Rust Users
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
A language site that logs IPs for a year, shares hosting with vendors, and asks you to email for deletion.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
IP addresses, cookies, GitHub name, emails, and forum posts, plus extra data for grant applicants.
Read the exact line
Privacy policy
“When you visit rust-lang.org, we receive your IP address as part of our standard server logs. We store these logs for 1 year.”
Training
They use data to run the sites, logs, security, and grants; they do not describe AI training.
Read the exact line
Privacy policy
“Rust Foundation will retain such data only for as long as is necessary for the purposes set out in this policy, or as needed to provide users with our services.”
Sharing
Staff, grant reviewers (GitHub names), and hosts like AWS, Heroku, Sentry, Discourse, and Mailgun.
Read the exact line
Privacy policy
“We use Heroku and AWS to host the services, on servers located in the US.”
Kept
Server logs are kept 1 year; grant data 3–7 years; other data until they say they no longer need it.
Read the exact line
Privacy policy
“When you visit rust-lang.org, we receive your IP address as part of our standard server logs. We store these logs for 1 year.”
Controls
You can block cookies in your browser and email them to ask for a copy or deletion of your data.
Read the exact line
Privacy policy
“You can also withdraw your consent to our processing of your information and the use of our services, and/or delete your user account at any time, by using the contact information below”
Fine print
No dated privacy policy; forum posts are public; a full terms document was not provided here.
Read the exact line
Privacy policy
“Posts on these forums are public. If you sign up to participate in these forums, we collect your email address and name.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask them to delete your account and data
Contact listed at the bottom of the privacy notice
Block or delete cookies in your browser
Your browser’s settings / help menu
Do not put private emails in Cargo.toml
crates.io crate files
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Data is stored in the US, so US government requests can reach it.
Read the exact line
Privacy policy
“If your personal data is in the United States, it may be accessed by government authorities in accordance with United States law.”
For example, a US legal demand could cover your crates.io login or forum email.
Anything you put in a published crate, including emails in Cargo.toml, is public.
Read the exact line
Privacy policy
“All crates on Crates.io are public, including the list of crate owners’ user names and the crate upload date.”
For example, an email in the authors field of Cargo.toml can be copied by anyone.
Grant applications are kept for years even if you are not funded.
Read the exact line
Privacy policy
“Data for all applicants will be retained for three years. Data for successful applicants will be retained for seven years.”
For example, your bank details as a successful applicant can be kept seven years.
Visit logs with your IP are kept for a full year.
Read the exact line
Privacy policy
“We store these logs for 1 year.”
For example, downloading a crate can leave an IP log for 12 months.
People on the Foundation team can read emails you send them.
Read the exact line
Privacy policy
“If you contact us via email, your email address and message will be accessible to our small team of staff.”
For example, a support email is readable by their staff, not only a bot.
They say internal Google Workspace mail is not used for ads.
Read the exact line
Privacy policy
“The data is not owned or controlled by Google; they will not share it with third parties or use it for advertising, and neither will we.”
For example, a grants email in Google Workspace should not be used to target ads.
They set a 16+ line and say they do not knowingly collect from younger kids.
Read the exact line
Privacy policy
“The services are not directed to children and we do not knowingly collect personal information from anyone under the age of sixteen.”
For example, a 15-year-old should only use the site with a parent’s consent.
They encrypt the connection with HTTPS.
Read the exact line
Privacy policy
“The connection between your computer and our servers is encrypted using Secure Sockets Layer (SSL) software that encrypts that information.”
For example, logging into crates.io should show https and a padlock.
Deletion and access requests go through email, not an in-app button.
Read the exact line
Privacy policy
“users can contact us using the contact information set out at the bottom of this policy.”
For example, to delete a crates.io account you must write to the contact listed.
A forum thread quotes an old TOS date; we were not given a current full agreement.
Read the exact line
Terms of service
“This document is CC-BY-SA. It was last updated May 31, 2013.”
For example, you cannot rely on this thread as a complete, current contract.
Words to know
Legal words from the lines above, in plain English.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
How we got here · grade C · score 46/100 · 12 of 15 policy answers backed by a verified quote · 5 not stated
What does the app collect beyond what it needs to work?
They collect IPs, user-agent, cookies, GitHub username and avatar, emails, and forum activity, plus extra grant fields.
Does it record your voice, face or body, and what happens to that?
The policy does not describe collecting voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They describe cookies for sessions and page views and say Workspace data is not used for advertising.
Do they sell or share your data, and can you opt out?
They share with hosts and tools such as AWS, Heroku, Sentry, Discourse, Mailgun, and GitHub login.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You request deletion by contacting them. Logs are kept one year; grant data three to seven years.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They do not describe a lasting AI memory or personal profile you can edit.
Do they commit to basic security, and have they leaked data?
They describe SSL encryption and administrative, technical, and physical safeguards.
Is there a real age gate, and are teens protected?
They say the services are not for under-16s and a parent must consent, with no age-check described.
Will they tell you when the rules change, and is the policy specific?
The privacy notice has no update date. The forum thread quotes a TOS last updated May 31, 2013.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
No subscriptions or paid product terms are described.
The privacy policy is 1,970 words at a fairly hard level (Flesch reading ease 50.8); the terms are 306 words at a plain English level.
