RubyX

Privacy Policy

Last updated: October 16, 2026

1. Who we are

RubyX ("we", "us") operates the RubyX store, dashboard, and desktop client. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws (UK GDPR, CCPA/CPRA).

2. Data we collect

  • Account data: email, display name, hashed password, native two-factor factor metadata, and avatar URL. If you choose Discord sign-in or linking, we also store your Discord ID, username, email-verification state, avatar, a bounded snapshot of servers you share with us, and RubyX server membership status. OAuth access and refresh tokens are not stored in our database.
  • Order & billing data: prepaid credit purchases and, when card checkout is enabled, transaction IDs, product, amount, currency, and country from the configured billing provider. We do not store full card numbers.
  • License data: license keys, claim codes, HWID hashes, expiry dates, validation timestamps, and IP addresses used for license validation (kept for fraud prevention and abuse mitigation).
  • Support data: messages and attachments you send through support tickets.
  • Email correspondence: sender and recipient addresses, message headers, subject, message body, and attachments sent to RubyX email addresses. Authorized administrators can access mail received at RubyX aliases through mail.rubyx.cc.
  • Technical data: log files, IP address, user-agent, device fingerprint hashes, and rate-limit counters.

3. Why we use your data (legal bases)

  • Performance of a contract — to deliver licenses, run the dashboard, process refunds, and provide support.
  • Legal obligation — to keep tax/VAT records, respond to lawful requests, and comply with anti-fraud regulations.
  • Legitimate interests — to secure the platform, prevent fraud and abuse, monitor uptime, and improve our products.
  • Consent — for optional marketing emails or non-essential cookies; you may withdraw consent at any time.

4. Sharing & processors

We share data only with vetted processors acting under written agreements:

  • Configured billing provider (when card checkout is live) — payments, refunds, tax compliance, and fraud screening. Card checkout is not live until the Billing page says so.
  • Supabase — managed database, authentication, and storage.
  • Cloudflare — CDN, DDoS protection, and edge runtime. Email Routing receives messages addressed to RubyX aliases; Workers processes them, D1 stores mailbox records, and private R2 storage holds message content and attachments.
  • Resend — sends outbound mailbox messages when the service is configured and an authorized administrator chooses to send a message. Receiving an email does not automatically send a reply through Resend.
  • Email/transactional providers — to send account verification, receipts, and security alerts.

We never sell your personal data.

5. International transfers

Some processors are located outside the European Economic Area. When this happens we rely on Standard Contractual Clauses or equivalent safeguards approved by the European Commission to ensure your data receives an adequate level of protection.

6. Retention

  • Account data: while your account is active, plus up to 24 months after closure.
  • Billing & tax records: 10 years, as required by EU tax law.
  • License validation logs: 12 months.
  • Support tickets: 36 months for quality and dispute handling.
  • Received email: retained in the mailbox until moved to Trash, then permanently deleted after 30 days in Trash. This mailbox retention is separate from support ticket retention.

7. Your rights

Subject to applicable law you have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You can also lodge a complaint with your local data protection authority. To exercise any right, email privacy@rubyx.cc. We will respond within 30 days.

8. Security

We protect your data with TLS in transit, encryption at rest, hashed passwords, row-level security on the database, audit logging, optional authenticator-based two-factor with native AAL2 session enforcement, and least-privilege access controls. No system is perfectly secure; please report vulnerabilities to security@rubyx.cc.

9. Cookies

We use strictly necessary cookies for authentication and session management, and optional analytics cookies (only with consent) to understand aggregate usage. You can manage preferences in your browser at any time.

10. Children

The Services are not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We will post any updates on this page and, for material changes, notify you by email. Continued use of the Services after the effective date constitutes acceptance of the revised policy.