Privacy Policy

Not legal advice — template to be reviewed by a qualified professional before public launch. Placeholders are shown in [brackets].

Last updated: 2026-10-24

1. Who we are

PHPSafeCheck ("we") is operated by [Operator name, address]. Contact: [contact address].

2. What you upload (your code)

Uploaded or pasted code is written to a temporary folder on the scanning server, analysed, and deleted as soon as the scan finishes — whether it succeeds or fails. We do not keep copies, do not use it to train any model, and do not share it. Code never leaves the scanning server.

3. Your report

Results are returned to your browser and kept only in that tab's session storage; closing the tab removes them. PDFs are generated on request and not stored on our servers.

4. Data we store

• Usage counter: a random cookie ID (psc_cid) and a salted, one-way hash of your IP address, each with a monthly scan count. Raw IP addresses are not stored. Counters reset monthly and older records are deleted after [90 days].
• License key (Pro only): stored in a cookie (psc_license) in your browser so you don't need to re-enter it.
• Server logs: standard request logs (time, path, status) kept for up to [14 days] for security and debugging.

We do not require an account or an email address to use the free plan.

5. Cookies

We use only strictly necessary first-party cookies (psc_cid, psc_license). No advertising or third-party tracking cookies.

6. Third parties

Dependency and PHP version checks send package names and versions only (never your code) to public vulnerability data sources: OSV (api.osv.dev), the Ubuntu CVE tracker (ubuntu.com), the Debian security tracker (security-tracker.debian.org) and endoflife.date. Their own privacy policies apply to those requests. If paid plans launch, payments will be handled by a payment processor [name], which receives payment details directly; we never see card numbers.

7. Legal bases and your rights

We process the minimal data above to provide the service and enforce plan limits [legal basis, e.g. legitimate interest]. Depending on where you live you may have rights to access, delete, or object to processing of your data. Because we store no names or emails, we may be unable to identify you; contact [contact address] with your cookie ID if you want it deleted.

8. Security

Scanning runs in an isolated container with a read-only filesystem; uploads are limited in size and file count.

9. Children

The service is not directed to children under 16 and we do not knowingly collect their data.

10. No live scanning

We never probe or scan websites. Only code you choose to upload is analysed.

11. Changes

We will post updates on this page and change the "Last updated" date.