Cookie Policy
This policy explains what cookies GoTo.now sets and why. The short version: we use a session cookie for account and form security; ordinary redirects set no cross-site tracking cookies. Optional marketing tags on selected custom-domain links require a separate affirmative choice.
Cookies we set on goto.now pages
| Cookie | Purpose | Lifetime |
|---|---|---|
session |
Keeps you signed in and remembers links you created as a guest | Session / up to 30 days |
csrf_token |
Protects forms against cross-site request forgery | Session |
gtn_mkt_<domain id> |
Remembers allow or decline on a configured branded domain | Up to 6 months |
The session cookie, plainly
It's how the dashboard knows you're you between pages, and how the homepage can show a guest the links they just made. Delete it and you're simply signed out - Nothing about your links changes.
What we deliberately don't set by default
No analytics cookies of our own, advertising IDs, or fingerprinting scripts are added to ordinary redirects. GoTo.now also does not accept arbitrary scripts from link owners.
What happens when someone clicks a short link
Clicking an ordinary goto.now short link performs a standard HTTP redirect. It does not set advertising or cross-site tracking cookies. Analytics shown to link owners are computed from standard server-side request data (referrer, user agent, IP-derived coarse location) in aggregate.
On a selected link under a verified custom domain, the owner may enable a
separate sponsored page and optional Meta Pixel or AdRoll retargeting. The
choice page loads neither provider. Choosing Allow and continue stores the
versioned gtn_mkt_<domain id> choice and permits the named tags; choosing
Continue without marketing stores the decline and keeps them off. The
destination remains available either way. Provider changes invalidate the old
choice and ask again.
Third-party cookies
Public pages may load assets from CDNs subject to their policies. Meta or AdRoll may set or read cookies only after affirmative consent on a configured custom-domain link; their own policies then apply. Contextual sponsored messages do not load either provider.
Managing cookies
You can clear or block cookies in your browser settings. Blocking the session cookie means you can't stay signed in, but shortening links still works.
For more about data handling, see our Privacy Policy.
Last updated: October 6, 2026