Privacy

Who is responsible for your data

This site is run by SpiderHunts Technologies Ltd, registered in England and Wales (no. 16718403), registered office 182-184 High Street N, Office 14607, London E6 2JA, United Kingdom. The company decides how the data described on this page is used and is responsible for it. For any question or request about your data, email info@spiderhunts.com.

Your files and text

Images, PDFs, text and numbers you enter are processed inside your browser. They are not uploaded to our servers and we cannot see them. They are released from browser memory when you close the page or reset the tool.

Accounts and cookies

There are no user accounts. The site sets no advertising cookies. Google Analytics sets its own statistics cookies for every visitor, because this site is configured without a consent bar. Some tools may remember preferences such as your currency in your browser’s local storage only; you can clear it in your browser settings.

If your browser is set to a language other than Arabic, the Arabic homepage may show a small bar pointing to the English version. If you close it, your browser remembers that in local storage (ts-langbar) so it does not come back. That stays on your device.

Analytics

We use Google Analytics 4 to learn which pages and tools are used most. It loads for every visitor and Google sets its statistics cookies, so there is no consent bar to accept or decline. You can block it with your browser’s tracking protection or an extension.

Google receives ordinary visit data such as the page address, browser and device type and approximate country, and sets its statistics cookies. On top of that we send only two coarse events: a tool was opened and a download button was pressed, each with the tool identifier and page language and nothing else. We never send the content or names of your files, your text, customer documents, phone numbers or the URLs you enter. Advertising signals and ad personalization are switched off.

Statistics data is processed by Google and may be transferred to and stored on its servers in the United States and other countries outside your own, under Google’s privacy policy. There is no in-page control to switch this off, so if you do not want it, block it with your browser's tracking protection or an extension. Blocking it does not affect how any tool works.

Google also collects some events by itself, through a feature called Enhanced Measurement that is switched on in the Google Analytics account rather than in this website’s code. Depending on those settings it can record things such as page views, scrolling, outbound clicks and the moment you start filling a form, including which field you touched first. It does not receive what you type, and we have verified that the name of a file you open in a tool is never sent. If you run this site, review Enhanced Measurement in the Google Analytics admin and switch off what you do not need.

Statistics are enabled for all visitors on this site.

Our own site statistics

Besides Google Analytics, this site keeps its own statistics, through a service we run ourselves on the same server that hosts these pages, at toolsahla.com/api/track. It is separate from Google Analytics: the “Our own site statistics” choice applies only to it, and nothing it records is sent to Google or to any other third party.

Until you choose, whenever you decline, and always if your browser sends Do Not Track or Global Privacy Control, it runs in aggregate mode. No cookie is set and the statistics script stores nothing in your browser. Each page load is sent without cookies, with a random number that exists only while that page is open, so two page loads cannot be joined together from what your browser sends. For each page load the server keeps: the page address and title, the full address of the page you came from (including any search words in it) and any campaign tags in the link, the time, the page language, your time zone and the country worked out from it, your screen and window size, the browser and operating system names and your browser’s user-agent text, how long the page was actively used and how far it was scrolled, counts (numbers only) of pointer, scroll, key, touch and click actions, and whether the browser showed signs of automation. The counts and signs are used to tell people from automated programs.

We never store your IP address. The server uses it for a moment to limit abusive traffic and to check visitors that claim to be search engine crawlers, and keeps only an HMAC of it: a keyed hash made with a secret that never leaves our server. The hash can show that two visits came from the same network, which is what rate limiting and bot detection need, but it cannot be turned back into the address. In aggregate mode, page loads from the same network on the same day also share a counting key made the same way from the address and the date, so a day’s visitors can be counted without a cookie; it changes every day.

If you accept, our server sets one first-party cookie, ts_vid. It holds a random visitor number signed by the server, cannot be read by page scripts (httpOnly), lasts up to 365 days and is used only for these statistics. Your browser also keeps the current visit’s number in local storage (ts_sid) so the pages of one visit are joined together; a new visit starts after 30 minutes without activity or at midnight. In this mode we also record: clicks on the page (their position, a short technical description of the element, the visible text of links and buttons, and the address a clicked link points to), repeated and unresponsive clicks, scroll milestones, downloads, links to other sites, copying, form activity by field name only, JavaScript error messages, page speed measurements, a heatmap of pointer positions, and how you use each tool: when you open it, start it, finish it or it fails (with a short technical error code), how long processing took, the type and approximate size band of a file but never its name or contents, how many results the site search found but never the words you typed, and when you switch the interface language. Your answer itself is remembered in local storage (ts-fp-consent) so we do not ask again.

We never store what you type. Which keys you press, the values of inputs, the text of form fields, and file names and contents are not recorded in any mode: key presses are only counted, form tracking stores a field’s name, such as “email”, never what is in it, and replays hold pointer positions and the name of a focused field, never your input or the page’s text. Nothing here names you, and the site does not ask for or store email addresses in these statistics.

Automated visitors that run the page’s scripts, such as search engines that render pages, are recorded rather than dropped, and each visit is labelled human, automated or uncertain; a single page view with no interaction stays uncertain, because it could be either. The label comes from the browser’s user-agent text, signs that the browser is controlled by automation software, whether any real interaction happened, a hidden link that people cannot see or click, and whether the address is in a range a crawler’s operator publishes. To confirm a visitor that claims to be Googlebot or Bingbot, the server looks up the name registered for the address at the moment of the visit and checks that the name points back to the same address; neither the address nor that name is stored, only the yes-or-no result, against the IP hash.

Retention: pointer replays no longer than 30 days; clicks and other interaction events, heatmap data and grouped error reports no longer than 180 days (for an error report, counted from its last occurrence); visits and their page views no longer than 400 days; the IP hash, the user-agent text and the aggregate counting key no longer than 90 days, after which they are erased from the visit and the rest of it is kept; crawler check results no longer than 7 days. These are maximums: we may set shorter periods, never longer ones. Deletion runs automatically once a day, so a record is removed by the first daily run after its limit. Daily totals per page, device type, source, country, visitor type and mode, which contain no identifier, are kept.

If your browser sends Do Not Track or Global Privacy Control, that is final: you are never asked, no cookie is set, nothing is stored in your browser, nothing on the page can switch detailed statistics on, and at most your page loads are counted in aggregate mode as described above. This applies to everyone, including the site’s owner.

You can change your choice at any time in the “Our own site statistics” box at the end of this page. Declining takes effect immediately: the visit number in local storage is removed, later page loads are counted in aggregate mode, and the ts_vid cookie is no longer sent. Page scripts cannot delete that cookie; you can delete it in your browser’s site data settings.

To receive a copy of everything our statistics hold about your browser, or to have it deleted, contact us (see the Contact page) with the value of your ts_vid cookie, which your browser shows under this site’s cookies. We then export or delete every visit, page view, event, heatmap and replay recorded under it, any grouped error report that only your visits produced, and any crawler check result stored against your network’s hash. Page loads counted in aggregate mode carry no cookie; those that came from the same network hash as your visits lose that hash and their counting key, so they can no longer be linked to you. The daily totals contain nothing to delete.

Fonts and resources

Fonts and libraries are served from this site itself. The only third-party resource is Google Analytics, and it loads for every visitor.

Hosting logs

The hosting provider may keep standard server logs such as IP address, request time and requested page for security and operations.

Feedback form

If the feedback form is enabled and you send a message, from the form on the homepage or from the small feedback box that can appear after a few seconds, we store exactly this: the message text, the tool you suggest, your name and email address if you provide them, the language of the page you wrote from, which of the two forms you used, and the time it arrived. We use it only to read and answer your message. We do not store your IP address, browser details or any cookie with it, and we do not share it with anyone outside our team. There is no automatic deletion yet: messages are kept until we remove them, and you can ask us to delete yours.

To keep out automated spam, both forms ask a small sum before sending. The question comes from our server and the answer is checked there; nothing about it is stored, and it is not a tracking tool. Your browser remembers in local storage (ts-fbp) when the feedback box was shown, closed or used, so it does not appear on every page. That stays on your device.

A copy of each message is also emailed to the site owner’s inbox so it can be answered quickly. It is sent through our email provider, Hostinger, to an inbox hosted by Google (Gmail), so the copy is stored there too.