Privacy policy

ooruby is run by our team in Scotland. It is open to people everywhere. We decide how and why the personal data described here is used, which makes us its controller under UK data protection law, and that law applies to us wherever you live. To reach us about any of it, email hello@ooruby.com.

If you only browse. You do not need an account to read listings, findings or the library. When you visit, we record the visit: the page, the time, the name of the website that sent you, any campaign tags on the link, the country, region and city your connection appears to be in, your device type, browser and operating system, and how long you stayed and how far down the page you scrolled. Our host works out the place from your connection and passes it on to us. Like any website, ours sees your IP address when your browser asks for a page. We use it for a moment to limit abuse, and these visit records do not include it. They carry a random identifier so that we can tell visits apart. It is not your name or your email address.

Searches. When a search on ooruby finds nothing, we note the words that were searched for, with the same random identifier, so that we can see what people are looking for. They are not tied to an account. If many people ask for the same thing, we may turn the words into a request on the Wanted board once a person has checked it, and the request does not say who searched. Anything that looks like an email address, a web address, a long number or a key is never used for a request. Please do not type personal details into the search box.

If you create an account. We collect your name, your email address and your password. We never see your password: it goes straight to our sign-in provider, which stores only a one way hash of it. If you sign in with Google, we receive your name, email address and profile picture from Google instead. Our sign-in provider also records technical details of each sign-in, such as the time, your IP address and your browser, for security. If you reached us through a link that carried campaign tags, we keep the first set with your account, so that we know what brought you.

What you add. Things you put on ooruby are stored against your account: for example a maker profile, a listing or a draft, a request on Wanted, a vote, a review or reply, a watch on a listing, or a team workspace and its invitations. What you choose to publish, such as a maker profile, a review or a request, can be seen by anyone who visits, under the name or handle you gave. Drafts and private projects can be seen only by you and, in a team workspace, by its members. When you say you want a listing or pass on it, its maker sees the totals and the reasons people gave, never who gave them. Makers also see how many times their own listings were viewed, as a number.

When you write to us. If you email hello@ooruby.com we keep your message and our replies, so that we can deal with it. Mail to that address is passed on by our domain registrar to the inbox we read.

People named in listings. Listings are about software, and most of that software was written by other people. A listing names the author or publisher as shown in the public registry it came from, such as npm or PyPI, or on its public repository, and links to that source. That is public information about public software, and we show it so that you can see where something came from. If you are named in a listing and want something corrected or removed, email us with the link.

The cookies and local storage described here are our own. There are no advertising cookies and nothing that follows you from site to site.

Signing in. If you have an account, our sign-in provider sets cookies whose names start with sb- to keep you signed in. You cannot stay signed in without them.

Counting visits. Two cookies hold random identifiers. ss_vid lasts one year and lets us count how many different people visit. ss_sid lasts 30 minutes after your last page and lets us count visits. Neither holds anything about you. If you block or delete them the site works the same, and your later visits are counted as someone new.

Switching counting off. The link at the bottom of every page, Stop counting my visits, turns the counting above off for the browser you are using. It remembers your choice in one more cookie, ss_off, which lasts one year and holds only that choice. While it is set we record no visits or searches from your browser, we set no ss_vid or ss_sid cookie and remove any you already have, we keep no campaign tag, and Vercel Web Analytics does not count you. It does not touch the sign in cookies, or anything you add to your account. The same link turns counting back on.

Your browser's storage. We keep a few small things on your device, outside cookies: your choice of light or dark theme; the listings you add to the Decision Room to compare them, up to four; a note that you closed the prompt to create an account, so that it stays quiet for a week; and, if the link that brought you here carried a campaign tag, the first one, so that a later sign up can credit it. If you try to save something while signed out, we also keep what you were trying to do until you have signed in, an hour has passed or you close the tab, so that we can finish it for you. Apart from the campaign tag, which is saved with your account if you sign up, these stay on your device. If you ask for the Decision Room's comparison document, the listings in it are sent to us to build it, and we do not keep them. You can clear all of this in your browser at any time.

Vercel Web Analytics. Our host also counts page views for us, without cookies or anything kept on your device.

UK data protection law asks us to have a reason for every use of personal data. In plain English, ours are these.

To run your account and the features you use. You asked us for a service, and this is how we provide it.

To keep the site safe, fix faults and understand how it is used. A site has to be kept running and protected from abuse, and we need to know which pages are read and which are not. We keep the counting light for this reason: it holds no names or email addresses. The law calls this our legitimate interests.

To publish the catalogue. Listings name the people and companies who made the software, as the public registries they come from do. Showing where software came from is the point of ooruby, and we think it fair because the information is already public. This is also our legitimate interests, and you can object to it (see Your rights).

To email you. We send the emails your account needs, such as the link that confirms your address or resets your password. We send anything else only if you asked for it, and each such email tells you how to stop.

With your consent. Where we ask for your consent, you can take it back at any time, and we will stop from then on.

We do not sell or rent personal data. We do not use it for advertising. We do not make decisions about you by computer that have legal or similarly significant effects.

These companies handle personal data for us, on our instructions, for the purposes above.

Supabase hosts our database and signs people in. Our database is in Stockholm, Sweden.

Vercel hosts the site, delivers its pages and provides Vercel Web Analytics. The servers that build our pages currently run in the United States.

Resend delivers the emails we send, such as sign up confirmations and password resets.

Namecheap, our domain registrar, passes mail sent to hello@ooruby.com on to us.

Google, if you choose Continue with Google. Google signs you in and tells us your name, email address and profile picture. We ask for nothing else: not your mail, contacts, calendar or files. Google decides for itself how it uses what it holds, under its own privacy policy.

Some of these providers handle data outside the UK, including in the United States. Where they do, we rely on the safeguards they offer, such as the UK US data bridge or standard contractual clauses.

We may also share information if the law requires it, or where it is needed to protect the site and the people who use it from abuse or fraud.

Your account. For as long as you have one. When you delete it, or ask us to, we delete or anonymise what you added, unless we have to keep something to meet a legal duty or to settle a dispute. Backups kept by our providers are replaced on their normal cycle.

Visit records. Only while they help us understand how the site is used. We review them at least once a year and delete what we no longer need.

Email to us. For as long as we need it to deal with the message, and a reasonable time after.

Provider logs. Our providers keep their own technical logs for short periods, under their own policies.

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to limit how we use it, or to move it to another service in a usable format. You can object to uses that rest on our legitimate interests. You can take back any consent you gave.

To do any of these, email hello@ooruby.com, from the address on your account if you have one. We may need to check that it is you. We will answer within one month, and we do not charge unless a request is clearly unfounded or excessive. There is no delete button on your account yet, so for now deleting an account is done by email.

If you are not happy with how we have handled your data, please tell us first so that we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk. If you live outside the UK, the law where you live may give you more rights, and you may be able to complain to your own data protection authority as well.

ooruby is for developers and the teams they work with. It is not meant for children, and you must be 16 or over to create an account. If you think a child has given us personal data, email us and we will delete it.

If we change what we collect or why, we will update this page and the date at the top. If a change affects people with accounts, we will also email them.