Who we are
The site is run by ClueTrove (كلاوتروف), based in Saudi Arabia. This policy covers the blog at cluetrove.com and the tools site at tools.cluetrove.com.
What we collect
We do not ask you to create an account, and the site has no sign-up, subscription or contact forms. On the blog we use Google Analytics to count visits (see “Analytics (blog and tools site)” below), and you can switch it off at any time. We use no advertising and no affiliate links.
Your files in the tools
ClueTrove’s file, text and calculator tools (JPG to PDF, merge and split PDF, image compressor, QR code, calculator, CV and cover-letter builders, GPA and grade calculators) process what you enter inside your browser, and their code has no function that uploads files or text to our servers. The tools site is served with a security policy (Content-Security-Policy with connect-src ‘none’) that tells the browser not to let its pages make network requests to other sites. Only the eight store check pages are excepted; they have their own policy that lets them connect to the tools site itself only (see the next paragraphs).
We tested this on the live site on 4 October 2026: from inside a tool page we tried a fetch request, a sendBeacon request, a WebSocket connection and loading an image from an external site, and the browser reported a policy violation for each attempt. Limits of this test: it was run in Chrome on one computer, and it did not cover every possible way of sending data, other browsers and devices, or browser extensions. It is therefore evidence that the policy works for what was tested, not proof that sending data is impossible.
Files stay in your browser’s memory until you close the page or choose Start over. The Image Compressor produces new files without EXIF data, such as location and camera model. A QR code holds only the text you type and does not track who scans it.
The store checks (store or product priorities report, interface and mobile, technical SEO, speed, links, images, content and structured data) take no files and no pasted text from you: you type only a store link or a product page link. They read public pages from the internet through our server, as the next paragraph describes.
What happens when you press Start the check: the link you type is sent with a POST request to a small endpoint on the tools site (tools.cluetrove.com/api/check.php). Our server then fetches a capped sample of public pages of that store (the page you entered, the home page, and up to a few category, product, policy and contact pages), the site’s robots.txt and sitemap, the product images, and up to 60 links found on those pages, so the sites involved see our hosting server’s address, not yours. The checker identifies itself as ClueTroveChecker/1.0, sends no cookies and no login, and does not fetch pages that the site’s robots.txt disallows for crawlers. To show some pages as a real phone and desktop browser would (with JavaScript on), the links of a few of those pages are passed to the Google PageSpeed Insights service, so Google receives those links and our server’s address and its own privacy policy applies. Only public pages are checked: the server refuses internal addresses and ports other than 80 and 443, verifies the destination of every redirect, and limits size, time and number of requests (about 60 page fetches, 30 robots, sitemap or theme-header files, 60 images, 600 link checks and 16 rendered measurements per visitor every 10 minutes). The report states exactly which pages were read, which could not be, and why.
Platform and theme: in the store priorities report only, the checker may recognise the store platform and theme from visible markers in pages it has already fetched (for example asset addresses and public theme identifiers). For WordPress and WooCommerce it also reads only the first 4 KB header block of the theme’s public style.css (theme name, version, parent theme) and never keeps or copies theme code. For platforms whose terms we have not yet clarified, this recognition is switched off and nothing about them is shown or kept. It never logs in, bypasses protection or collects customer data.
We do not store the links you enter or the results of these checks. The server keeps a temporary request counter in a temporary folder, holding only request times, in a file name derived from a salted hash of your IP address, and it is deleted automatically at the first later request once an hour has passed. Hostinger hosting records the usual technical request data (IP address, time and path). If the connection fails, a store blocks automated visitors, or Google’s quota is used up, the report says so with the reason, keeps what completed, and shows no estimated results.
Improvement priorities report: every store check adds its findings to the report automatically; there is no add button. The findings (title, evidence and page links) are kept in the sessionStorage of the current browser tab only, and the browser erases them when the tab is closed or when you press “Clear the report”. They are not sent anywhere, and we never see them.
Browser storage and cookies
We save your light or dark mode choice in your browser’s local storage as cluetrove-color-mode; it stays in your browser and the page does not send it to us. If you use the improvement priorities report, your findings are kept in the browser’s sessionStorage (key ct-report-v1) for that tab only until it is closed or you clear them yourself, and the page does not send them to us. We checked the response headers of blog and tools pages on 3 October 2026 and found no cookies (Set-Cookie) set for visitors. WordPress uses cookies when someone signs in to the admin area. Google Analytics also sets first-party cookies named _ga and _ga_ followed by our measurement ID on the blog and the tools site, and if you switch counting off your choice is stored in your browser’s local storage as cluetrove-consent. We have closed comments on the site.
Services loaded with the pages
Telegram: store check reports end with an optional contact button to the Telegram account published on the contact page (t.me/Abodexpress1). It is a plain link that sends nothing and loads nothing from Telegram with the page; no connection to Telegram happens unless you click it yourself, and Telegram’s privacy policy then applies. The report is complete without contacting anyone. A custom plan and implementation are paid services whose scope and price are agreed after reviewing your case; the checks and the first report are free.
Google PageSpeed Insights: when you use a store check, our server sends the links of a few of the store’s pages to this service (googleapis.com) so that Google’s browser renders them; no other tool does this.
Hosting: the site is hosted by Hostinger, whose servers log standard technical request data such as IP address, browser type and request time.
Fonts: the fonts of the blog and the tools site (Inter, Source Serif 4 and Tajawal, under the SIL Open Font License) are stored on our own servers, so loading them sends nothing to Google. Until 6 October 2026 they were loaded from Google Fonts, which received visitors’ IP addresses and browser information.
Hostinger Reach: blog pages used to load a Hostinger script intended for newsletter forms; the site has no sign-up forms. We deactivated the Hostinger Reach plugin (without deleting it) on 3 October 2026 and checked blog pages afterwards: the script no longer appears. This does not mean Hostinger records nothing: the hosting’s technical request data remains as described above.
Apart from the Google Analytics tag, the blog has no advertising or tracking pixels.
When you contact us
If you message us on Telegram (see the contact page), we can see your Telegram account name and the content of your message, and Telegram’s privacy policy applies to that conversation. We use what you send to reply to you. There is no contact form on the site and we do not publish an email address at the moment.
Analytics (blog and tools site)
The blog and the tools site use Google Analytics 4 to count visits; the blog also counts two kinds of click and the tools site counts the first press of a tool’s main button. It records the page you view, its title and referrer, your approximate location derived from your IP address (we do not see the full IP address in reports), your device, browser and language, and an identifier kept in the first-party cookies _ga and _ga_ followed by our measurement ID. The two clicks are a click on a link to the tools site and a click on our Telegram link; we never record anything you type in a tool or any file. Counting runs automatically when you visit the blog or the tools site, with no consent bar. You can switch it off at any time with the “Analytics settings” link in the blog footer, or “Stop visit counting” in the tools site footer: the analytics cookies are deleted and nothing more is sent to Google, and your choice is stored in your browser (key cluetrove-consent). You can also block cookies in your browser or use a tracker-blocking extension. We count visits and the pages read so that we can improve the content. Google Analytics is operated by Google, which processes the data and may transfer it outside your country; Google’s own privacy policy applies. We keep event data for 2 months, and we turned off Google signals and ad personalisation. The tools site (tools.cluetrove.com) also counts its visits with Google Analytics, with the same measurement ID and settings (no Google signals, no ad personalisation), in addition to a visit counter of our own described in the next section. The “Stop visit counting” link in the tools site footer stops both.
Visit counting on the tools site
The tools site counts its visits with a small counter of our own and also with Google Analytics as described in the previous section; the only extra event there is the first press of a tool’s main button, with nothing you type. Our own counter works like this: When a page opens, and the first time you press the tool’s main button on that page, your browser asks our server for a tiny image. The request carries only the page name, the kind of event (“opened” or “used”) and the domain of the site you came from. It never includes what you type, any file, any link you check, your name or your IP address, and this counter sets no cookie. Our server adds one to a daily total (per page, language, device class (phone, tablet or computer) and referring domain) and does not keep the request itself, your IP address or your browser details; to stop anyone flooding the totals it keeps, for ten minutes only, a counter of request times in a file named by a salted code that changes every day. This counter counts visits and uses; it does not know who you are and cannot tell one visitor from another. It does not run when your browser sends Do Not Track or Global Privacy Control, and you can turn it off with the “Stop visit counting” link at the bottom of every tools page (your choice is stored in your browser only). Your files and text stay in your browser; this is the only request the tool pages send to our server, and the security policy still blocks every other request to any other site.
Changes
We will update this page before adding any service that collects data, such as advertising, analytics or affiliate links. For questions about using the site, see the help page.