rubyvision
Dashboard

Privacy Policy

Last updated: October 28, 2026

1. About This Policy

This Privacy Policy explains how we collect, use, and protect your personal data when you use the Ruby software, website, and packet gateway (collectively, the “Service”). It applies alongside our Terms of Service. It is written to satisfy the transparency obligations of the EU/UK General Data Protection Regulation (GDPR) and similar laws (CCPA, PIPEDA, etc.).

2. Data Controller & Contact

The entity operating this website acts as the data controller for the personal data described below. To exercise any right in Section 9, or to ask any question about this policy, contact us through the Discord server linked on the homepage.

3. Data We Collect

  • Account data: your email address and a one-way hashed password. We hash passwords with scrypt and never store or transmit them in plaintext.
  • Purchase & billing data: the Stripe payment ID, the email you paid with, the amount and currency, and the billing name and country collected at checkout. Card numbers never touch our servers. Stripe handles all card data under its own compliance program.
  • Terms acceptance data: when you check the agreement box at checkout, we record your IP address, user-agent, a timestamp, and the exact terms version you agreed to. This is retained as chargeback evidence and is linked to your purchase.
  • Device & authentication data: the device labels you create, plus the OAuth access and refresh tokens needed to authenticate the desktop client and enforce per-device revocation. Refresh tokens are single-use: every rotated token is recorded so a replay can be detected, and those records are deleted once they can no longer be presented.
  • Usage data: the settings you configure in the dashboard, and gateway connection logs required to operate the gateway securely.
  • Technical & security data: IP addresses used for rate limiting and abuse prevention (stored in our database, not just in memory) and request metadata in server logs. The desktop app also reports file verification failures, launch and update failures, its build, whether a debugger is attached to its own process, and an identified virtual machine manufacturer/model. Reports include the triggering rule and diagnostic results (such as file hashes or Windows API results) and are associated with the reporting account, device, network address and last reported computer specifications. These reports support security review; debugger and virtual machine flags suspend desktop use pending an administrator's review. Security reports and review flags, including dismissed flags, are retained indefinitely.
  • Computer specifications: when the desktop client launches it reports your CPU model, graphics card(s), amount of RAM, Windows version, screen resolution and time zone. We use it to detect a licence being shared across several computers. These records and their history are retained indefinitely.

We do not collect sensitive special-category data (health, ethnicity, political opinions, etc.), and we do not sell your personal data.

4. How We Use Your Data

  • To create and authenticate your account and to deliver the access you paid for.
  • To link a purchase to your account, including retroactively, if a card payment lands before you sign up.
  • To authenticate your devices and enforce revocation when a device is removed or your account is deleted.
  • To process payments, issue refunds where applicable, and defend disputes using the terms-acceptance and billing records described above.
  • To rate-limit, detect fraud and abuse, and keep the gateway and its users secure.
  • To retain records where required by tax, accounting, or anti-fraud law.

5. Legal Basis for Processing (GDPR)

  • Contract: to deliver the Service you paid for (account, access, device linking).
  • Legitimate interest: rate limiting, fraud and abuse prevention, dispute defense, and security logging.
  • Legal obligation: retaining payment and tax records as required by law.
  • Consent: any non-essential processing for which you opt in.

6. Third Parties & Processors

  • Stripe processes card payments and holds the card data you submit at checkout, including the card kept on file to renew a weekly or monthly subscription. You can update the card or cancel at any time in Stripe's customer portal. Stripe's handling of that data is governed by Stripe's Privacy Policy.
  • Our hosting provider runs the servers and database the Service operates on. Access is restricted to what is required to run the Service.
  • Discord is our support channel. We do not share your account data with Discord; if you contact us there, Discord's own privacy policy applies to your activity on its platform.

We do not share your personal data with advertisers or advertising networks.

7. International Data Transfers

The Service is hosted on servers that may be located outside your country of residence. When transferring personal data out of the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses, or a recognized adequacy decision. Stripe and other processors handle their own transfer mechanisms under their published policies.

8. Data Retention

  • Account records and their change history are retained indefinitely, including after an account is deleted. This includes sign-ins and recorded IP addresses, device connections and hardware reports, security events, alerts (including dismissed alerts), downloads, purchases, terms acceptances, support messages, settings and analytics.
  • Discord profile snapshots and past links are retained indefinitely, including after unlinking or linking a different Discord account.
  • Desktop console log archives are deleted after seven days. High-volume operational telemetry and console logs are excluded from permanent history.
  • Authentication secrets and transient sessions, expired tokens, authorization codes and rate-limit counters are excluded from permanent history and continue to expire or be cleared as needed.
  • Verified erasure and restriction requests are handled under the rights described below and applicable law.

9. Your Rights

Under GDPR (and equivalent rights under CCPA and similar laws) you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Request erasure (“right to be forgotten”), subject to retention required by law or ongoing disputes.
  • Restrict or object to processing.
  • Data portability: receive your data in a structured format.
  • Withdraw consent at any time (without affecting prior processing).
  • Lodge a complaint with your local data protection authority.

We respond to verified requests within 30 days. Where we have reasonable doubt about your identity, we may request additional information to confirm it before acting.

10. Cookies

We use essential cookies (for your session and authentication) and one first-party analytics cookie (rv_vid, a random id kept for up to a year). It lets us see which pages visitors view, how long they stay, where they came from, and whether they went on to sign up or buy, so we can improve the site. These events do not include your IP address, are not shared with anyone, and are retained indefinitely. We do not use advertising cookies or third-party analytics.

11. Security

Passwords are hashed with scrypt and never stored in plaintext. Rate limiting is enforced server-side and persisted in our database (not in per-worker memory), so a restart does not reset the limit. Gateway sessions are re-validated against the database on a recurring sweep and revocations are pushed for immediacy, so a revoked device does not stay connected. Access tokens are short-lived and refresh tokens are single-use. No system is ever fully secure, but we apply these controls to protect your data.

12. Children's Privacy

The Service is not directed at children under the age of digital consent in their jurisdiction, and we do not knowingly process their data. If you believe a minor has provided us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy as the Service evolves. Material changes will be reflected in the “Last updated” date above. Continued use after changes take effect constitutes acceptance.

14. Contact

Questions about this policy or your data can be directed to our team via the Discord server.