RubyGems.org Privacy Notice

Last updated May 9, 2025

This policy is in community review. It will take effect at the end of this period estimated on May 20th, 2025.

This privacy notice describes what personal information Ruby Central, Inc. (“Ruby Central”) collects from users of RubyGems.org, when and how we share that information, and why. This notice is an addendum to the Ruby Central Privacy Notice, which also applies to users of RubyGems.org.

Personal information we collect

Ruby Central collects the following information from users of RubyGems.org:

Registration Information

When you register for RubyGems.org, we collect your username, email address and password. You may optionally provide your full name or your organization’s name, if you use that feature.

Multi-Factor Authentication Information

You may register security devices and/or authentication apps in order to secure your RubyGems.org account with multi-factor authentication. When you do, we collect information uniquely identifying your security device.

Web traffic Information

We collect information related to web traffic such as IP addresses and geolocation data for security-relevant events and to analyze how and where RubyGems.org is used.

Gem Data and Metadata

When you upload a gem software package to RubyGems.org, we collect any data and metadata contained in the package. This includes gem specification (gem spec) data, including gem author names and email addresses. It also includes any personal information included in the gem files, such as open source author attributions in source code files.

Purposes and Legal Bases for Our Use of Your Personal Information

Ruby Central collects personal information related to your use of RubyGems.org for the following purposes:

To provide the RubyGems service including incident response purposes
To publish information about RubyGems packages and authors on the RubyGems service
To communicate with you about your use of the RubyGems service
To better understand how users access and use RubyGems so we can improve the service
To personalize your experience on the Sites and RubyGems service

We collect this information to perform our contract with you (e.g. to provide the RubyGems service), and for our legitimate business purposes. In some cases, we may ask your consent to use your personal information for certain purposes where required by applicable law.

In addition to the purposes described in the Ruby Central Privacy Policy, we disclose personal information related to your use of RubyGems as set forth below:

To publish information about RubyGems packages and authors via the service
To enable users of the service, including mirror operators, to view and download RubyGems packages
To analyze usage of the RubyGems service

Ruby Central uses some third party services to assist with operating online services supporting RubyGems.org. We share personal information with these service providers solely for the purpose of providing their services to us, and subject to terms that prohibit further use of personal information.

Specifically, we use:

Amazon Web Services (AWS) to host the RubyGems.org website and services. We store your information on AWS servers. Their use of this information is subject to the AWS GDPR Data Processing Addendum between AWS and Ruby Central.
Fastly to provide CDN services for the RubyGems.org website and services. Your information transits their servers. Their use of this information is subject to the Data Processing Terms between Fastly and Ruby Central and the Fastly Privacy Policy.
Datadog to aggregate metrics and application performance data. Some personal information may be stored on their servers. Their use of this information is subject to the Data Processing Addendum between Datadog and Ruby Central.
Honeycomb.io to aggregate metrics and application performance data. Only information related to web traffic is stored on their servers. Their use of this information is subject to the Data Processing Addendum between Honeycomb and Ruby Central.
Honeybadger to monitor, track, and resolve application errors. Their use of this information is subject to the Data Processing Addendum between Honeybadger and Ruby Central.
Twilio to send emails through the SendGrid product. Their use of this information is subject to the Data Protection Addendum between Twilio and Ruby Central.

We also have a partnership with ClickHouse to enable retrieval and analysis of historic RubyGems.org download log data, and to make some log data publicly available to the Ruby community. The data we share with ClickHouse includes geolocation data, which we use for internal analysis of RubyGems.org usage, but the only location data we make publicly available is continent and country from which downloads originate. ClickHouse’s use of private geolocation data is subject to the Data Processing Addendum between ClickHouse and Ruby Central.