Privacy

The site uses Google Analytics 4 to count visits and a short list of actions. It is loaded only on tulus.studio, only once a page has finished loading, and never for an automated browser. Google signals and ad personalisation are switched off, and the property shares no data with Google for other purposes.

Google Analytics receives the pages viewed, with what it collects about any visit: the browser and device, an approximate location it derives for the visit, and the page or campaign that sent the visitor. It sets its own cookies (named _ga and _ga_ followed by an id) to recognise a returning browser.

The actions the site names are these, and nothing they carry identifies anyone:

• a case study being viewed, and the Surface and Structure switch, the X-ray and the lens being used;
• a form being started, a step reached, a form sent (with the goal chosen, never what was typed), or an error;
• a click on WhatsApp or email, and on the ways to the review or a project;
• the guide’s checklist being used: only that it was, and the share completed, never which actions were ticked;
• in Search Intelligence: a scan started (with whether an address or pasted code was checked), finished or failed (the tool, the page’s language, the number of errors and warnings, a code for a failure), a finding’s evidence opened, a change copied, a report copied, downloaded or printed.

No address you check, no host name, no report and nothing you type is sent to Google Analytics. There is no consent banner today: the analytics load without asking. A content blocker or your browser’s tracking protection stops them, and the site works the same without them.

When you send the project form or ask for a review, what you wrote is stored on the studio’s server, in a file only the form service can read. With it are kept the page the form was on, the first page of your visit and the address that sent you there, any campaign tags on that first page, your browser’s description (its user agent), and whether the page’s script was running.

Your network address is not stored. A fingerprint of it is: a SHA-256 hash made with a random value that is replaced every day and never written down. It tells submissions from one address on one day apart from others; the address cannot be recovered from it, by anyone.

Each enquiry is then mailed once, from the owner’s Gmail to the owner’s Gmail, with your email address as the one to reply to. The owner reads it and replies by email. Nothing is added to a mailing list or passed to anyone else. Enquiries are kept until they are removed by hand; ask, and yours will be.

When you check a page with Search Intelligence, the scanner, on the studio’s own machines, fetches from that site its robots.txt, the page you entered and the redirects it leads through, the address the page names as its canonical, and the sitemaps robots.txt names (or /sitemap.xml). The hreflang checker also fetches each language version the page names, from that version’s site, its robots.txt first. The SEO audit fetches, the same way, up to ten pages of the one site you entered: that page, the home page, pages it links to and pages the sitemaps list. It also asks for the site’s home page at its http:// address and at its other name, with or without “www.”, to see where they lead. It identifies itself as “Mozilla/5.0 (compatible; TulusSearchIntelligence/1.0; +https://tulus.studio/tools)”, sends no cookies or passwords, and keeps none it is given. It visits public addresses only.

It obeys robots.txt for every address it fetches besides robots.txt itself: when robots.txt asks crawlers like it not to fetch an address, it does not, and the report says so.

The report is kept on the server for 24 hours, then deleted. A cookie, tscan, lets only the browser that started a check open its report: it holds a random value, is sent only with the requests for that one report, cannot be read by the page’s scripts (HttpOnly), and expires after 24 hours. It is strictly necessary for the check you asked for, so it is set without asking. So that the report opens again when you come back to the tool’s page, this browser also remembers the last check of each tool (its id and the time it was made, never the address) for 24 hours; without the cookie, that id opens nothing.

A check of the same address made in the last ten minutes may be copied into yours instead of being fetched again, and the report then says when the original was made. Each check keeps its own copy and its own cookie; no one else can open yours.

Code pasted into the structured data checker, instead of an address, is read for that report only: nothing in it is run, and nothing it names is fetched. The report keeps short excerpts of it, never the whole code, and is deleted with them after 24 hours. As with an address, a check of the same code in the last ten minutes may be copied into yours. The scanner’s log lines say that code was checked and how large it was, never what it said.

To stop the scanner being used against a site or in bulk, each scanned site’s host name is counted, for the limits per site, and so are your network address and the block of addresses it belongs to (its first three numbers, or the first three groups of an IPv6 address), for the limits per visitor and per block. Before a check, your browser solves a small puzzle that takes it a fraction of a second, and an address that keeps being refused is refused for six hours. All of that is kept in the scanner’s memory only and never written to disk. The scanner’s log lines name the scanned site’s host name and your address’s block, never the page’s path or query, and never your full address. Its daily totals count scans per tool and per block and name no site; they are kept for 90 days. Each morning the studio’s owner receives a summary of the day before: how many checks ran, the busiest address blocks and the most-checked site names. As each check finishes, the owner also receives a short message on Telegram: the tool, the name of the site checked, the result in numbers and the address block the check came from, never the page’s path or your full address. Nothing is sold.

Like any web server, the one that serves tulus.studio writes an access log: for each request, the visitor’s network address, the time, the address asked for, the answer and its size, the page that linked to it, and the browser’s description. The log is started afresh every day, kept for 14 days, then deleted.

The form service and the scanner write their own lines to the server’s journal, which keeps them for 7 days at most. The form service’s lines carry no personal data; the scanner’s carry the host names described above.

A few things are kept in your browser, and are not sent anywhere unless said here:

• the view you chose (Surface or Structure), and whether the home page’s opening has played, for the visit;
• a form’s answers until it is sent, and where your visit began, which goes with the form when you send it;
• the guide’s checklist ticks, until you reset them;
• the last check of each Search Intelligence tool (its id and when it was made), for 24 hours, so that its report opens again;
• an address typed on the Search Intelligence hub, for the moment it takes to open the tool’s page.

TULUS.studio, Bandung, Indonesia, is responsible for this site. To ask what is kept about you, or to have an enquiry removed, write to the address below or send a WhatsApp message.

Messages to the studio’s WhatsApp number are answered first by an AI assistant, and a person from the studio follows up.

• Email: inquiry@tulus.studio
• WhatsApp: +62 818-729-290