> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. crate

> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. crates.io distributes packages by source, so I'd imagine it doesn't have any info regarding the username of the system the package was uploaded from (although it does obviously have the username associated with the crates.io account, but there's no reason those have to be the same)