Privacy notice · pkgs.ml

pkgs.ml is Riot's OCaml package registry. This notice explains what data pkgs.ml processes, why it processes that data, and how the service tries to keep that data minimal.

The service is intentionally designed around data minimization. In practice, that means pkgs.ml stores the identity and security data needed to authenticate users, operate package publishing, and expose public package metadata, while avoiding generic request logging and raw IP-based analytics in the registry database.

1. Controller and contact

The controller for personal data processed through pkgs.ml is the operator of pkgs.ml.

Privacy questions and requests can be sent to privacy@pkgs.ml .

If pkgs.ml is later operated by a legal entity, this notice should be updated to name that entity and its contact details explicitly.

2. What data pkgs.ml collects

GitHub account data

When you sign in with GitHub, pkgs.ml stores your GitHub login, GitHub user ID, display name when available, avatar URL, primary email address, and whether that primary email address is verified. pkgs.ml currently requires a verified primary email address to complete sign-in.

pkgs.ml also stores a copy of your GitHub avatar in registry storage so that the web UI can continue to display your avatar without depending on a live GitHub API request on every page load.

Session and authentication data

pkgs.ml uses a secure session cookie named pkgs_session to keep you signed in. In the registry database, pkgs.ml stores the session ID, the user ID it belongs to, the associated GitHub login, the session creation time, and the expiry time.

The session cookie is HttpOnly, Secure, and SameSite=Lax. It is used only for authentication and authenticated account actions.

Publish token data

If you create an API publish token, pkgs.ml shows the plaintext token exactly once at creation time. After that, pkgs.ml stores only the token ID, a derived hash of the secret, the owning user and GitHub login, the token name, capability metadata, creation time, last-used time, and revocation time if the token is revoked.

Public package and registry data

pkgs.ml is a public registry. When a package is published, the service stores and serves public registry metadata such as package name, version, description, license, homepage, repository, categories, keywords, dependencies, owner login, public artifact digests, manifests, and public package/source archives.

Package ownership information shown on package pages and user pages is public by design. Published package artifacts and metadata may also be cached or mirrored as part of normal registry operation.

Operational events

pkgs.ml stores purpose-built package lifecycle events rather than generic request logs. These events include publication and indexing events such as package submission, verification, publication, indexing, and searchability. Event rows record the event ID, type, package name, package version, optional package locator, a structured payload, and the event timestamp.

Analytics data currently collected

pkgs.ml currently stores only a small number of purpose-built analytics facts for aggregate ecosystem statistics:

package downloads: package name, version, artifact digest, source archive key, and timestamp;
Riot binary downloads: binary name, object key, and timestamp;
OCaml toolchain downloads: binary name, object key, and timestamp; and
index reads: document key, package name when applicable, and timestamp.

These tables are used to produce aggregate registry statistics such as package installs, Riot installs, OCaml installs, index refreshes, and package-level download counts.

3. Data pkgs.ml does not currently collect by default

pkgs.ml does not currently treat generic request logging as a product feature, and it does not intentionally store raw IP addresses in the registry database for analytics or product reporting.

pkgs.ml also does not currently store generic page-view logs, unique visitor IDs, search query analytics, or advertising and cross-site tracking identifiers in the registry database. If a future feature requires new analytics data, the intent is to keep that collection narrowly scoped, documented, and anonymous where possible.

4. How pkgs.ml collects data

pkgs.ml collects data directly from you when you:

sign in with GitHub;
create or revoke publish tokens;
publish a package artifact; or
download package artifacts, Riot binaries, OCaml toolchains, or sparse index documents.

pkgs.ml also receives account information from GitHub during OAuth sign-in and stores a small number of registry events and analytics facts automatically as part of operating the service.

5. Why pkgs.ml processes data

To authenticate users and manage accounts

GitHub identity data and session data are used to sign users in, maintain user accounts, associate package ownership, and display account identity in the web interface.

Legal basis: performance of a contract or steps taken at your request before providing authenticated registry features.

To operate package publication securely

Publish token metadata, session data, package claims, and publication events are used to create, validate, revoke, and audit publish credentials and publishing actions.

Legal basis: performance of a contract and legitimate interests in keeping the registry secure and preventing unauthorized publication.

To run the public registry

Package metadata, ownership metadata, manifests, artifacts, and index documents are used to render package pages, user pages, search results, sparse index documents, and public downloads.

Legal basis: performance of a contract and legitimate interests in operating a usable public package ecosystem.

To expose aggregate usage statistics

Purpose-built analytics facts such as download counts and index reads are used to produce aggregate statistics pages and to understand service usage without relying on generic IP-based request logging.

Legal basis: legitimate interests in operating, improving, and securing the service.

6. Recipients and infrastructure

pkgs.ml does not sell personal data. Data may be processed by a limited number of infrastructure providers that are needed to run the service.

GitHub, for user authentication;
Cloudflare, for hosting, storage, sessions, delivery, and registry infrastructure; and
public users of the registry, but only for data that is public by design, such as published package metadata and ownership information.

Data may also be disclosed where required by law or where reasonably necessary to protect the security, integrity, or operation of the service.

7. International transfers

Because pkgs.ml relies on online infrastructure and GitHub authentication, data may be processed outside your country. Where applicable, the operator of pkgs.ml should rely on appropriate safeguards for international transfers.

8. Retention

pkgs.ml keeps personal data only for as long as reasonably necessary to provide the service, maintain package ownership and publish security, comply with legal obligations, and preserve the integrity of the public registry.

In practice, that means account, package ownership, token metadata, and publication records may remain stored while they are needed to operate the service and maintain a coherent public package ecosystem. Published package metadata and package artifacts may need to remain available as part of registry continuity even if a user later stops using the service.

pkgs.ml does not currently publish fixed retention windows for every category of operational data. Where a fixed period is not yet defined, retention is based on operational need, security, legal obligations, and ecosystem integrity.

9. Whether you must provide data

If you want to use authenticated features such as package management or publish token administration, you need to provide the GitHub account data required for sign-in. If you want to publish packages with a token, you need to create and use a publish token.

If you choose not to provide the data needed for authentication or publishing, pkgs.ml may be unable to provide those authenticated registry features to you.

10. Cookies and similar technologies

pkgs.ml uses one authentication cookie, pkgs_session, to keep signed-in users authenticated. pkgs.ml does not currently describe or use advertising cookies or unrelated tracking cookies on its public privacy page.

The website also stores the light or dark theme preference in local browser storage so the UI can remember your choice. That preference is used only for presentation.

11. Your rights

Subject to applicable law, you may have the right to access your personal data, rectify inaccurate personal data, erase personal data, restrict processing, object to processing based on legitimate interests, receive the personal data you provided in a portable format where applicable, and withdraw consent where processing depends on consent.

If you make a request, pkgs.ml should respond within the time required by applicable law.

12. Complaints

If you are in the EEA, UK, or another jurisdiction with similar rights, you may lodge a complaint with your local supervisory authority if you believe your personal data has been processed unlawfully or your rights have not been respected.

13. Automated decision-making

pkgs.ml does not currently describe automated decision-making or profiling that produces legal or similarly significant effects on users. If that changes, this notice should be updated.

14. Changes to this notice

pkgs.ml may update this notice from time to time. If material changes are made, the updated version should be published on this page together with an updated "Last updated" date.