{"id":13834897,"url":"https://github.com/prey/gdpr_rails","last_synced_at":"2026-01-20T21:04:11.408Z","repository":{"id":66688194,"uuid":"127337729","full_name":"prey/gdpr_rails","owner":"prey","description":"Rails Engine for the GDPR compliance","archived":false,"fork":false,"pushed_at":"2026-01-16T18:25:19.000Z","size":395,"stargazers_count":633,"open_issues_count":6,"forks_count":62,"subscribers_count":17,"default_branch":"master","last_synced_at":"2026-01-17T05:46:39.472Z","etag":null,"topics":["cookies","gdpr","gdpr-dashboard","gdpr-rails","general-data-protection-regulation","rails"],"latest_commit_sha":null,"homepage":"https://preyproject.com","language":"CSS","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/prey.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"MIT-LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-03-29T19:24:37.000Z","updated_at":"2026-01-16T18:25:31.000Z","dependencies_parsed_at":null,"dependency_job_id":"0d188c28-5e0c-4091-b6e2-936d09c54820","html_url":"https://github.com/prey/gdpr_rails","commit_stats":null,"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/prey/gdpr_rails","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prey%2Fgdpr_rails","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prey%2Fgdpr_rails/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prey%2Fgdpr_rails/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prey%2Fgdpr_rails/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/prey","download_url":"https://codeload.github.com/prey/gdpr_rails/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prey%2Fgdpr_rails/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28613679,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-20T18:56:40.769Z","status":"ssl_error","status_checked_at":"2026-01-20T18:54:26.653Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cookies","gdpr","gdpr-dashboard","gdpr-rails","general-data-protection-regulation","rails"],"created_at":"2024-08-04T14:00:53.570Z","updated_at":"2026-01-20T21:04:11.401Z","avatar_url":"https://github.com/prey.png","language":"CSS","funding_links":[],"categories":["CSS","GDPR","GDPR and Data Protection"],"sub_categories":[],"readme":"\n\n# GDPR RAILS\n\n### Rails Engine for the GDPR compliance\n![RB](https://media.giphy.com/media/L74KIFFW4kUkE/giphy.gif)\n\u003e The world needs some privacy, please\n\n\n[![Build Status](https://travis-ci.org/prey/gdpr_rails.svg?branch=master\u0026aa=123)](https://travis-ci.org/prey/gdpr_rails)\n[![Maintainability](https://api.codeclimate.com/v1/badges/4908e74f90a34ba473df/maintainability)](https://codeclimate.com/github/prey/gdpr_rails/maintainability)\n[![Coverage Status](https://coveralls.io/repos/github/prey/gdpr_rails/badge.svg?branch=master)](https://coveralls.io/github/prey/gdpr_rails?branch=master)\n\n## About this project\n\nPolicyManager (Aka GDPR Rails) was created with flexibility in mind to comply with the requirements of the GDPR ([General Data Protection Regulation](https://www.eugdpr.org/)). It's currently being developed at preyproject and will be battle-tested on [preyproject.com](https://preyproject.com) from May 25th.\n\n## Requirements\n\n- Ruby 2.5+\n- Rails 5.2+\n- ActiveStorage (required for portability features)\n\n**Note:** Paperclip is no longer supported. Please use ActiveStorage instead.\n\n### Main Features:\n\n#### Policy Rules\n+ Configurable policy rules, supports activerecord validations for new or existing users\n+ Supports session-less consent policies which will become persistent once the user signs in or signs up\n+ Versioning system for new policies\n+ JSON endpoints to handle pending policies and portability logic in order to be implemented in *client only* interfaces, ie: frontend apps like React, Vue, Backbone, you name it.\n\n#### Portability\nPortability module lets you define export options, that will generate a navigable static HTML site with all the data you've defined in the **portability rules** with json support too.\n+ Seamless data export with configurable templates\n+ Configurable Mailer templates for progress \u0026 download completion\n+ Downloads images to the local filesystem in order to comply with GDPR requirements on data accessibility.\n+ Zips all the information and delivers it with a expirable download link\n+ ActiveJob to handle the process\n+ Behind the scenes uses Rails's ActiveStorage in which you can set up storages, like S3, Google\n\n#### Scripts \u0026 Cookies\nConfigurable *scripts* which will bind cookie names in order to handle the script rendering and the cookie clean up.\n\n#### Forgetability\n+ TBD, for now we simply delete all the data when a user closes the account.  This could be handled in the future with encryption like in emails or other kind of sensible fields on a database.\n\n### Admin Panel\n![Admin panel](https://user-images.githubusercontent.com/11976/40152755-856941e2-5954-11e8-87d0-1464c21a61c2.png)\n\n## Installation\n\n\nAdd this line to your application's Gemfile:\n\nas `gem 'gdpr_rails'`\n\nThen in your application.rb require the policy_manager lib with\n\n`require \"policy_manager\"`\n\n## Requirements\n\n- Ruby 3.0+\n- Rails 6.1+\n- ActiveStorage configured in the host application\n\nInstall \u0026 run the migrations\n\n`rake policy_manager:install:migrations`\n\n## Rails ActiveStorage\n\nActiveStorage is required and used for file handling. Ensure your host app has ActiveStorage installed and configured.\n\n\n## Usage examples\n\n### Basic config\n\n```ruby\nconfig = PolicyManager::Config.setup do |c|\n  c.logout_url = \"logout\"\n  c.from_email = \"admin@acme.com\"\n  c.admin_email_inbox = \"foo@baaz.org\"\n\n  c.user_resource = User # defaults to User\n  c.admin_user_resource = AdminUser # defaults to User\n  # is_admin method in order for engine to know\n  # how to authorize admin only areas\n  c.is_admin_method = -\u003e(o){\n    o.is_god? || o.is_admin? || o.is_me? || o.watheva\n  }\n\nend\n```\n\nIn order for this engine to work you must supply some rules according to your needs, in order to be in comply with the GDPR you will need 3 rules at least. A cookie consent, a Privacy\u0026 TOS and an Age  confirmation (+16).\nSo, let's start by doing that:\n\n## Term rules\n\nIn your app router add the following:\n\n```ruby\n  mount PolicyManager::Engine =\u003e \"/policies\"\n```\n\nThen add the concern to your `User` model:\n\n```ruby\nclass User \u003c ApplicationRecord\n  include PolicyManager::Concerns::UserBehavior\nend\n```\n\nThen add an initializer, `config/initializers/gdpr.rb` and inside it set your policy rules.\n\n```ruby\nPolicyManager::Config.setup do |c|\n  c.add_rule({name: \"cookie\", sessionless: true }  )\n  c.add_rule({name: \"age\", validates_on: [:create, :update], blocking: true })\n  c.add_rule({name: \"privacy_terms\", validates_on: [:create, :update], blocking: true })\nend\n\n# If you are using devise, you must extend engines's controller with devise helpers in order to get current_user\nPolicyManager::UserTermsController.send(:include, Devise::Controllers::Helpers)\n```\n\n\u003e Note that you will need to go to the policy panel and add the policy\n\u003e content for each term at `http://localhost:3000/policies/categories` otherwise you will see errors like `no term for #{rule} policy`\n\n### ActiveRecord Methods\n\nWhen the policies are configured will generate some helper methods on User model. For example, with the example above you will get the following methods for free:\n\n+ `@user.has_consented_cookie?`\n+ `@user.has_consented_age?`\n+ `@user.has_consented_privacy_terms?`\n#### also you get:\n+ `@user.pending_policies`\n+ `@user.pending_blocking_policies`\n+ `@user.confirm_all_policies!`\n+ `@user.reject_all_policies!`\n+ `@user.needs_policy_confirmation_for?(rule)`\n+ `@user.policy_term_on(rule)`\n+ `@user.policy_user_term_on(term)`\n+ `@user.handle_policy_for(term)`\n+ `@user.can_request_portability?`\n\n## Policy rules:\n\n+ **sessionless:** will allow rules to be available for non logged users, if accepted a cookie `cookies[\"policy_rule_cookie\"]` will be generated. If then the user sign in or signs up you could get this cookie it will persist in database.\n\n**Use this in your controller:**\n```ruby\n@user.accept_policy_from(\"your_cookie\") if cookies[\"policy_rule_your_cookie\"] == \"accepted\"\n```\n+ **validates_on:** will require users validation, will automagically create virtual attributes for the policy you set, so, if you set `age` in your config you must supply in your forms a `policy_rule_age` checkbox in your form, if you don't supply those then the user validation will return errors on `policy_rule_age` . Don't forget to add the fields in your strong params in the controller which handles the request.\n+ **if:** you can add conditions as a Proc in order skip validations:\n```ruby\n  c.add_rule({name: \"age\", validates_on: [:create, :update],\n              if: -\u003e(o){ o.enabled_for_validation } })\n```\n+ **on_reject**: Proc which will be triggered when user rejects a policy (has an argument that contains the controller context)\n+ **on_accept**: Proc which will be triggered when user accepts a policy (has an argument that contains the controller context)\n\n#### Example\n\u003e This is an example for a `cookie` rule. The expected behavior would be when the user rejects cookies iterate over our scripts and delete cookies:\n\n```ruby\n  c.add_rule({name: \"cookie\", sessionless: true, on_reject: -\u003e(context){\n      PolicyManager::Script.cookies\n      .select{|o| !o.permanent }\n      .each{|o|\n        o.cookies.each{|c|\n          context.send(:cookies).delete(c, domain: o.domain)\n        }\n      }\n    }\n  })\n```\n\n#### Policy handling:\n\nThere are some endpoints that will handle json in order to interact with client applications, like react interfaces, $.ajax etc.\nyou can also use the html web panel directly from the engine.\nSo, if the Engine was mounted on `/policies` then your routes will be:\n\n    pending_user_terms          GET    /user_terms/pending(.:format)                     policy_manager/user_terms#pending\n    accept_multiples_user_terms PUT    /user_terms/accept_multiples(.:format)            policy_manager/user_terms#accept_multiples\n    blocking_terms_user_terms   GET    /user_terms/blocking_terms(.:format)              policy_manager/user_terms#blocking_terms\n    accept_user_term            PUT    /user_terms/:id/accept(.:format)                  policy_manager/user_terms#accept\n    reject_user_term            PUT    /user_terms/:id/reject(.:format)                  policy_manager/user_terms#reject\n    user_terms                  GET    /user_terms(.:format)                             policy_manager/user_terms#index\n    user_term                   GET    /user_terms/:id(.:format)                         policy_manager/user_terms#show\n\n## Scripts \u0026 Cookies\n\nThis is supposed to in mix with your declared cookie term. So, this configuration let's you declare your external scripts that are related with tracking, ie: Google Analytics, Kissmetrics, Google Tag manager, etc... This configuration expects that you declare scripts that will be rendered over certain contexts (environments) and have the names (and domains) of the cookies that those scripts generates.\n\n#### example:\n```ruby\n  c.add_script(\n    name: \"google analytics\",\n    script: 'shared/analytics/universal',\n    environments: [:production],\n    description: -\u003e{I18n.t(\"cookies.list.google_analytics\")},\n    cookies: [\"_ga\", \"_gid\", \"_gat_XXX-XXX\"],\n    domain: \".panel.preyproject.com\"\n  )\n```\n\n\u003e **Importance of declaring the cookie domain**: When you clean up the cookies (like in the example above for `on_reject`) is important to set the domain that this cookies belongs. In some cases this external scripts could add the cookie on your subdomain or your base domain. In out case we found that some cookies are generated on panel.preyproject.com or .panel.preyproject or just preyproject.com. Try to get that information on chrome console -\u003e application -\u003e cookies.\n\n### Example in your layout:\nThis is an example on how you would render your scripts only if the user has accepted the cookie\n```ruby\n    \u003c% if current_user.has_consented_cookie? %\u003e\n     \u003c!--  # this cames from portability/helpers/scripts_helpers --\u003e\n      \u003c%= render_scripts %\u003e\n    \u003c% end %\u003e\n```\n`render_scripts` will iterate over your configured scripts and render the templates defined on `PolicyManager::Script`\n\n## Portability Rules\n\nExport option \u0026 Portability rules will allow you to set up how and which data you will give to a requester user.\n\n#### Exporter:\n+ **path**: where the folder will be generated, usually can be set on /tmp, this will need a pathname, like `Rails.root.join(\"tmp/export\")`\n+ **resource**: which model , ie: `User`\n+ **index_template**: The first page. defaults to a simple ul li list of links tied to your rules, this expects a Pathname or a String with your template\n+ **layout**: A layout template this expects a layout name which has to be available on your app.\n+ **after_zip**: a callback to handle the zip file on the resource, something like:\n```ruby\nafter_zip: -\u003e(zip_path, resource){\n  puts \"THIS IS GREAT #{zip_path} was zipped, now what ??\"\n}\n```\n\n+ **mail_helpers**:  If you have some helpers you want to add to the mailers, then you can pass an Array of helpers, `[MailHelper, OtherMailHelper]`,\n+ **expiration_link**: integer, defaults to 60 (1 minute),\n\n#### Portability Rules:\n\nPortability rules collection render. This will call a @user.articles\nand will auto paginate records\n\n```ruby\nPolicyManager::Config.setup do |c|\n\n  # minimal exporter setup\n  c.exporter = {\n    path: Rails.root + \"tmp/export\",\n    resource: 'User'\n  }\n\n  # portability rules, collection render. This will call a @user.articles\n  # and will auto paginate records\n  # template expects a string or path\n  c.add_portability_rule({\n    name: \"exportable_data\",\n    collection: :articles,\n    template: \"hello, a collection will be rendered here use @collection.to_json\",\n    json_template: \"collection.json.jbuilder\", # or Rails.root.join(\"app/views/collection/json.jbuilder\")\n    per: 20\n  })\n\n  # portability rules, member render. This will call a @user.account_data\n  # template expects a string or path\n  c.add_portability_rule({\n    name: \"my_account\",\n    member: :account_data,\n    template: \"hellow , here a resource will be rendered \u003c%= @member.to_json %\u003e \"\n  })\n\nend\n```\n**Important:**\n\u003e If the content that will be delivered has images use the `image_tag`\n\u003e in your template.  This helper was reimplemented in order for the remote image to be downloaded automatically.\n\u003e And will be served locally in order to comply with the\n\u003e Portability data requirements.\n\n### Web Endpoints and methods for user:\n\n```\nuser_portability_requests   GET    /user_portability_requests(.:format)              policy_manager/user_portability_requests#index\n                            POST   /user_portability_requests(.:format)              policy_manager/user_portability_requests#create\nuser_portability_request    DELETE /user_portability_requests/:id(.:format)          policy_manager/user_portability_requests#destroy\n\n```\n### Web Endpoints and methods for admin :\nthis routes are accessible from engine's admin panel\n```\n\nconfirm_portability_request GET    /portability_requests/:id/confirm(.:format)       policy_manager/portability_requests#confirm\nportability_requests        GET    /portability_requests(.:format)                   policy_manager/portability_requests#index\nportability_request         DELETE /portability_requests/:id(.:format)               policy_manager/portability_requests#destroy\n```\n\n\n# TO DO\n+   anonimyzer\n\n#### Acknowledgments\n+ [Prey Team](https://github.com/orgs/prey/people)\n+ Special thanks to our legal GDPR advisor: Paul Lagniel \u003cpaul@preyhq.com\u003e\n\n#### Main maintainers\n+ Miguel Michelson - miguel@preyhq.com\n+ Patricio Jofré - pato@preyhq.com\n\n## Contributing\n- Just fork the repo and send us a Pull Request, with some tests please :)\n- FYI: The CI pipeline on travis will require gemlocks for each or the Rails versions we test against.\n  - Run `bundle exec appraisal install` and commit the generated files in the `./gemfile/` directory\n  - Check out [Appraisal](https://github.com/thoughtbot/appraisal) for more context.\n\n## License\nThe gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprey%2Fgdpr_rails","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprey%2Fgdpr_rails","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprey%2Fgdpr_rails/lists"}