What PHPRay collects,
and what it does not.
Draft — the effective date will be set at launch. Controller: IQgroup Adam Buhl, ul. Luboszycka 36/1, 45-128 Opole, Poland, NIP 9910389442, operator of the IQhost hosting brand. Contact: [email protected].
1. The open-source software (extension, collector, plugins)
The extension and the collector run entirely on your own server and send nothing to us. There is no telemetry, no update check and no licence call-home. Trace data (request URIs, timings, SQL fingerprints with literals replaced by “?”, outbound hostnames, PHP error messages) stays in your collector's local database for the retention you configure (30 days by default, 4 GB cap).
2. This website
phpray.dev sets no cookies and loads no third-party scripts or external fonts. Visits are counted by our own Umami instance (stats.phpray.dev, hosted in the EU): it records the page address, referrer, browser type and country — no cookies and no IP address (a daily, irreversible hash is used instead), so it does not identify a person. The web server keeps standard access logs (IP address, URL, user agent, timestamp) for 14 days for security purposes, then deletes them. The only things stored in your browser are your language and theme choice — never sent to us.
3. PHPRay Cloud (the fleet console)
Date reaches the cloud only when you enter a server key into your collector. Then the collector sends: per-minute aggregates per site (request counts, latency percentiles, error counts, top URIs, per-plugin timings); a configurable sample of request traces (URI, method, status, timings, SQL fingerprints, outbound hostnames, PHP errors, plugin and theme names) — query literals are removed before sending, and request bodies, cookies, session identifiers and POST data are never captured; the server name, collector version and PHP version. Visitor IP addresses can appear in a trace only if your application puts them in a URL; we recommend the collector's scrub rules for such paths. Account data: the e-mail address and name you give us, invoices, and console access tokens (stored hashed).
Where and for how long
Servers in the European Union (Opole, Poland) operated by the controller. Traces and aggregates for the retention of your plan, then deleted; account data for the life of the account plus the period required by Polish accounting law for invoices. Processors: the hosting provider of our EU servers and our payment provider; we will list them by name before launch. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).
4. Your rights
You can export or delete all data of an account from the console, or by writing to us; deletion completes within 30 days, backups expire within a further 30 days. You have the right of access, rectification, erasure, restriction, portability and objection, and to lodge a complaint with the Polish supervisory authority (UODO). A data-processing agreement for agencies handling their clients' sites is available on request.
5. Changes
We will announce changes to this policy in the console and on this page with the date of the change. The history of this page is public in the website's repository.