Privacy Policy
Last updated: 26 October 2026
This policy explains what personal data phpwarden (“we”, “us”) collects when you use the phpwarden hosted service, why, and who we share it with. The open-source command-line scanner runs on your own machines and sends us nothing unless you explicitly configure it to report to the hosted service.
What we collect
| Data | Why |
|---|---|
| Account email and password hash | To create and secure your account and sign you in. |
| Scan results you submit (findings, project names, dependency/version data, and — if you use log detection — the request lines you upload) | To display your dashboard, rank findings, and send alerts. |
| Billing identifiers (Stripe customer/subscription IDs) | To manage subscriptions and API credits. We never see or store full card numbers — payments are handled by Stripe. |
| Team membership and discussion messages you post | To provide team collaboration features. |
| Basic technical logs (IP address, request metadata) | Security, abuse prevention, and rate limiting. |
How we use it
We use your data only to operate, secure and improve the Service, to process payments, and to contact you about your account, security alerts you’ve enabled, and essential service notices. We do not sell your personal data, and we do not use your scan data to train models.
Processors we rely on
- Stripe — payment processing and billing.
- Resend — transactional email (verification, password reset, invites, alerts).
- Cloudflare — content delivery, TLS and DDoS protection for our domains.
These processors handle data on our behalf under their own security and privacy terms.
Retention
We keep account and scan data for as long as your account is active. When you delete your account, we delete the associated projects, findings, sessions, team records and feed keys. Some records may persist briefly in backups and in billing records we are required to retain.
Your choices
You can access and update your account details, delete projects, and delete your account from the dashboard. To request a copy or deletion of your personal data, or to ask a privacy question, email [email protected].
Cookies
We use a small number of first-party cookies strictly to keep you signed in and to protect forms against cross-site request forgery. We do not use third-party advertising or tracking cookies.
Changes
We may update this policy; material changes will be posted here with a new “last updated” date.