Overview
PatchScope is designed to work with as little personal data as possible. There are no user accounts. Two of the three tools run entirely in your browser. If you send a consultation request or join the deep analysis waitlist, the details you enter are collected as described in the section on those forms below. This policy explains what is processed, by whom and why, and the choices you have.
In this policy, “PatchScope”, “we” and “us” refer to the PatchScope project, operated by evoa.one, at patchscope.evoa.one.
Summary
| Activity | Where it happens | What we keep |
|---|---|---|
| PHP Version Checker | Your browser | Nothing. Inputs are not sent to us |
| CVE Lookup | Your browser | Nothing. Searches are not sent to us |
| Website Security Checker | Our scanner endpoint (Cloudflare Pages Function) | Nothing in a database. The hostname is processed transiently |
| Consultation request and deep analysis waitlist | Our form endpoint (Cloudflare Pages Function), then email through Resend | Name, email, message and technical details you enter. The site stores no copy; the email is kept for the period stated below |
| Cloudflare Web Analytics (if enabled) | Cloudflare | Aggregated, cookieless page statistics |
| Google Analytics 4 | Google, only after you accept | Usage statistics as described below |
| Google AdSense (once enabled) | Google, after a consent decision | As described by Google |
Tools that run in your browser
The PHP Version Checker and CVE Lookup download a static data file and perform all matching locally in your browser. The versions, CVE IDs and keywords you type are not transmitted to our servers.
Website Security Checker
When you run a website scan, the URL you enter is sent to our scanner endpoint so that it can make requests to that site on your behalf. The scanner:
- Processes the hostname and the responses transiently, in memory, to produce your results.
- Inspects response bodies in memory only (up to 64 KB per response) to confirm specific file signatures. Bodies are never stored and never returned to you; results show only status codes and header values.
- Records only cookie names and attributes from the scanned site, never cookie values.
- Does not store the hostname or results in any database operated by us.
Our hosting provider, Cloudflare, may keep standard request logs (such as IP address, timestamp and request path) in accordance with its own policies. The scanned website will also see requests from our scanner, identified by the user agent PatchScopeBot/1.0, and may log them under its own policies.
Please scan only websites you own or are authorized to test. See the terms of use.
Consultation requests and the deep analysis waitlist
When you send a consultation request or join the deep analysis waitlist, you choose to give us personal data. We collect it only after you tick a separate consent box, which is not part of the terms of use. You may decline; the request then cannot be processed, and the rest of the site works as before.
- Items collected. Consultation request: email address and message (required), and name, PHP version and stack or hosting (optional). Waitlist: email address only. Anything you write in the message, such as a site address, is part of the request. Please do not enter credentials, secrets or personal data of third parties.
- Purpose. To read and answer your consultation request, or to send you one notice when deep analysis opens. The waitlist consent covers only that notice, not marketing. We do not use these details for advertising or any other purpose.
- Retention. Consultation requests are kept for up to 6 months after the request is handled. Waitlist email addresses are kept until the notice is sent or you ask us to delete the address, and for no longer than 12 months. They are then deleted.
- Recipient and processors. The details are emailed to the PatchScope operator, evoa.one, at the mailbox contact+patchscope@evoa.one. The email is sent from noreply+patchscope@evoa.one through Resend (which only sends the message), and the form endpoint runs on Cloudflare Pages Functions (hosting). The mailbox is hosted by Google Workspace (email receiving and storage). These processors may handle the data on servers outside Korea, including in the United States.
- Overseas transfer. Resend, Cloudflare and Google may process the details on servers outside Korea, including in the United States. Items: those listed above. When and how: at the moment you submit the form (Resend and Cloudflare) or at the moment Resend delivers the email to the mailbox (Google), by network transmission, in the United States and other countries where the provider operates. Recipients and contacts, as published in their privacy policies: Resend, support@resend.com; Cloudflare, privacyquestions@cloudflare.com; Google (Google Workspace), Privacy Help Center https://support.google.com/policies/troubleshooter/7575787/ (from Google Cloud Privacy Notice). Purpose: email delivery (Resend), hosting of the form endpoint (Cloudflare) and receiving and storing the email in the operator’s mailbox (Google), for the retention periods stated above. How to refuse: do not submit the form, or withdraw your consent through the contact page; the effect is that the request cannot be processed.
- No copy on the site. PatchScope does not store the request in a database. Cloudflare, Resend and Google may hold technical records and copies under their own policies.
- Your rights. To ask for access, correction or deletion, or to withdraw your consent, use the contact page.
- Care and limits. We take reasonable care with the details, but email is not a guaranteed-secure channel. These forms are not for children under 14.
Hosting
PatchScope is hosted on Cloudflare Pages. When you visit the site, Cloudflare processes technical data necessary to deliver the pages and protect the service, such as your IP address, browser user agent and requested URLs. This processing is governed by Cloudflare’s privacy policy.
Analytics
We use analytics to understand, in aggregate, which pages and tools are used, so that we can improve them.
Cloudflare Web Analytics
If enabled, Cloudflare Web Analytics collects aggregated page view statistics. It is designed to be privacy-first and does not use cookies or local storage to track individual visitors.
Google Analytics 4
Google Analytics 4 is loaded only after you accept analytics in the consent banner. If you decline or make no choice, it is not loaded. When enabled, Google processes data such as pages viewed, approximate location, device and browser information. IP address handling is determined by Google; see Google’s documentation for details.
What analytics events never contain
Analytics events sent by PatchScope never contain the versions, CVE IDs, keywords, URLs, hostnames or query strings you enter, and never contain detailed results. At most, events record coarse categories, for example that a check returned the verdict “affected” or concerned branch “8.3”.
Advertising
Google AdSense may be shown on content pages once enabled. AdSense loads only after you have made a consent decision in the banner:
- If you accept, Google may serve personalized ads, which can involve cookies or similar identifiers.
- If you decline, non-personalized ads may still be requested. Google may use cookies or similar technologies for purposes such as frequency capping, aggregated reporting and fraud prevention, as described in Google’s policies.
Advertising does not appear inside tool results, and ad requests do not include the inputs you type into the tools.
Cookies and local storage
PatchScope itself does not set cookies for its own functions. It uses your browser’s localStorage to remember:
- Your consent choice.
- Interface preferences, such as language or theme, where applicable.
Third-party services you consent to, such as Google Analytics or Google AdSense, may set their own cookies.
Your consent choices
You can review or change your choice at any time using the Privacy choices link in the site footer. Withdrawing consent stops analytics and personalized advertising from loading on subsequent page views. You can also clear localStorage and cookies for this site in your browser settings, which resets your choice.
Data sharing
We do not sell personal data. Data is processed by the service providers described above (Cloudflare for hosting and optional analytics, Resend for delivering consultation and waitlist emails, and Google for analytics and advertising where enabled and permitted by your choice). These providers act under their own terms and privacy policies.
Retention
We do not maintain a database of tool inputs or scan results. Consultation requests and waitlist addresses are kept for the periods stated in the section on those forms. Data held by our providers, such as request logs or analytics data, is retained according to their policies and settings.
Your rights
Depending on where you live, you may have rights to access, correct or delete personal data about you, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a data protection authority. Because we do not keep user accounts or store tool inputs, the only personal data we usually hold is what you send through the consultation and waitlist forms. For data held by Cloudflare or Google, you can also use the controls those providers offer.
To make a privacy request or ask a question, email the address listed on the contact page.
Children
PatchScope is a technical service intended for a general professional audience and is not directed at children. The consultation and waitlist forms are not for children under 14.
Changes to this policy
We may update this policy as the service changes, for example when analytics or advertising is enabled or adjusted. The “updated” date at the top of the page shows the latest revision. Significant changes will be reflected on this page before they take effect.