Privacy policy
The checker
Text you enter in the checker is processed in your browser. It is not sent to our servers and not stored.
Analytics
We use Google Analytics 4 and OpenPanel to count visits and see which pages are useful. Google Analytics may set cookies and receive your IP address, browser and page views. In the EEA, the UK and Switzerland it starts with analytics storage denied (Google Consent Mode v2), so it does not set analytics cookies there. OpenPanel is cookieless. Neither receives what you type into the checker.
You can block these with your browser settings or a content blocker.
Advertising
The site uses Google AdSense to show ads on some pages. Google may use cookies and similar identifiers to serve and measure ads, including personalised ads where you consent. There are no ads on the checker or its result.
Visitors in the EEA, the UK and Switzerland see Google's consent message and can accept, reject or manage their choices. You can change them later with the "Privacy and cookie settings" link that Google's message provides. For how Google handles data, see "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites). You can manage ad personalisation at https://adssettings.google.com. We never pass your checker input or your email address to Google for advertising. Operated by Zane; questions: contact@php2shellcheck.com.
If you email contact@php2shellcheck.com, we keep your message only as long as needed to answer it. For the paid patch plan, we use the details you send to write your instructions. Payments are handled by a third-party payment processor; we never see your card details.
Email updates (optional)
If you subscribe, we store your email address, the language of the page you used, the times you subscribed and confirmed, and when we last emailed you. We use them only to send the confirmation and the notices you asked for: a short email when an official source changes the php2shell fix status. We send nothing else and never share the list.
Subscribing is double opt-in: an address stays unconfirmed until you open the link in the confirmation email and press the confirm button. The link works for 48 hours, and unconfirmed addresses are deleted at the latest 8 days after the confirmation email. A confirmed address is kept until you unsubscribe. To limit abuse we keep a counter per hashed IP address and delete it within two days at the latest (the IP address is hashed with a secret salt and the hour, so it cannot be traced back or linked across hours). We do not store your IP address itself.
The list is stored in a Cloudflare D1 database (Cloudflare). The form uses Cloudflare Turnstile to stop bots. Its script loads only when you start using the form (click or tab into it), and Cloudflare receives your IP address and browser signals to run the check. The email is sent through Amazon SES (Amazon Web Services, Tokyo region).
Every email has a one-click unsubscribe link, which deletes your address at once. You can also email contact@php2shellcheck.com to unsubscribe, to ask what we hold about you or to have it deleted. If you prefer no email, the RSS feed on the status page carries the same updates.
Contact
Operated by Zane. Questions: contact@php2shellcheck.com.