RubyGems.org Privacy Notice

Last updated Mar 18, 2025

This policy is in community review. It will take effect at the end of this period estimated on May 20th, 2025.

This privacy notice describes what personal information Ruby Central, Inc. (“Ruby Central”) collects from users of RubyGems.org, when and how we share that information, and why. This notice is an addendum to the Ruby Central Privacy Notice, which also applies to users of RubyGems.org.

Personal information we collect

Ruby Central collects the following information from users of RubyGems.org:

Registration Information

When you register for RubyGems, we collect your username, email address and password. You may optionally provide your full name or your organization’s name, if you use that feature.

Multi-Factor Authentication Information

You may register security devices and/or authentication apps in order to secure your RubyGems account with multi-factor authentication. When you do, we collect information uniquely identifying your security device.

Web traffic Information

We collect information related to web traffic such as IP addresses and geolocation data for security-relevant events.

Gem Data and Metadata

When you upload a gem software package to RubyGems, we collect any data and metadata contained in the package. This includes gem specification (gem spec) data, including gem author names and email addresses. It also includes any personal information included in the gem files, such as open source author attributions in source code files.

Purposes and Legal Bases for Our Use of Your Personal Information

Ruby Central collects personal information related to your use of RubyGems for the following purposes:

To provide the RubyGems service including incident response purposes
To publish information about RubyGems packages and authors on the RubyGems service
To communicate with you about your use of the RubyGems service
To better understand how users access and use RubyGems so we can improve the service
To personalize your experience on the Sites and RubyGems service

We collect this information to perform our contract with you (e.g. to provide the RubyGems service), and for our legitimate business purposes. In some cases, we may ask your consent to use your personal information for certain purposes where required by applicable law.

In addition to the purposes described in the Ruby Central Privacy Policy, we disclose personal information related to your use of RubyGems as set forth below:

To publish information about RubyGems packages and authors via the service
To enable users of the service, including mirror operators, to view and download RubyGems packages

Ruby Central uses some third party services to assist with operating online services supporting RubyGems.org. We share personal information with these service providers solely for the purpose of providing their services to us, and subject to terms that prohibit further use of personal information.

Specifically, we use:

Amazon Web Services (AWS) to host the RubyGems.org website and services. We store your information on AWS servers. Their use of this information is subject to the AWS GDPR Data Processing Addendum between AWS and Ruby Central and the AWS Privacy Notice.
Fastly to provide CDN services for the RubyGems website and services. Your information transits their servers. Their use of this information is subject to the Data Processing Terms between Fastly and Ruby Central and the Fastly Privacy Policy.
Datadog to aggregate metrics and application performance data. Some personal information may be stored on their servers. Their use of this information is subject to the Data Processing Addendum between Datadog and Ruby Central and the Datadog Privacy Policy.
Honeycomb.io to aggregate metrics and application performance data. Only information related to web traffic is stored on their servers. Their use of this information is subject to the Data Processing Addendum between Honeycomb and Ruby Central and the Honeycomb Privacy Notice.
Honeybadger to monitor, track, and resolve application errors. Their use of this information is subject to the Data Processing Addendum between Honeybadger and Ruby Central and the Honeybadger Privacy Statement.
Twilio to send emails through the SendGrid product. Their use of this information is subject to the Data Protection Addendum between Twilio and Ruby Central and the Twilio Privacy Notice.