stored, including a unique identifier, to improve services and enable new products.
Why it matters: The service may collect and store information about your mobile device, including unique identifiers, to enhance existing services and introduce new features.
We may collect and store information related to your mobile device. In some cases, we may receive, generate, or assign your mobile device a unique identifier for the purposes described above in “Information Related to Use of the Services.” We may also ask you to provide your phone number to enable new products and improve the Services, such as by enabling multi-factor authentication for Account login.
What We Collect and How We Use It, paragraph 20 · Citation strength: strong
Cancellation and Renewal
Terms related to how you can cancel the service, conditions for renewal, and associated policies.
Not clearly stated: The document does not contain clear statements about cancellation or renewal policies.
Gotchas
Potentially overlooked clauses that could be disadvantageous or surprising to users.
low90% confidence
Third-party privacy policies govern linked services
The Privacy Policy does not apply to practices of third parties not owned, controlled, or managed by the service, and users are encouraged to review the privacy policies of all Third Party Services they access.
Why it matters: The company is not responsible for the privacy practices of third-party services you use or link to, meaning you must review their separate policies to understand how your data is handled.
This Privacy Policy does not apply to the practices of third parties that we do not own, control, or manage, including but not limited to any third party websites, services, applications, or businesses (“**Third Party Services**”). This includes third parties you provide with information about yourself as part of enabling or using a Tumblr feature. While we try to work only with those Third Party Services that share our respect for your privacy, we don't take responsibility for the content or privacy policies of those Third Party Services. We encourage you to carefully review the privacy policies of all Third Party Services you access.
What This Privacy Policy Covers, paragraph 2 · Citation strength: strong
low90% confidence
User responsibility for third-party service policies when sharing content
When sharing information with Third Party Services (e.g., sharing posts to Twitter or Facebook), this Privacy Policy only governs information collected by the service, and users are responsible for reading and understanding the Third Party Services' privacy policies.
Why it matters: If you share content from the service to other platforms like Twitter or Facebook, those platforms' privacy policies, not this one, will govern how they handle the shared information. You are responsible for understanding those policies.
You may also choose to share information that you provide to us, like blog posts, with those Third Party Services (for example, by sharing posts to Twitter or Facebook). This Privacy Policy only governs information we collect and you are responsible for reading and understanding those Third Party Services' privacy policies.
No responsibility for individual blog data practices
The Privacy Policy doesn’t govern what users do on their Tumblr blogs, and the company is not responsible for the information collection and use practices of individual blogs and bloggers.
Why it matters: The service is not responsible for data collected by individual blogs or bloggers on its platform, meaning each blog may have different data practices, including collecting more information or sharing with third parties, from which the service disclaims responsibility.
This Privacy Policy doesn’t govern what our users do on their Tumblr blogs and we aren't responsible for the information collection and use practices of our individual blogs and bloggers. One of the great features of Tumblr's products is customizability, and bloggers have a lot of flexibility in how their blogs behave. When you visit a blog in our network, that blog may collect more information than we do, and may provide information to third parties that we have no relationship with, including to advertisers.
What This Privacy Policy Covers, paragraph 3 · Citation strength: strong
Protections
Commitments and features that protect user interests and privacy.
Protection90% confidence
Opt-out for personalized advertising
Users in some geographic locations have the legal right to opt-out of having ads personalized to them, although they will still see less relevant advertisements.
Why it helps: Users can control whether advertisements are personalized based on their data, helping to reduce targeted tracking without completely blocking ads.
In some geographic locations, Tumblr users have the legal right to opt-out of having ads personalized to them. Note that if you opt-out you will continue to see advertisements on Tumblr, though they will be less relevant and useful to you.
Personalized Advertising on Tumblr, paragraph 3 · Citation strength: strong
Protection90% confidence
Financial information not stored directly
Financial information is not stored by the company but by its payment processor, and only a unique token and, in some cases, the last four digits of the credit card number are received from the processor.
Why it helps: The company does not directly store sensitive financial details like full credit card numbers, which reduces the risk of direct exposure in case of a data breach on their system.
Please note that if you use the Payment Processor’s services, your data will be handled in accordance with the Payment Processor’s privacy policy and practices. They have their own rules about information collection, use, storage, and sharing, which you should review before using the Payment Processor’s services. We do receive certain information from our Payment Processor: (1) a unique token that we connect with your Account to enable you to make further purchases using the information stored by our Payment Processor and (2) in certain cases, the last four digits of the credit card number associated with that token, so that we can prevent fraudulent transactions and identity theft.
What We Collect and How We Use It, paragraph 14 · Citation strength: strong
Protection90% confidence
Non-storage and immediate discard of contact list information
The service will not access or store your contact list unless requested, and discards this information immediately afterward.
Why it helps: The company commits to only accessing contact lists upon user request and immediately deleting that data, ensuring user contact information is not retained or used without explicit, temporary consent.
We won’t look at (or be able to look at) your contact list unless you ask us to. Why would you ask us to? Because that’s how you would find out if any of your contacts are on Tumblr. We discard this information immediately afterward.
What We Collect and How We Use It, paragraph 24 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.