> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. Why s

> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. Why so? It's not different from any other serivice where people submit things. It shouldn't matter if it's a binary, text, or a video, and I've heard opinions that the contents users submit need to be monitored for personal information anyway.