PHP2List itself sets no cookies, has no accounts, and runs no analytics, advertising or tracking scripts. Its pages load nothing from other websites. Your vendor watchlist and theme choice are saved only in your own browser, and only if you want them to be.
The site is hosted by Cloudflare, which handles every request. Cloudflare processes request data such as your IP address to deliver and protect the site, and may set its own strictly necessary security cookies. Details are below.
Your privacy choices
You can decide whether PHP2List may save your watchlist and theme choice in this browser. Turning it off deletes anything already saved. The watchlist keeps working through the page address, but it won't be remembered next time.
Who is responsible
The operator of PHP2List, an independent website (see the disclaimer), is responsible for this website ("controller" under the EU and UK General Data Protection Regulation, GDPR).
Contact for privacy questions or requests: contact details will be published here.
Cookies and browser storage
- Cookies set by PHP2List: none.
- Cookies set by Cloudflare: depending on the security features active at the time, Cloudflare may set cookies such as
__cf_bm(bot detection; expires after 30 minutes of inactivity) orcf_clearance(set when you pass a security check). Cloudflare describes these as strictly necessary and says it does not use__cf_bmto track users from site to site. See Cloudflare's cookie list and cookie policy. - Local storage (kept on your device and not sent to the server):
php2list.vendors: your vendor watchlist, saved when you add vendors.php2list.theme: light or dark theme, saved only if you switch away from your system setting.php2list.privacy: remembers that you've seen the privacy notice and your choice, so it isn't shown on every visit.
PHP2List's local storage is used only to provide features you choose to use, and to remember your privacy choice. Storage that is strictly necessary for a service you request, and security cookies needed to protect a site, are generally exempt from consent under the EU ePrivacy rules. We still let you switch PHP2List's own storage off, as described above. Cloudflare's security cookies are controlled by Cloudflare, not by this setting.
What is processed, and why
When you visit the site
Like any website, your browser sends technical information with each request: your IP address, browser and device details (user agent), the page requested (but not the part of the address after #), the referring page if your browser sends one, and the time. Every request passes through Cloudflare, which processes this information to deliver the site, protect it from attacks and bots, and run its network.
What the operator can see: Cloudflare's dashboard shows the operator aggregated traffic statistics, such as request counts. Cloudflare's developer tools can also show live request details for troubleshooting. The operator does not export, store or combine this information, and does not use it to identify or profile visitors.
- Purpose: delivering the website, keeping it secure, and troubleshooting.
- Legal basis (GDPR): legitimate interests (Article 6(1)(f)) in providing a working, secure website.
- Retention: Cloudflare keeps logs according to its own policies. The operator does not keep its own copies.
Your watchlist, searches and exports
Vendor names, searches and filters are handled in your browser. They are kept in your device's local storage and in the part of the page address after #, which browsers don't include in requests to the server. CSV and JSON exports are created on your device and are not uploaded. If you share a link, anyone who receives it can see the vendor names in it.
The software list itself
The list is fetched from GitHub by the PHP2List server, not by your browser. It describes software products and companies, not visitors.
Hosting provider and international transfers
PHP2List runs on Cloudflare Pages. Cloudflare processes request data on the operator's behalf under its Data Processing Addendum. Cloudflare operates a global network, so data may be processed outside the EU, UK or your country. For transfers from the EU, UK and Switzerland, Cloudflare relies on the EU Standard Contractual Clauses in its Data Processing Addendum and its certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. See the Cloudflare Privacy Policy and Cloudflare's GDPR information.
The operator does not sell visitor data, share it for advertising, or use it for profiling or automated decision-making. How Cloudflare handles data it processes as a provider is set out in its own policies, linked above.
Your rights
If the GDPR applies to you (for example in the EU, EEA or UK), you have the right to access, correct or erase personal data about you, to restrict or object to its processing, and to data portability. The operator does not keep its own records about visitors, so there will normally be nothing for the operator itself to provide or delete. Request data processed by Cloudflare can be raised with the operator, who can follow up with Cloudflare, or with Cloudflare directly.
You also have the right to complain to a data protection authority, for example the authority in the EU country where you live or work, or the Information Commissioner's Office (ICO) in the UK. Outside the EU and UK you may have similar rights under local law, such as Canada's PIPEDA or US state privacy laws.
Links to other websites
PHP2List links to vendor advisories, research and other sites. Those sites have their own privacy policies. When you follow a link, PHP2List tells your browser not to pass on the page address as a "referrer".
Changes to this notice
If the way PHP2List handles information changes, for example if analytics are ever added, this notice will be updated first and the date below will change.