Trust, safety and reliability
A link shortener sits between your audience and the web. Here's how we keep that position honest.
Check a link now
What this means in practice
Public link verification
Anyone can preview a GoTo.now link's destination with the link checker before clicking - No account needed.
Abuse reporting
Malicious links are removed. Report any suspicious goto.now URL via the Report URLs page and our team will review it.
Privacy-respecting analytics
Click analytics use standard server-side request data. We don't plant cross-site tracking cookies on people who click links.
Reliable redirects
Our redirect engine carries millions of links in production with headroom to spare - Because a dead link is a broken promise.
Transport security
All redirects and pages are served over HTTPS. Credentials are stored hashed; we never store plaintext passwords.
Bot transparency, private stats
Automated traffic is detected and separated in your analytics, and click statistics are visible only to the link owner - Never to the public.
How abuse handling actually works
Every report to [email protected] is reviewed by a human. Confirmed phishing, malware or fraud destinations are disabled platform-wide - The short code stops redirecting for everyone at once, which is one advantage of centralized short links: takedowns are instant and total. Repeat offenders lose accounts and API keys. Automated signals (destination scanning, creation-pattern anomalies) queue suspicious links for the same review, so enforcement doesn't wait for a victim to complain.
Our privacy posture, in one paragraph
Redirects set no advertising or cross-site tracking cookies. Click analytics are computed from standard server request data, shown in aggregate, and visible only to the link's owner - There is no public stats lookup. We don't sell data, and the Privacy Policy is written to be read, not to hide things. Destinations, on the other hand, are deliberately public: anyone can verify any link with the checker or the preview page.
Reliability you can check yourself
Our redirect engine carries millions of links in production, and it does nothing else - Pages and redirects are separated so a busy campaign day never slows your links. Pages and redirects are HTTPS-only and passwords exist only as salted hashes.
Found a security issue?
We want to hear it before anyone else does. Write to [email protected] with details; good-faith research is welcomed and we respond fast, credit gladly, and never take legal aim at honest reporters.
What we store, why, and for how long
| Data | Why | Retention |
|---|---|---|
| Account email + hashed password | Sign-in | Until you delete the account |
| Your links (slug → destination) | Redirects must work | While the link exists |
| Click records (time, referrer, UA, coarse geo) | Your private analytics | Link lifetime |
| Server logs | Security & abuse forensics | Weeks, rotated |
| Redirect-visitor cookies | - | None set |
Advice we give every link visitor
Verify before you trust: paste any goto.now link into the checker, or open goto.now/p/<code> for the preview page. Read the revealed domain character by character - Lookalikes (rn for m, 1 for l) are the oldest trick running. Urgency is the tell: real institutions don't give you two hours. And a goto.now link never requires a login to be checked - Anyone demanding credentials "to verify a link" is the scam.
For account holders
Use a password unique to GoTo.now (or just sign in with Google and let its protections work for you). We never email asking for your password. Log out on shared machines - The dashboard holds your full link history. Suspect access? Change the password in Settings; every mutation on your links requires the fresh session.
Regulation, plainly
We operate to GDPR/UK-GDPR standards - Lawful bases documented in the Privacy Policy, data-subject requests honored on the listed timelines - And we don't sell or "share" personal information in the CCPA sense. There's no advertising identity graph here to regulate: the redirect path sets no tracking cookies at all, which makes most of the scary questions simply not apply.
Our standing commitments
Takedowns of confirmed malicious links stay measured in hours, not days. Statistics stay private to link owners. Destinations stay publicly verifiable. Links never get held hostage behind a paywall. And when we get something wrong, [email protected] reaches humans who fix it and say so.