Privacy Policy

Last updated: October 23, 2026

php2shell is a PHP upgrade compatibility scanner and code migration assistant. This policy explains which data we collect, why we collect it and what we never do with it. We keep it short and concrete on purpose.

1. Information we collect

• Account data: email address, display name and the hashed password you choose when you register. If you enable email verification, we also store the verification token and the verification status.
• Analysis data: the project name, the PHP versions you select, the number of files, the detected issues, the fix records and the report you export.
• Submitted source code: the PHP files you upload or paste for the analysis. This content is used to produce the scan result, the diff and the report.
• Usage data: which features you used, how many scans you ran and how many credits you consumed. We use it for quota enforcement and to keep the service running.
• Payment data: handled by our payment processors. Waffo Pancake is our default payment channel and a PCI-DSS certified payment processor, and Creem is retained as a backup payment channel. We receive the subscription status, the product and the order identifier - never your card number. Card details are entered on the payment processor's hosted checkout, never on the php2shell servers, and we never store them.
• Support data: the messages you send to support@php2shell.top.

2. How we use the data

• To run the compatibility scan, the automatic fixer, the test verification and the report generation.
• To manage your subscription, your license key and your token quality pack credits.
• To detect abuse, to enforce the quotas and to keep the availability of the service.
• To answer your support requests and to send service related emails (no marketing spam).
• To comply with our legal obligations.

3. Source code and AI assisted analysis

The compatibility analysis, the automatic fixing and the report generation run on the server that hosts this tool. The source code you submit is used to produce the result you asked for and is handled under the access controls of the service.

The AI assisted analysis is the only feature where a code fragment is transmitted to an external AI provider. When you request an AI review, php2shell de-identifies the fragment first: comments are removed, string literals are replaced by placeholders, variable names are replaced by neutral placeholders and credentials, e-mail addresses, URLs, IP addresses and file system paths are masked. The de-identified fragment is sent to the model provider, used for the answer and then discarded. We do not store the original or the de-identified snippet, and we never keep a training copy of it.

We never resell, share or expose API keys. The AI assisted review is powered by the DeepSeek deepseek-chat model, accessed through the DeepSeek API. AI access is only possible through the token quality pack, which is a prepaid credit system - a one-time purchase, never renewed and never charged automatically - we pay the provider, you never bring your own key and you never hold a provider account.

4. Data sharing

We do not sell your personal data. We share data only with:

• Waffo Pancake - our default payment processor (transaction and invoice data).
• Creem - our backup payment processor (transaction and invoice data).
• Our AI provider - the de-identified fragment described above, only when you request an AI review.
• Infrastructure providers - hosting, database and email delivery.
• Legal authorities - when required by law.

5. Cookies, local storage and the traffic statistics

This website uses no advertising cookie and no cross-site tracking. The browser's local storage keeps your session token, your refresh token and a copy of your profile so that you stay signed in between visits. Clearing the site data in your browser removes them immediately.

The home page loads a cookie-less traffic statistics script and a session replay script from Umami, hosted at llmgateway.cloud. They tell us how many people visit the site, which pages they read and whether the pages work, so that we can fix them. They set no advertising cookie, they do not build a profile of you across other websites and they never receive your source code, your licence key or your payment data. The session replay records the interaction with the page itself, never the content of the files you analyse.

If you prefer not to be counted, use a browser extension that blocks third party scripts, or tell us and we will exclude your visits from the statistics.

6. Data retention

• Account data: as long as your account is active.
• Analysis history: the most recent 50 projects per account.
• Exported reports: stored on your machine only, we never keep a copy.
• Token consumption records: 12 months.
• When you delete your account, we remove or anonymise your personal data within 30 days.

7. Your rights

Depending on your jurisdiction you may have the right to:

• access your personal data and export it as JSON,
• correct inaccurate information,
• delete your account and the associated data,
• object to or restrict a specific processing,
• receive a copy of the data in a portable format.

You can export your data or delete your account from the dashboard at any time, or write to support@php2shell.top and we will do it for you. This includes the payment data we hold about you: we keep only the subscription status, the product and the order identifier, and you can request a copy of it at any time.

8. Security

Passwords are stored as salted bcrypt hashes, session tokens are signed JWTs, every page is served with strict security headers, and administrative endpoints require an elevated role. The service runs on TLS in production.

9. Children

php2shell is a developer tool and is not directed at children. We do not knowingly collect data from anyone under the age of 16.

10. Contact

For any privacy question, write to support@php2shell.top. We answer within two business days.