RubyGems.org
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
You keep your gems, but they get a license to host them, and they can close your account without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, MFA device IDs, IP and location, plus anything inside gems you upload.
Read the exact line
Privacy policy
“When you register for RubyGems.org, we collect your username, email address and password. You may optionally provide your full name or your organization’s name”
Training
They run the site, publish gems and authors, email you, and study how the service is used.
Read the exact line
Privacy policy
“To provide the RubyGems service including incident response purposes To publish information about RubyGems packages and authors on the RubyGems service”
Sharing
Vendors like AWS and Fastly see data; gem authors and some download logs are public.
Read the exact line
Privacy policy
“We share personal information with these service providers solely for the purpose of providing their services to us, and subject to terms that prohibit further use of personal information.”
Kept
Account data is deleted within 90 days after you leave; gems they think others need can stay forever.
Read the exact line
Terms of service
“we will delete your Account information and any User Content associated with it within 90 days of cancellation or termination (though some information may remain in encrypted backups)”
Controls
You can close your account anytime; they do not describe in-app privacy switches.
Read the exact line
Terms of service
“You may terminate your Account at any time.”
Fine print
They can shut you off without notice, cap at $100, and you must them.
Read the exact line
Terms of service
“We may suspend or terminate your access to the Service, with or without notice, at any time if we determine, in our sole discretion”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Close your account if you want to leave
Terms section 7: You may terminate your Account at any time.
Contact legal@rubycentral.org about disputes or notices
Terms section 11: legal@rubycentral.org
Avoid putting extra personal data inside gem files
Privacy: Gem Data and Metadata
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can keep, copy, and share what you upload forever, including giving others the same rights.
Read the exact line
Terms of service
“You grant to Provider a non-exclusive, worldwide, , , license (including the right to ) to use, host, store, cache, reproduce, publish, display, perform, distribute, and transmit Your Content”
For example, even after you leave, they can keep serving a gem you published and let mirrors copy it.
If other people still use your gem, they can refuse to take it down.
Read the exact line
Terms of service
“You agree, consistent with the license granted by you in Section 3(b) above, that Provider may continue hosting any gem you upload so long as Provider reasonably believes any other user or gem depends upon it.”
For example, you delete your account but a popular library still depends on your gem, so it stays online.
They can lock you out without warning if they think you broke the rules or pose a risk.
Read the exact line
Terms of service
“We may suspend or terminate your access to the Service, with or without notice, at any time if we determine, in our sole discretion, that your use of the Service: (1) violates this Agreement”
For example, they could disable your login overnight without emailing you first.
If someone sues them because of what you uploaded or how you used the site, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and Provider, and its subsidiaries, affiliates, officers, agents, or other partners, and employees, from any claim or demand, including reasonable attorneys’ fees”
For example, if a gem you uploaded leads to a lawsuit, you could owe their attorney fees.
If they mess up, they say they will not pay you more than $100.
Read the exact line
Terms of service
“IN NO EVENT SHALL THE OF PROVIDER OR ITS AFFILIATES EXCEED ONE HUNDRED U.S. DOLLARS (U.S. $100.00) OR THE AMOUNT YOU PAID US TO USE THE SERVICES.”
For example, if a site outage costs your company money, they cap what they owe at $100.
Whatever personal details sit inside a gem file, including emails in source comments, get collected.
Read the exact line
Privacy policy
“When you upload a gem software package to RubyGems.org, we collect any data and metadata contained in the package.”
For example, an author email in a gemspec or a name in a source-file header is stored with the package.
Download logs with location go to a partner; the public version is only country-level.
Read the exact line
Privacy policy
“The data we share with ClickHouse includes geolocation data, which we use for internal analysis of RubyGems.org usage, but the only location data we make publicly available is continent and country from which downloads originate.”
For example, the community can see that many downloads came from Germany, not your street.
You still own what you upload; they only get a license to run the service.
Read the exact line
Terms of service
“You retain your rights to Your Content.”
For example, you still own the copyright in your gem’s source code.
Kids under 13 are not allowed; they say they will shut those accounts down.
Read the exact line
Terms of service
“The Service is not intended for children under the age of 13. If we learn that any registered user of the Service is under the age of 13, it is our policy to disable the user’s Account”
For example, if a 12-year-old registers, they say they will disable the account and delete that personal info.
Big rule changes should come with 30 days’ notice by site post or email.
Read the exact line
Terms of service
“We will notify users of material changes to these Terms, such as price increases, at least 30 days prior to the change taking effect by posting a notice on our Website or sending email”
For example, if they add a fee, they say they will email you at least a month ahead.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
How we got here · grade B · score 50/100 · 14 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect account info plus IP addresses, geolocation, MFA device IDs, and everything inside uploaded gems.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They do not describe ads or third-party advertising trackers.
Do they sell or share your data, and can you opt out?
They share with named service providers under contracts that bar further use, and publish gem and limited download-location info as part of the service.
What rights do they take over what you type and what the AI makes?
You keep ownership, but you grant a perpetual, sublicensable license so they and public mirrors can host your gems forever.
How long do they keep your data after you delete it, and can you delete it in the app?
They say they delete account info within 90 days after you cancel, but gems others depend on may be hosted indefinitely.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
Not stated in the documents.
Is there a real age gate, and are teens protected?
The service is not for children under 13; they say they disable accounts if they learn a user is under 13.
Will they tell you when the rules change, and is the policy specific?
Both documents are dated, and they say they will give 30 days’ notice of material term changes by website or email.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate access with or without notice if they decide you violated the rules or pose a risk.
If something goes wrong, who pays?
The service is “as is,” liability is capped at $100, and you must indemnify them for claims from your use.
Do subscriptions renew on their own, and can you get a refund?
The documents do not describe paid subscriptions or refunds.
The privacy policy is 728 words at a college graduate level (Flesch reading ease 35.5); the terms are 2,379 words at a college level.
