Privacy policy

Last updated: 2026-10-22

What we process

• The address you check. We use it to make the request. The result for that site (not your identity) is cached for 10 minutes so repeated checks don’t hit the site again.
• Your IP address is used transiently for rate limiting and bot protection (Cloudflare Turnstile). We do not store it in our own logs.
• Operational logs record the result category and timing of each check, without your IP address or the checked address. They are kept for a limited period by our hosting provider.
• Aggregate statistics count checks by result category, detected PHP branch, CMS, web server and CDN, so we can see which fixes people need. They contain no IP address, no checked address and no response content.
• Page analytics. We use Google Analytics to count page views, referrers and approximate location (country or city). It sets first-party cookies (_ga, _ga_*) outside the EEA, the UK and Switzerland; in those regions it runs without cookies. Google signals and ad personalisation are turned off. The address you check is never part of the page URL, so Google Analytics does not receive it.
• AI assistant (only when you use it). If you paste server output, upload a screenshot, or ask for a fix plan or a message to your host, we send that content to DeepSeek, whose servers are in China, through Cloudflare AI Gateway. Before sending text we remove hostnames, domain names, IP addresses, email addresses, account names in file paths and anything that looks like a key or password. The checked address is never sent. Screenshots are re-encoded in your browser and sent as they are, so crop out anything private. We don’t store what you paste, the screenshot or the AI’s answer; we only record the task type, timing and token cost. AI Gateway logging is turned off.
• Bulk reports. When you check a list, we store the list and the results so we can show you the totals; an unpaid check is deleted after 3 days. If you buy the report, we also store your email address and any server output verdicts you add, so we can show the report, run the rechecks and send you the report link and change alerts. They are deleted when the report link expires (30 to 120 days depending on the plan). The list of sites is never sent to the AI provider: the AI summary only sees counts and PHP versions per group. Payment details are handled by Waffo, our merchant of record; we only receive whether and when the payment succeeded. The report page loads no analytics.
• AI credits. If you buy credits we store the email address, the balance and which pack was paid for, so we can add the credits, show the balance and email you the private link. We do not store the output you paste or the assistant’s reply. Payment details are handled by Waffo; we only receive whether and when the payment succeeded. The page that holds the credit link loads no analytics.

What we don’t do

• No accounts and no passwords. A credit purchase is a private link, like a bulk report. No advertising, no advertising cookies.
• We don’t sell or share data. We don’t build lists of vulnerable sites.

Your data rights

You can ask to see, correct or delete the personal data we hold about you. For a bulk report that is the email address you gave at checkout, the list of sites you submitted, the check results and any server output verdicts you added. You can also object to processing or ask for a copy in a portable format (CSV).

• See your data. Open your report link: it shows the sites, results and verdicts we store for that report, and you can download them as CSV. The email address is the one our report emails were sent to; write to us if you want us to confirm it. If you lost the link, use “Find my report” on the bulk report page and we email the links of your paid reports to the address you used. For credits, the balance page shows what this link can spend. If you lost it, use “Email me my credit link” on the credits page.
• Correct it. Write to us to change the email address on a report. A list of sites cannot be edited after the check, but you can run a new free check with the corrected list.
• Delete it. Write to us and we delete the list, the results, the verdicts and your email address for that report. The report link then stops working and rechecks and alerts stop. Unpaid checks are deleted automatically after 3 days, and paid reports when their link expires. For credits, write to us and we delete the balance and the email address on that link. Spent credits cannot be restored.

How to ask: email contact@php2shell.app from the address you used at checkout, and include the report link or the date of purchase so we can find the right report. If you write from another address, we may ask you to confirm that the report is yours before we change or delete anything.

How long it takes: we confirm your request within 3 business days and complete it within 30 days, usually much sooner. If we cannot do something (see below), we tell you why.

What we cannot change: our operational logs and statistics contain no IP address, checked address or email, so they cannot be linked to you. Payment records are held by Waffo as merchant of record and are kept as tax and accounting law requires; you can contact Waffo for those. Google Analytics data is anonymous to us; you can block it with your browser or the Google Analytics opt-out add-on.

If you are in the EEA, the UK or another region with data protection law, you can also complain to your local data protection authority.

Processors

The site runs on Cloudflare Workers. Turnstile is provided by Cloudflare under its own privacy policy. Google Analytics is provided by Google; see how Google uses data from sites that use its services. Payments for credits and bulk reports are processed by Waffo; report emails are sent through Cloudflare Email Service. The AI assistant uses DeepSeek’s API under its open platform terms and privacy policy.

Contact

Email contact@php2shell.app for privacy questions and data requests. See also contact.