What we keep, and for how long.

The address you check

We load that page once and reuse the result for 10 minutes, so a repeat check doesn't load the site again. We keep a list of the public sites people check, with each site's latest result, whether someone downloaded, emailed or asked about its report, and, if analytics are on (see below), how the person behind the latest check found PHP Scanner, such as a search or a LinkedIn post, so we can see how widely PHP2Shell reaches and which channels bring people here. That list never records who checked a site: no IP address, no visitor id.

A PHP version you paste

It's rated in your browser and isn't sent to us, unless you download or email the report, or send the Talk to Catch form. Then it's used for that report or kept with your request.

Your email, if you ask for the report

We use it to send the report through our email provider, Resend, and don't keep it. Rate limits use a scrambled version of it for up to 24 hours.

If you tick "keep me posted"

We keep your email, the site you checked, its result, the wording you agreed to, the date, and how you found PHP Scanner if analytics are on (see below), so we can email you when a future PHP security fix may affect your site. Every email has an unsubscribe link. After you unsubscribe we keep only your email and the dates you agreed and unsubscribed, so we never email you again.

If you ask Catch to get in touch

Your name, email, the site you checked, its result, your answers and how you found PHP Scanner (if analytics are on) go to Catch Digital so a person can reply. We keep them for up to 24 months, and they're never sent to an AI model.

Where we keep it all

In an Airtable base that only Catch Digital's team can open. Airtable is a US company, so this information is stored in the United States. We use the list of checked sites for statistics, never to contact a site's owner about their result.

Our host

Vercel runs this site and keeps standard request logs, which include the address you checked, for a short time.

Analytics and cookies

We use Google Analytics, through Google Tag Manager, to count visits and see which pages and steps people use, and Catch Digital's own tracker to remember how you found us, such as a search, a LinkedIn post or an ad. Neither receives the address you checked: we remove it from page addresses and titles before anything is sent. In the EU, the UK and US states that require opt-in, nothing runs until you choose in the banner. Elsewhere it runs by default, and you can turn it off at any time with Cookie preferences at the bottom of every page. A Global Privacy Control signal from your browser counts as no. The cookies are _ga and _ga_GD53DB1HJ5 (Google Analytics, up to 2 years) tg-tier (which consent rules apply to you) and ps_source (1 minute: carries how you found us from the address form to your result, only when analytics are on); your choice and the tracker's notes (tg-consent-v1 and cd_ entries) stay in your browser's storage. We run no ad pixels.

Questions, a copy or deletion

Email hello@catchdigital.io and we'll answer, send you a copy of what we hold about you, or delete it.

PHP Scanner is run by Catch Digital, 1215 13 St SE Unit 101B, Calgary, AB T2G 3J4, Canada.